diff --git a/.github/workflows/Scheduled-Dependabot-PRs-Auto-Merge.yml b/.github/workflows/Scheduled-Dependabot-PRs-Auto-Merge.yml
index baa7d42a1..c3f5425bc 100644
--- a/.github/workflows/Scheduled-Dependabot-PRs-Auto-Merge.yml
+++ b/.github/workflows/Scheduled-Dependabot-PRs-Auto-Merge.yml
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Install GitHub CLI
         run: |
diff --git a/.github/workflows/azd-template-validation.yml b/.github/workflows/azd-template-validation.yml
index 2e2c752fb..9d306d9ed 100644
--- a/.github/workflows/azd-template-validation.yml
+++ b/.github/workflows/azd-template-validation.yml
@@ -15,12 +15,12 @@ jobs:
     name: azd template validation
     environment: production
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set timestamp
         run: echo "HHMM=$(date -u +'%H%M')" >> $GITHUB_ENV
 
-      - uses: microsoft/template-validation-action@v0.4.3
+      - uses: microsoft/template-validation-action@9f56864b1ddbfb56dd27f3cbc71a00750cdb9a18 # v0.4.3
         with:
           validateAzd: ${{ vars.TEMPLATE_VALIDATE_AZD }}
           validateTests: ${{ vars.TEMPLATE_VALIDATE_TESTS }}
diff --git a/.github/workflows/azure-dev.yml b/.github/workflows/azure-dev.yml
index 31480f6a6..b0c7bb4f3 100644
--- a/.github/workflows/azure-dev.yml
+++ b/.github/workflows/azure-dev.yml
@@ -21,7 +21,7 @@ jobs:
       AZURE_DEV_COLLECT_TELEMETRY: ${{ vars.AZURE_DEV_COLLECT_TELEMETRY }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set timestamp and env name
         run: |
@@ -29,10 +29,10 @@ jobs:
           echo "AZURE_ENV_NAME=azd-${{ vars.AZURE_ENV_NAME }}-${HHMM}" >> $GITHUB_ENV
 
       - name: Install azd
-        uses: Azure/setup-azd@v2
+        uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2
 
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/bicep_deploy.yml b/.github/workflows/bicep_deploy.yml
index eefbf4cff..c568a0ac9 100644
--- a/.github/workflows/bicep_deploy.yml
+++ b/.github/workflows/bicep_deploy.yml
@@ -19,10 +19,10 @@ jobs:
     environment: production
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/broken-links-checker.yml b/.github/workflows/broken-links-checker.yml
index 3b19db1df..2e0ae117c 100644
--- a/.github/workflows/broken-links-checker.yml
+++ b/.github/workflows/broken-links-checker.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0
 
@@ -35,7 +35,7 @@ jobs:
       - name: Check Broken Links in Changed Markdown Files
         id: lychee-check-pr
         if: github.event_name == 'pull_request' && steps.changed-markdown-files.outputs.any_changed == 'true'
-        uses: lycheeverse/lychee-action@v2.7.0
+        uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0
         with:
           args: >
             --verbose --no-progress --exclude ^https?://
@@ -48,7 +48,7 @@ jobs:
       - name: Check Broken Links in All Markdown Files in Entire Repo (Manual Trigger)
         id: lychee-check-manual
         if: github.event_name == 'workflow_dispatch'
-        uses: lycheeverse/lychee-action@v2.7.0
+        uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0
         with:
           args: >
             --verbose --no-progress --exclude ^https?://
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 32ed2cf07..dcc1b280b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -49,16 +49,15 @@ jobs:
         # Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
         # Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
         # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
-        dot-version: ['3.1.x']
+        dotnet-version: ['3.1.x']
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
     
     # Installing DotNet version
-    - uses: actions/checkout@v6
     - name: Setup dotnet ${{ matrix.dotnet-version }}
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
       with:
         dotnet-version: ${{ matrix.dotnet-version }}
     # You can test your matrix by printing the current dotnet version
@@ -67,7 +66,7 @@ jobs:
     
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -94,6 +93,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/deploy-KMGeneric.yml b/.github/workflows/deploy-KMGeneric.yml
index 8c6684004..0cc863ccc 100644
--- a/.github/workflows/deploy-KMGeneric.yml
+++ b/.github/workflows/deploy-KMGeneric.yml
@@ -32,10 +32,10 @@ jobs:
       API_APP_URL: ${{ steps.get_output.outputs.API_APP_URL }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -218,7 +218,7 @@ jobs:
       RESOURCE_GROUP_NAME: ${{ needs.deploy.outputs.RESOURCE_GROUP_NAME }}
     steps:
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/deploy-v2.yml b/.github/workflows/deploy-v2.yml
index f235a2421..78c30a0c1 100644
--- a/.github/workflows/deploy-v2.yml
+++ b/.github/workflows/deploy-v2.yml
@@ -4,14 +4,14 @@ on:
     branches:
       - main
     paths:
-      - 'src/App/**/*.js'
-      - 'src/App/**/*.jsx'
-      - 'src/App/**/*.ts'
-      - 'src/App/**/*.tsx'
-      - 'src/App/**/*.html'
-      - 'src/App/**/*.css'
-      - 'src/App/**/*.scss'
-      - 'src/App/**/*.json'
+      - 'src/app/**/*.js'
+      - 'src/app/**/*.jsx'
+      - 'src/app/**/*.ts'
+      - 'src/app/**/*.tsx'
+      - 'src/app/**/*.html'
+      - 'src/app/**/*.css'
+      - 'src/app/**/*.scss'
+      - 'src/app/**/*.json'
       - 'src/**/*.py'
       - 'src/api/requirements.txt'
       - 'src/**/*.Dockerfile'
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 365ec8ae1..d807f53f2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.x'
 
@@ -38,7 +38,7 @@ jobs:
           touch site/.nojekyll  # Disable Jekyll processing
 
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: docs/workshop/site
diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 15f4367f5..0796852c2 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -7,7 +7,7 @@ on:
       - dev
       - demo
     paths:
-      - 'src/App/**'
+      - 'src/app/**'
       - 'src/api/**'
       - 'src/**/*.Dockerfile'
       - 'src/gunicorn.conf.py'
@@ -25,7 +25,7 @@ on:
       - dev
       - demo
     paths:
-      - 'src/App/**'
+      - 'src/app/**'
       - 'src/api/**'
       - 'src/**/*.Dockerfile'
       - 'src/gunicorn.conf.py'
@@ -46,14 +46,14 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Login to Azure
         if: ${{ (github.event_name == 'push' && (github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo')) || (github.event_name == 'workflow_dispatch' && (github.ref_name == 'dependabotchanges'||github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo')) }}
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -89,17 +89,17 @@ jobs:
        
          fi
       - name: Build and Push Docker Image for WebApp
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
-          context: ./src/App
-          file: ./src/App/WebApp.Dockerfile
+          context: ./src/app
+          file: ./src/app/WebApp.Dockerfile
           push: ${{ github.ref_name == 'main' || github.ref_name == 'dev' || github.ref_name == 'demo'  || github.ref_name == 'dependabotchanges'  }}
           tags: |
             ${{ secrets.ACR_LOGIN_SERVER || 'acrlogin.azurecr.io' }}/km-app:${{ steps.determine_tag.outputs.tagname }}
             ${{ secrets.ACR_LOGIN_SERVER || 'acrlogin.azurecr.io' }}/km-app:${{ steps.determine_tag.outputs.tagname }}_${{ steps.date.outputs.date }}_${{ github.run_number }}
 
       - name: Build and Push Docker Image for api
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: ./src/api
           file: ./src/api/ApiApp.Dockerfile
diff --git a/.github/workflows/job-azure-deploy.yml b/.github/workflows/job-azure-deploy.yml
index b71b7e245..b968b83d0 100644
--- a/.github/workflows/job-azure-deploy.yml
+++ b/.github/workflows/job-azure-deploy.yml
@@ -329,10 +329,10 @@ jobs:
           echo "Final EXP status: $EXP_ENABLED"
 
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/job-cleanup-resources.yml b/.github/workflows/job-cleanup-resources.yml
index 83a60a576..0755c49c8 100644
--- a/.github/workflows/job-cleanup-resources.yml
+++ b/.github/workflows/job-cleanup-resources.yml
@@ -55,7 +55,7 @@ jobs:
       IMAGE_TAG: ${{ inputs.image_tag }}
     steps:
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/job-deploy-linux.yml b/.github/workflows/job-deploy-linux.yml
index 3ece58123..ecfa97155 100644
--- a/.github/workflows/job-deploy-linux.yml
+++ b/.github/workflows/job-deploy-linux.yml
@@ -206,7 +206,7 @@ jobs:
           echo "✅ All input parameters validated successfully!"
 
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       
       - name: Configure Parameters Based on WAF Setting
         shell: bash
@@ -237,10 +237,10 @@ jobs:
           fi
 
       - name: Install azd
-        uses: Azure/setup-azd@v2
+        uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2
           
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -354,7 +354,7 @@ jobs:
           echo "✅ ODBC Driver 18 for SQL Server installed successfully."
 
       - name: Re-authenticate with Azure (refresh OIDC token)
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -371,7 +371,7 @@ jobs:
 
       - name: Re-authenticate with Azure before retry (refresh OIDC token)
         if: steps.run_create_agents_scripts.outcome == 'failure'
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -387,7 +387,7 @@ jobs:
           echo "✅ Create agents scripts completed successfully on retry."
 
       - name: Re-authenticate with Azure before processing sample data (refresh OIDC token)
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -404,7 +404,7 @@ jobs:
 
       - name: Re-authenticate with Azure before retry (refresh OIDC token)
         if: steps.process_sample_data.outcome == 'failure'
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/job-deploy-windows.yml b/.github/workflows/job-deploy-windows.yml
index e63c84851..31a039e68 100644
--- a/.github/workflows/job-deploy-windows.yml
+++ b/.github/workflows/job-deploy-windows.yml
@@ -209,7 +209,7 @@ jobs:
           echo "✅ All input parameters validated successfully!"
 
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Configure Parameters Based on WAF Setting
         shell: bash
@@ -240,10 +240,10 @@ jobs:
           fi
 
       - name: Setup Azure Developer CLI (Windows)
-        uses: Azure/setup-azd@v2
+        uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2
 
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -379,7 +379,7 @@ jobs:
           }
 
       - name: Re-authenticate with Azure (refresh OIDC token)
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -398,7 +398,7 @@ jobs:
 
       - name: Re-authenticate with Azure before retry (refresh OIDC token)
         if: steps.run_create_agents_scripts.outcome == 'failure'
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -416,7 +416,7 @@ jobs:
           echo "✅ Create agents scripts completed successfully on retry."
 
       - name: Re-authenticate with Azure before processing sample data (refresh OIDC token)
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -435,7 +435,7 @@ jobs:
 
       - name: Re-authenticate with Azure before retry (refresh OIDC token)
         if: steps.process_sample_data.outcome == 'failure'
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/job-docker-build.yml b/.github/workflows/job-docker-build.yml
index 1ee14faad..7d4dd2a7d 100644
--- a/.github/workflows/job-docker-build.yml
+++ b/.github/workflows/job-docker-build.yml
@@ -29,7 +29,7 @@ jobs:
       IMAGE_TAG: ${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Generate Unique Docker Image Tag
         id: generate_docker_tag
@@ -46,10 +46,10 @@ jobs:
           echo "Generated unique Docker tag: $UNIQUE_TAG"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -61,19 +61,19 @@ jobs:
           az acr login --name "$ACR_NAME"
 
       - name: Build and Push Docker Image for WebApp
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         env:
           DOCKER_BUILD_SUMMARY: false
         with:
-          context: ./src/App
-          file: ./src/App/WebApp.Dockerfile
+          context: ./src/app
+          file: ./src/app/WebApp.Dockerfile
           push: True
           tags: |
             ${{ secrets.ACR_TEST_LOGIN_SERVER }}/km-app:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}
             ${{ secrets.ACR_TEST_LOGIN_SERVER }}/km-app:${{ steps.generate_docker_tag.outputs.IMAGE_TAG }}_${{ github.run_number }}
 
       - name: Build and Push Docker Image for API
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         env:
           DOCKER_BUILD_SUMMARY: false
         with:
diff --git a/.github/workflows/job-test-automation.yml b/.github/workflows/job-test-automation.yml
index 9db1db98d..d3951c683 100644
--- a/.github/workflows/job-test-automation.yml
+++ b/.github/workflows/job-test-automation.yml
@@ -48,10 +48,10 @@ jobs:
       TEST_REPORT_URL: ${{ steps.upload_report.outputs.artifact-url }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.13'
 
@@ -193,7 +193,7 @@ jobs:
 
       - name: Upload test report
         id: upload_report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         if: ${{ !cancelled() }}
         with:
 
diff --git a/.github/workflows/pr-title-checker.yml b/.github/workflows/pr-title-checker.yml
index 67ba788b2..d386090a3 100644
--- a/.github/workflows/pr-title-checker.yml
+++ b/.github/workflows/pr-title-checker.yml
@@ -19,6 +19,6 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'merge_group' }}
     steps:
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pylint.yml b/.github/workflows/pylint.yml
index d14a7c343..24878af7a 100644
--- a/.github/workflows/pylint.yml
+++ b/.github/workflows/pylint.yml
@@ -19,10 +19,10 @@ jobs:
       matrix:
         python-version: ["3.11"]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: ${{ matrix.python-version }}
       
diff --git a/.github/workflows/stale-bot.yml b/.github/workflows/stale-bot.yml
index 85c76e855..88d0de90d 100644
--- a/.github/workflows/stale-bot.yml
+++ b/.github/workflows/stale-bot.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Mark Stale Issues and PRs
-        uses: actions/stale@v10
+        uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
         with:
           stale-issue-message: "This issue is stale because it has been open 180 days with no activity. Remove stale label or comment, or it will be closed in 30 days."
           stale-pr-message: "This PR is stale because it has been open 180 days with no activity. Please update or it will be closed in 30 days."
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           fetch-depth: 0  # Fetch full history for accurate branch checks
       - name: Fetch All Branches
@@ -75,7 +75,7 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload CSV Report of Inactive Branches
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: merged-branches-report
           path: merged_branches_report.csv
diff --git a/.github/workflows/telemetry-template-check.yml b/.github/workflows/telemetry-template-check.yml
index cf020bbdc..2b143e86e 100644
--- a/.github/workflows/telemetry-template-check.yml
+++ b/.github/workflows/telemetry-template-check.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Check for required metadata template line
         run: |
diff --git a/.github/workflows/test-automation.yml b/.github/workflows/test-automation.yml
index ac571cf51..6984037c4 100644
--- a/.github/workflows/test-automation.yml
+++ b/.github/workflows/test-automation.yml
@@ -40,10 +40,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: '3.13'
 
@@ -123,7 +123,7 @@ jobs:
 
       - name: Upload test report
         id: upload_report
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         if: ${{ !cancelled() }}
         with:
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a45f09f72..2fb2fdf57 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -79,10 +79,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/validate-bicep-params.yml b/.github/workflows/validate-bicep-params.yml
index c53caead3..232b21dd3 100644
--- a/.github/workflows/validate-bicep-params.yml
+++ b/.github/workflows/validate-bicep-params.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
 
@@ -63,7 +63,7 @@ jobs:
 
       - name: Upload validation results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: bicep-validation-results
           path: |
diff --git a/README.md b/README.md
index 17f8a45ff..62c448299 100644
--- a/README.md
+++ b/README.md
@@ -94,6 +94,8 @@ Follow the quick deploy steps on the deployment guide to deploy this solution to
 
 > **Note**: Some tenants may have additional security restrictions that run periodically and could impact the application (e.g., blocking public network access). If you experience issues or the application stops working, check if these restrictions are the cause.
 
+> **Production deployments:** This accelerator includes a Well-Architected Framework (WAF) aligned configuration (deployment flavor `avm-waf`) that enables private networking, VNet integration, private endpoints, a Bastion-accessed jumpbox, and optional zone redundancy. See [Choose Deployment Type](./docs/DeploymentGuide.md#33-choose-deployment-type-standard-vs-production).
+
 > ⚠️ **Important: Check Azure OpenAI Quota Availability**
  <br/>To ensure sufficient quota is available in your subscription, please follow the [quota check instructions guide](./docs/quota_check.md) before you deploy the solution.
 
@@ -201,6 +203,8 @@ You may want to consider additional security measures, such as:
 * Protecting the Azure App Service instance with a [Virtual Network](https://learn.microsoft.com/azure/app-service/overview-vnet-integration).
 * Configuring [App Service authentication](./docs/AppAuthentication.md) to require users to sign in.
 
+For production, deploy the **Well-Architected Framework (WAF)** aligned configuration (deployment flavor `avm-waf`), which enables private networking, VNet integration, private endpoints, a Bastion-accessed jumpbox, and optional zone redundancy. See [Choose Deployment Type](./docs/DeploymentGuide.md#33-choose-deployment-type-standard-vs-production).
+
 <br/>
 
 ### Additional documentation
diff --git a/azure.yaml b/azure.yaml
index c5530ef2a..7d059c7f9 100644
--- a/azure.yaml
+++ b/azure.yaml
@@ -53,59 +53,74 @@ hooks:
     windows:
       shell: pwsh
       run: |
-        # ── Step 0: Build & push the app images to ACR and point the App Services
-        #    at them (apps are provisioned with a placeholder hello-world image) ──
-        Write-Host ""
-        Write-Host "Building & pushing container images..." -ForegroundColor Yellow
-        & ./infra/scripts/build/build_and_push_images.ps1
-        if ($LASTEXITCODE -ne 0) {
-          Write-Host "ERROR: Image build/push failed. Fix the issue and re-run: ./infra/scripts/build/build_and_push_images.ps1" -ForegroundColor Red
-          exit 1
-        }
+        # ── Step -1: If private networking is enabled, temporarily open public
+        #    network access on data-plane resources (ACR / SQL / Storage / Cosmos)
+        #    so the steps below can reach them; always revert in the finally block ──
+        try {
+          pwsh -File ./infra/scripts/post-provision/manage-network-access.ps1 -Action Enable
+          # ── Step 0: Build & push the app images to ACR and point the App Services
+          #    at them (apps are provisioned with a placeholder hello-world image) ──
+          Write-Host ""
+          Write-Host "Building & pushing container images..." -ForegroundColor Yellow
+          pwsh -File ./infra/scripts/build/build_and_push_images.ps1
+          if ($LASTEXITCODE -ne 0) {
+            Write-Host "ERROR: Image build/push failed. Fix the issue and re-run: ./infra/scripts/build/build_and_push_images.ps1" -ForegroundColor Red
+            throw "Image build/push failed."
+          }
 
-        # Write azd env values to .env so scripts can read them
-        Write-Host "Writing .env file..." -ForegroundColor Yellow
-        azd env get-values 2>$null | ForEach-Object {
-          $_ -replace '^(\w+)="(.*)"$', '$1=$2'
-        } | Where-Object { $_ -match '=' -and $_ -notmatch 'WARNING' } | Set-Content -Path ".env" -Encoding utf8
+          # Write azd env values to .env so scripts can read them
+          Write-Host "Writing .env file..." -ForegroundColor Yellow
+          azd env get-values 2>$null | ForEach-Object {
+            $_ -replace '^(\w+)="(.*)"$', '$1=$2'
+          } | Where-Object { $_ -match '=' -and $_ -notmatch 'WARNING' } | Set-Content -Path ".env" -Encoding utf8
 
-        # ── Step 1: Python environment ──
-        Write-Host ""
-        Write-Host "Preparing Python environment..." -ForegroundColor Yellow
-        if (-not (Test-Path ".venv")) {
-          python -m venv .venv
-        }
-        & ./.venv/Scripts/Activate.ps1
-        python -m pip install --quiet --upgrade pip
-        pip install --quiet -r infra/scripts/post-provision/requirements.txt
+          # ── Step 1: Python environment ──
+          Write-Host ""
+          Write-Host "Preparing Python environment..." -ForegroundColor Yellow
+          if (-not (Test-Path ".venv")) {
+            python -m venv .venv
+          }
+          & ./.venv/Scripts/Activate.ps1
+          python -m pip install --quiet --upgrade pip
+          pip install --quiet -r infra/scripts/post-provision/requirements.txt
 
-        # ── Step 2: Grant API identity access to SQL ──
-        Write-Host ""
-        & ./infra/scripts/post-provision/setup-sql-roles.ps1
-        if ($LASTEXITCODE -ne 0) {
-          Write-Host "WARNING: SQL role assignment failed — retry later with: ./infra/scripts/post-provision/setup-sql-roles.ps1" -ForegroundColor Yellow
-        }
+          # ── Step 2: Grant API identity access to SQL ──
+          Write-Host ""
+          & ./infra/scripts/post-provision/setup-sql-roles.ps1
+          if ($LASTEXITCODE -ne 0) {
+            Write-Host "WARNING: SQL role assignment failed — retry later with: ./infra/scripts/post-provision/setup-sql-roles.ps1" -ForegroundColor Yellow
+          }
 
-        # ── Step 3: Choose use case, load data, then create the scenario agent ──
-        Write-Host ""
-        & ./infra/scripts/post-provision/setup-data.ps1 -AllowDeployedFallback
+          # ── Step 3: Choose use case, load data, then create the scenario agent ──
+          Write-Host ""
+          & ./infra/scripts/post-provision/setup-data.ps1 -AllowDeployedFallback
 
-        # ── Done ──
-        Write-Host ""
-        Write-Host "========================================" -ForegroundColor Green
-        Write-Host "  Deployment complete!" -ForegroundColor Green
-        Write-Host "========================================" -ForegroundColor Green
-        $webUrl = azd env get-value SERVICE_FRONTEND_URI 2>$null
-        if ($webUrl) {
+          # ── Done ──
           Write-Host ""
-          Write-Host "  Open: $webUrl" -ForegroundColor Cyan
+          Write-Host "========================================" -ForegroundColor Green
+          Write-Host "  Deployment complete!" -ForegroundColor Green
+          Write-Host "========================================" -ForegroundColor Green
+          $webUrl = azd env get-value SERVICE_FRONTEND_URI 2>$null
+          if ($webUrl) {
+            Write-Host ""
+            Write-Host "  Open: $webUrl" -ForegroundColor Cyan
+          }
+          Write-Host ""
+        } finally {
+          # ── Always revert network access back to private-only, even on failure ──
+          & ./infra/scripts/post-provision/manage-network-access.ps1 -Action Disable
         }
-        Write-Host ""
       continueOnError: false
       interactive: true
     posix:
       shell: sh
       run: |
+        # ── Step -1: If private networking is enabled, temporarily open public
+        #    network access on data-plane resources (ACR / SQL / Storage / Cosmos)
+        #    so the steps below can reach them; always revert on exit (success or failure) ──
+        pwsh -File ./infra/scripts/post-provision/manage-network-access.ps1 -Action Enable
+        trap 'pwsh -File ./infra/scripts/post-provision/manage-network-access.ps1 -Action Disable' EXIT
+
         # ── Step 0: Build & push the app images to ACR and point the App Services
         #    at them (apps are provisioned with a placeholder hello-world image) ──
         echo ""
diff --git a/docs/CustomizingAzdParameters.md b/docs/CustomizingAzdParameters.md
index bbb60a84c..490643157 100644
--- a/docs/CustomizingAzdParameters.md
+++ b/docs/CustomizingAzdParameters.md
@@ -25,6 +25,15 @@ After setting parameters, run `azd up` (or `azd provision`) to apply them.
 | `existingAiFoundryEndpoint` | `EXISTING_AI_FOUNDRY_ENDPOINT` | *(empty)* | Endpoint of an existing AI Foundry project to reuse. |
 | `existingAiSearchConnectionName` | `EXISTING_AI_SEARCH_CONNECTION_NAME` | *(empty)* | Name of an existing Azure AI Search connection to reuse. |
 | `adminApiKey` | `ADMIN_API_KEY` | *(empty)* | Optional admin API key for privileged operations. |
+| `deploymentFlavor` | `DEPLOYMENT_FLAVOR` | `bicep` | Infrastructure variant: `bicep`, `avm`, or `avm-waf`. See [Deployment Flavor & Production (WAF) Parameters](#deployment-flavor--production-waf-parameters). |
+| `azureAiServiceLocation` | `AZURE_ENV_AI_SERVICE_LOCATION` | *(location)* | Region for the Azure AI (OpenAI) service. |
+| `appServicePlanSku` | `AZURE_ENV_APP_SERVICE_PLAN_SKU` | `B3` | App Service Plan SKU for the backend and frontend web apps. |
+| `containerRegistryName` | `AZURE_ENV_CONTAINER_REGISTRY_NAME` | *(generated)* | Name of an existing Azure Container Registry to reuse (leave empty to create one). |
+| `backendContainerImageTag` / `frontendContainerImageTag` | `AZURE_ENV_IMAGE_TAG` | `latest` | Container image tag to deploy. |
+| `deployCosmos` | `AZURE_ENV_DEPLOY_COSMOS` | `false` | Deploy Cosmos DB alongside SQL (SQL is the primary database; not required). |
+| `existingLogAnalyticsWorkspaceId` | `AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID` | *(empty)* | Resource ID of an existing Log Analytics workspace to reuse. |
+| `existingFoundryProjectResourceId` | `AZURE_EXISTING_AIPROJECT_RESOURCE_ID` | *(empty)* | Resource ID of an existing Azure AI Foundry project to reuse. |
+| `deployingUserPrincipalType` | `DEPLOYING_USER_PRINCIPAL_TYPE` | `User` | Principal type of the deployer (`User` or `ServicePrincipal`); used for data-plane RBAC assignments. |
 
 ## Model Configuration
 
@@ -37,6 +46,42 @@ The AI model deployments are defined as parameters in [infra/main.bicep](../infr
 | `gptModelVersion` | `2025-12-11` | Version of the chat model. |
 | `deployCosmos` | `false` | Set to `true` to also deploy Cosmos DB (SQL is the primary database; not required). |
 
+## Deployment Flavor & Production (WAF) Parameters
+
+The infrastructure supports three deployment flavors, selected by the `deploymentFlavor` value in [infra/main.parameters.json](../infra/main.parameters.json):
+
+| Flavor | Description |
+|--------|-------------|
+| `bicep` | **Default.** Development / testing deployment without private networking. |
+| `avm` | Azure Verified Modules without private networking. |
+| `avm-waf` | Well-Architected Framework aligned: private networking, VNet, private endpoints, jumpbox VM + Bastion, and optional redundancy. |
+
+**How to select a flavor:** the deployment flavor is chosen by which parameters file is active — `azd` always reads `infra/main.parameters.json`. To deploy the Production (WAF) flavor, copy the WAF parameters file over the default:
+
+```powershell
+Copy-Item ./infra/main.waf.parameters.json ./infra/main.parameters.json -Force
+```
+
+```bash
+cp ./infra/main.waf.parameters.json ./infra/main.parameters.json
+```
+
+The WAF parameters file sets the following additional values. Flags without an `azd` environment variable are hard-coded in the file — edit the file directly to change them.
+
+| Parameter | azd Environment Variable | Default (WAF file) | Description |
+|-----------|--------------------------|--------------------|-------------|
+| `deploymentFlavor` | `DEPLOYMENT_FLAVOR` | `avm-waf` | Selects the WAF infrastructure variant. |
+| `enableMonitoring` | *(hard-coded)* | `true` | Application Insights + Log Analytics. |
+| `enablePrivateNetworking` | *(hard-coded)* | `true` | VNet, private endpoints, jumpbox VM, and Azure Bastion. |
+| `enableScalability` | *(hard-coded)* | `true` | Higher SKUs and autoscale settings. |
+| `enableRedundancy` | *(hard-coded)* | `false` | Zone redundancy and Log Analytics workspace replication. |
+| `enableTelemetry` | `AZURE_ENV_ENABLE_TELEMETRY` | `true` | Anonymous deployment telemetry. |
+| `vmAdminUsername` | `AZURE_ENV_VM_ADMIN_USERNAME` | *(empty)* | Jumpbox admin username (fallback; login is via Entra ID + Bastion). |
+| `vmAdminPassword` | `AZURE_ENV_VM_ADMIN_PASSWORD` | *(empty)* | Jumpbox admin password. |
+| `vmSize` | `AZURE_ENV_VM_SIZE` | `Standard_D2s_v5` | Jumpbox VM size. |
+
+> **Production prerequisite:** the WAF jumpbox VM enables host encryption, so the `EncryptionAtHost` feature must be registered on the subscription before deploying. See [Choose Deployment Type](./DeploymentGuide.md#33-choose-deployment-type-standard-vs-production) for the registration commands and VM credential setup.
+
 ## Examples
 
 **Deploy to Australia East with a specific environment name:**
@@ -64,6 +109,15 @@ azd env set AZURE_CU_LOCATION swedencentral
 azd up
 ```
 
+**Deploy the Production (WAF) configuration with VM credentials:**
+
+```shell
+Copy-Item ./infra/main.waf.parameters.json ./infra/main.parameters.json -Force
+azd env set AZURE_ENV_VM_ADMIN_USERNAME azureadmin
+azd env set AZURE_ENV_VM_ADMIN_PASSWORD <strong-password>
+azd up
+```
+
 ## Viewing Current Values
 
 ```shell
diff --git a/docs/DeploymentGuide.md b/docs/DeploymentGuide.md
index 1544d3004..a5a3dd4cf 100644
--- a/docs/DeploymentGuide.md
+++ b/docs/DeploymentGuide.md
@@ -8,6 +8,8 @@ This guide walks you through deploying the Conversation Knowledge Mining Solutio
 
 > **Note**: Some tenants may have additional security restrictions that run periodically and could impact the application (e.g., blocking public network access). If you experience issues or the application stops working, check if these restrictions are the cause.
 
+> **Deploying to production?** This accelerator includes a **Well-Architected Framework (WAF)** aligned configuration (deployment flavor `avm-waf`) that adds private networking, VNet integration, private endpoints, a Bastion-accessed jumpbox, and optional zone redundancy. Review [Step 3.3: Choose Deployment Type](#33-choose-deployment-type-standard-vs-production) before deploying.
+
 ## Step 1: Prerequisites & Setup
 
 ### 1.1 Azure Account Requirements
@@ -170,12 +172,14 @@ By default, `azd up` provisions the following resources:
 |----------|--------------------|
 | Azure AI Services (OpenAI) | gpt-5.2 (2025-12-11), text-embedding-3-small |
 | Azure AI Search | Standard (S1) |
-| Azure App Service Plan | B2 (backend), B2 (frontend) |
+| Azure App Service Plan | B3 (backend), B3 (frontend) |
 | Azure SQL Database | Basic (5 DTU) |
 | Azure Container Registry | Basic |
 | Azure Storage Account | LRS |
 | Azure AI Foundry Hub + Project | Standard |
 
+> These defaults correspond to the **Development / Testing** deployment (default `bicep` flavor). For a hardened, network-isolated deployment, see [3.3 Choose Deployment Type](#33-choose-deployment-type-standard-vs-production).
+
 ### 3.2 Advanced Configuration (Optional)
 
 <details>
@@ -198,6 +202,70 @@ To adjust quota settings, follow the [Quota Check Instructions](./quota_check.md
 
 </details>
 
+### 3.3 Choose Deployment Type (Standard vs Production)
+
+This accelerator ships two configurations. The default is optimized for development and testing; a **Well-Architected Framework (WAF)** aligned configuration adds network isolation and resiliency for production.
+
+| Aspect | Development / Testing (Default) | Production (WAF-aligned) |
+|--------|---------------------------------|--------------------------|
+| Deployment flavor | `bicep` | `avm-waf` |
+| Configuration file | `infra/main.parameters.json` (used as-is) | Copy `infra/main.waf.parameters.json` over `infra/main.parameters.json` |
+| Private networking (VNet + private endpoints) | Disabled | Enabled |
+| Jumpbox VM + Azure Bastion | No | Yes (login via Microsoft Entra ID through Bastion) |
+| Scalability (higher SKUs / autoscale) | Disabled | Enabled |
+| Zone redundancy | Disabled | Configurable (`enableRedundancy`) |
+| Monitoring (App Insights + Log Analytics) | Enabled | Enabled |
+| Relative cost | Lower | Higher |
+| Well-Architected Framework | Partial | Aligned |
+
+> A third, intermediate flavor — `avm` — uses the Azure Verified Modules **without** private networking. To use it, set `deploymentFlavor` to `avm` in the copied parameters file.
+
+**To deploy the Production (WAF) configuration:**
+
+1. **Copy the WAF parameters file over the default.** This is how the deployment flavor is selected — `azd` always reads `infra/main.parameters.json`.
+
+   - **Windows (PowerShell):**
+     ```powershell
+     Copy-Item ./infra/main.waf.parameters.json ./infra/main.parameters.json -Force
+     ```
+   - **Linux / macOS:**
+     ```bash
+     cp ./infra/main.waf.parameters.json ./infra/main.parameters.json
+     ```
+
+   > This overwrites your local `infra/main.parameters.json`. To switch back to the default (Development / Testing) deployment later, restore it with `git checkout infra/main.parameters.json`.
+
+2. **Register the `EncryptionAtHost` feature.** This is required because the WAF jumpbox VM enables host encryption. Run once per subscription and wait until the state is `Registered`:
+
+   ```shell
+   az feature register --namespace Microsoft.Compute --name EncryptionAtHost
+   az feature show --namespace Microsoft.Compute --name EncryptionAtHost --query "properties.state" -o tsv
+   az provider register --namespace Microsoft.Compute
+   ```
+
+3. **Set the jumpbox VM credentials** — see [3.4 Set VM Credentials](#34-set-vm-credentials-production-only).
+
+4. Continue with [Step 4: Deploy the Solution](#step-4-deploy-the-solution). During post-provisioning, public network access on data-plane resources is opened temporarily and then re-locked automatically (see [Step 5.1](#51-build-and-push-container-images)).
+
+### 3.4 Set VM Credentials (Production Only)
+
+The Production (WAF) configuration deploys a jumpbox virtual machine for administrative access to the private network. Sign-in to the VM is via **Microsoft Entra ID through Azure Bastion**; the admin credentials below are a required fallback for the template.
+
+```shell
+azd env set AZURE_ENV_VM_ADMIN_USERNAME <admin-username>
+azd env set AZURE_ENV_VM_ADMIN_PASSWORD <admin-password>
+```
+
+> **Password requirements:** the password must meet [Azure VM complexity rules](https://learn.microsoft.com/azure/virtual-machines/windows/faq#what-are-the-password-requirements-when-creating-a-vm-) (12–123 characters, with at least three of: lowercase, uppercase, number, special character). These values are stored in your local `azd` environment (`.azure/`) — do not commit them to source control.
+
+Optionally override the VM size (default `Standard_D2s_v5`):
+
+```shell
+azd env set AZURE_ENV_VM_SIZE Standard_D2s_v5
+```
+
+> **Note:** If you do not set these values, the template generates a non-interactive fallback username and password. Because login is through Entra ID + Bastion, you normally never use them directly.
+
 ## Step 4: Deploy the Solution
 
 💡 **Before You Start:** If you encounter any issues during deployment, check our [Troubleshooting Guide](./TroubleShootingSteps.md) for common solutions.
@@ -241,6 +309,8 @@ azd up
 3. **Azure region** - Select a region with available model quota for AI operations
 4. **Resource group** selection (create new or use existing)
 
+> **Production (WAF) deployments:** if you copied `main.waf.parameters.json` and did not pre-set the VM credentials in [Step 3.4](#34-set-vm-credentials-production-only), `azd` will additionally prompt for the jumpbox VM admin username and password during provisioning.
+
 **Expected Duration:** 10-20 minutes for default configuration
 
 `azd up` runs the hooks defined in [azure.yaml](../azure.yaml) and performs the following steps automatically — no separate manual deploy step is required:
@@ -249,7 +319,7 @@ azd up
 2. **Provision** — Creates all Azure resources using the Bicep templates in `infra/`. The backend and frontend App Services start with a temporary placeholder image.
 3. **Post-provision** — Runs automatically after provisioning:
    - Builds and pushes the API and web images to ACR and points the App Services at them ([infra/scripts/build/build_and_push_images.ps1](../infra/scripts/build/build_and_push_images.ps1))
-   - Writes the `azd` environment values to a local `.env` file
+   - Writes the `azd` environment values to a local `.env` file (already gitignored; it may contain secrets — do not commit it)
    - Creates a Python virtual environment and installs [infra/scripts/post-provision/requirements.txt](../infra/scripts/post-provision/requirements.txt)
    - Grants the API managed identity access to Azure SQL ([setup-sql-roles.ps1](../infra/scripts/post-provision/setup-sql-roles.ps1))
    - Presents the interactive data setup menu ([setup-data.ps1](../infra/scripts/post-provision/setup-data.ps1)), which prompts you to **select a scenario**. Based on your choice it uploads the sample dataset, **creates the Azure AI Foundry agents**, and wires up the search index and SQL connections. See [Step 5.2](#52-run-post-deployment-data-setup) for details.
@@ -297,6 +367,8 @@ This solution provisions a dedicated **Azure Container Registry (ACR)** in your
 
 **Expected Processing Time:** 5-10 minutes depending on network speed.
 
+> **Production (WAF) deployments:** When private networking is enabled, the Azure Container Registry and other data-plane resources have public network access disabled. The `azd up` post-provision hook runs [manage-network-access.ps1](../infra/scripts/post-provision/manage-network-access.ps1) to temporarily enable public access so images can be built/pushed and data can be loaded, then restores the private-only setting when it finishes (even if a step fails). If you re-run the build or data-setup scripts manually against a WAF deployment, run that script first with `-Action Enable` and afterwards with `-Action Disable`.
+
 ### 5.2 Run Post Deployment Data Setup
 
 During the `azd up` postprovision hook, an interactive data setup menu is presented. The hook creates the `.venv` Python environment and installs the required packages. When running data setup manually from a new shell, activate that environment first and ensure its dependencies are installed:
@@ -394,6 +466,8 @@ azd down --purge
 
 > **Note:** `azd down` permanently deletes all resource groups, data, and deployed agents. This action cannot be undone. Export any data you need before running this command.
 
+> **⚠️ WAF deployments with redundancy enabled:** If you deployed the Production (WAF) configuration with `enableRedundancy=true`, Log Analytics workspace replication is enabled. Disable workspace replication (in the Azure Portal or via the Azure CLI) **before** running `azd down`, otherwise deletion of the resource group can fail.
+
 ## Managing Multiple Environments
 
 ### Recover from Failed Deployment
diff --git a/infra/abbreviations.json b/infra/abbreviations.json
deleted file mode 100644
index 17b4b7a4a..000000000
--- a/infra/abbreviations.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "ai": {
-    "aiSearch": "srch-",
-    "aiServices": "aisa-",
-    "aiFoundry": "aif-",
-    "aiFoundryProject": "aifp-"
-  },
-  "compute": {
-    "appServicePlan": "asp-",
-    "webApp": "app-"
-  },
-  "databases": {
-    "cosmosDBDatabase": "cosmos-",
-    "sqlDatabaseServer": "sql-",
-    "sqlDatabase": "sqldb-"
-  },
-  "managementGovernance": {
-    "applicationInsights": "appi-",
-    "logAnalyticsWorkspace": "log-",
-    "resourceGroup": "rg-"
-  },
-  "storage": {
-    "storageAccount": "st"
-  }
-}
\ No newline at end of file
diff --git a/infra/avm/main.bicep b/infra/avm/main.bicep
new file mode 100644
index 000000000..b56d2b561
--- /dev/null
+++ b/infra/avm/main.bicep
@@ -0,0 +1,1020 @@
+// ============================================================================
+// main.bicep — Orchestrator
+// Description: Pure orchestrator for Conversation Knowledge Mining solution. Calls modules to deploy resources.
+//              All resource names are derived from params — no hardcoded names.
+//              This file only calls modules; no inline resource definitions.
+//              Supports WAF-aligned deployment via feature flags.
+// ============================================================================
+targetScope = 'resourceGroup'
+
+// ============================================================================
+// Parameters — Core
+// ============================================================================
+
+@minLength(3)
+@maxLength(16)
+@description('Optional. A unique application/solution name used as base for all resource naming.')
+param solutionName string = 'kmgen'
+
+@maxLength(5)
+@description('Optional. A unique text suffix appended to resource names for uniqueness.')
+param solutionUniqueText string = substring(uniqueString(subscription().id, resourceGroup().name, solutionName), 0, 5)
+
+@metadata({ azd: { type: 'location' } })
+@description('Optional. Primary Azure region for resource deployment.')
+param location string = resourceGroup().location
+
+@allowed(['australiaeast', 'swedencentral', 'southeastasia'])
+@metadata({
+  azd:{
+    type: 'location'
+    usageName: [
+      'OpenAI.GlobalStandard.gpt-5.2,150'
+      'OpenAI.GlobalStandard.text-embedding-3-small,80'
+    ]
+  }
+})
+@description('Required. Location for AI Foundry and model deployments.')
+param azureAiServiceLocation string
+
+// ============================================================================
+// Parameters — WAF Feature Flags
+// ============================================================================
+
+@description('Optional. Tags to apply to all resources.')
+param tags object = {}
+
+@description('Optional. Enable/Disable usage telemetry for AVM modules.')
+param enableTelemetry bool = true
+
+@description('Optional. Enable monitoring for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false.')
+param enableMonitoring bool = false
+
+@description('Optional. Enable private networking for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false.')
+param enablePrivateNetworking bool = false
+
+@description('Optional. Enable scalability for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false.')
+param enableScalability bool = false
+
+@description('Optional. Enable redundancy for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false.')
+param enableRedundancy bool = false
+
+// ============================================================================
+// Parameters — VM (applicable when enablePrivateNetworking = true)
+// ============================================================================
+
+@secure()
+@description('Optional. The user name for the administrator account of the virtual machine. Required by Azure at provisioning time but not used for login when Entra ID is enabled.')
+param vmAdminUsername string?
+
+@secure()
+@description('Optional. The password for the administrator account of the virtual machine. Auto-generated if not provided. Not used for login when Entra ID is enabled.')
+param vmAdminPassword string?
+
+@description('Optional. The size of the virtual machine. Defaults to Standard_D2s_v5.')
+param vmSize string = 'Standard_D2s_v5'
+
+@description('Optional. Set to true to also deploy Cosmos DB (not required — SQL is the primary database).')
+param deployCosmos bool = false
+
+// ============================================================================
+// Parameters — AI Configuration
+// ============================================================================
+
+@allowed(['Standard', 'GlobalStandard'])
+@description('Optional. GPT model deployment type.')
+param deploymentType string = 'GlobalStandard'
+
+@description('Optional. Name of the GPT model to deploy.')
+param gptModelName string = 'gpt-5.2'
+
+@description('Optional. Version of the GPT model to deploy.')
+param gptModelVersion string = '2025-12-11'
+
+@minValue(10)
+@description('Optional. Capacity of the GPT deployment (TPM in thousands).')
+param gptDeploymentCapacity int = 150
+
+@description('Optional. Name of the embedding model to deploy.')
+@allowed(['text-embedding-3-small'])
+param embeddingModel string = 'text-embedding-3-small'
+
+@minValue(10)
+@description('Optional. Capacity of the embedding model deployment.')
+param embeddingDeploymentCapacity int = 80
+
+// ============================================================================
+// Parameters — Compute
+// ============================================================================
+
+@description('Optional. Name of the Azure Container Registry. Leave empty to auto-generate a globally unique name (cr<suffix>).')
+param containerRegistryName string = ''
+
+@description('Optional. Backend container image name.')
+param backendContainerImageName string = 'km-api'
+
+@description('Optional. Backend container image tag.')
+param backendContainerImageTag string = 'latest'
+
+@description('Optional. Frontend container image name.')
+param frontendContainerImageName string = 'km-app'
+
+@description('Optional. Frontend container image tag.')
+param frontendContainerImageTag string = 'latest'
+
+@allowed(['F1', 'D1', 'B1', 'B2', 'B3', 'S1', 'S2', 'S3', 'P1', 'P2', 'P3', 'P1v3', 'P1v4'])
+@description('Optional. App Service Plan SKU.')
+param appServicePlanSku string = 'B3'
+
+@description('Kind of web app.')
+param kind string = 'app,linux,container'
+
+// ============================================================================
+// Parameters — Authentication (matches infra_old/main.bicep)
+// ============================================================================
+
+@description('Optional. Azure AD tenant ID for authentication.')
+param azureAdTenantId string = ''
+
+@description('Optional. Azure AD client ID for authentication.')
+param azureAdClientId string = ''
+
+@description('Optional. Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable.')
+@secure()
+param adminApiKey string = ''
+
+// ============================================================================
+// Parameters — Existing Resources
+// ============================================================================
+
+@description('Optional. Resource ID of an existing Log Analytics workspace (empty = create new).')
+param existingLogAnalyticsWorkspaceId string = ''
+
+@description('Optional. Resource ID of an existing AI Foundry project (empty = create new).')
+param existingFoundryProjectResourceId string = ''
+
+// ============================================================================
+// Parameters — Identity
+// ============================================================================
+
+@allowed(['User', 'ServicePrincipal'])
+@description('Optional. Principal type of the deploying user.')
+param deployingUserPrincipalType string = 'User'
+
+// ============================================================================
+// Variables
+// ============================================================================
+
+var solutionSuffix = toLower(trim(replace(replace(replace(replace(replace(replace('${solutionName}${solutionUniqueText}', '-', ''), '_', ''), '.', ''), '/', ''), ' ', ''), '*', '')))
+// ACR names are globally unique — default to a suffixed name so multiple deployments don't collide.
+var containerRegistryResourceName = !empty(containerRegistryName) ? containerRegistryName : 'acrkm${solutionSuffix}'
+var deployerInfo = deployer()
+var deployingUserPrincipalId = deployerInfo.objectId
+var deployingUserPrincipalName = deployerInfo.?userPrincipalName ?? deployerInfo.objectId
+var createdBy = contains(deployerInfo, 'userPrincipalName') ? split(deployerInfo.userPrincipalName, '@')[0] : deployerInfo.objectId
+var useExistingAIProject = !empty(existingFoundryProjectResourceId)
+
+// ========== Tags: merge caller-supplied tags with standard metadata (matching old infra) ========== //
+var existingTags = resourceGroup().tags ?? {}
+var resourceTags = union(existingTags, tags, {
+  TemplateName: 'KM-Generic'
+  CreatedBy: createdBy
+  DeploymentName: deployment().name
+  Type: enablePrivateNetworking ? 'WAF' : 'Non-WAF'
+})
+
+// ========== WAF: Region pairs for redundancy (Log Analytics replication) ========== //
+var replicaRegionPairs = {
+  australiaeast: 'australiasoutheast'
+  centralus: 'westus'
+  eastasia: 'japaneast'
+  eastus: 'centralus'
+  eastus2: 'centralus'
+  japaneast: 'eastasia'
+  northeurope: 'westeurope'
+  southeastasia: 'eastasia'
+  uksouth: 'westeurope'
+  westeurope: 'northeurope'
+}
+var replicaLocation = replicaRegionPairs[location]
+
+// ========== WAF: Region pairs for Cosmos DB zone-redundant HA ========== //
+var cosmosDbHaRegionPairs = {
+  australiaeast: 'uksouth' //'southeastasia'
+  centralus: 'eastus2'
+  eastasia: 'southeastasia'
+  eastus: 'centralus'
+  eastus2: 'centralus'
+  japaneast: 'australiaeast'
+  northeurope: 'westeurope'
+  southeastasia: 'eastasia'
+  uksouth: 'westeurope'
+  westeurope: 'northeurope'
+}
+var cosmosDbHaLocation = cosmosDbHaRegionPairs[location]
+
+// ========== WAF: Diagnostic settings helper — reused across modules ========== //
+var monitoringDiagnosticSettings = enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : []
+
+// ========== WAF: Private DNS zones for private endpoints ========== //
+var privateDnsZones = [
+  'privatelink.cognitiveservices.azure.com'
+  'privatelink.openai.azure.com'
+  'privatelink.services.ai.azure.com'
+  'privatelink.blob.${environment().suffixes.storage}'
+  'privatelink.queue.${environment().suffixes.storage}'
+  'privatelink.file.${environment().suffixes.storage}'
+  'privatelink.dfs.${environment().suffixes.storage}'
+  'privatelink.documents.azure.com'
+  'privatelink${environment().suffixes.sqlServerHostname}'
+  'privatelink.search.windows.net'
+  'privatelink.azurewebsites.net'
+  'privatelink.azurecr.io'
+]
+var dnsZoneIndex = {
+  cognitiveServices: 0
+  openAI: 1
+  aiServices: 2
+  storageBlob: 3
+  storageQueue: 4
+  storageFile: 5
+  storageDfs: 6
+  cosmosDB: 7
+  sqlServer: 8
+  search: 9
+  webApp: 10
+  containerRegistry: 11
+}
+
+// ========== Model deployments configuration ========== //
+var aiModelDeployments = [
+  {
+    name: gptModelName
+    model: gptModelName
+    sku: { name: deploymentType, capacity: gptDeploymentCapacity }
+    version: gptModelVersion
+    raiPolicyName: 'Microsoft.Default'
+  }
+  {
+    name: embeddingModel
+    model: embeddingModel
+    sku: { name: 'GlobalStandard', capacity: embeddingDeploymentCapacity }
+    version: '1'
+    raiPolicyName: 'Microsoft.Default'
+  }
+]
+
+// ============================================================================
+// Resource Group Tags (matching old infra)
+// ============================================================================
+
+resource resourceGroupTags 'Microsoft.Resources/tags@2024-11-01' = {
+  name: 'default'
+  properties: {
+    tags: resourceTags
+  }
+}
+
+// ============================================================================
+// Module: Monitoring
+// ============================================================================
+
+var useExistingLogAnalytics = !empty(existingLogAnalyticsWorkspaceId)
+
+// Existing workspace reference (for cross-subscription support)
+resource existingLogAnalyticsWorkspace 'Microsoft.OperationalInsights/workspaces@2025-07-01' existing = if (useExistingLogAnalytics) {
+  name: split(existingLogAnalyticsWorkspaceId, '/')[8]
+  scope: resourceGroup(split(existingLogAnalyticsWorkspaceId, '/')[2], split(existingLogAnalyticsWorkspaceId, '/')[4])
+}
+
+ //  ========== Log Analytics Workspace module ========== //
+module log_analytics './modules/monitoring/log-analytics.bicep' = if (enableMonitoring && !useExistingLogAnalytics) {
+  name: take('module.log-analytics.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    retentionInDays: 365
+    publicNetworkAccessForIngestion: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    publicNetworkAccessForQuery: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    enableReplication: enableRedundancy
+    replicationLocation: enableRedundancy ? replicaLocation : ''
+    dailyQuotaGb: enableRedundancy ? '150' : ''
+    dataSources: enablePrivateNetworking ? [
+      {
+        tags: tags
+        eventLogName: 'Application'
+        eventTypes: [{ eventType: 'Error' }, { eventType: 'Warning' }, { eventType: 'Information' }]
+        kind: 'WindowsEvent'
+        name: 'applicationEvent'
+      }
+      {
+        counterName: '% Processor Time'
+        instanceName: '*'
+        intervalSeconds: 60
+        kind: 'WindowsPerformanceCounter'
+        name: 'windowsPerfCounter1'
+        objectName: 'Processor'
+      }
+    ] : []
+  }
+}
+
+// ========== Resolve workspace resource ID and name — existing or new ========== //
+var logAnalyticsWorkspaceResourceId = useExistingLogAnalytics
+  ? existingLogAnalyticsWorkspace.id
+  : (enableMonitoring ? log_analytics!.outputs.resourceId : '')
+var logAnalyticsWorkspaceName = useExistingLogAnalytics
+  ? split(existingLogAnalyticsWorkspaceId, '/')[8]
+  : (enableMonitoring ? log_analytics!.outputs.name : '')
+
+// ========== App Insights module ========== //
+module app_insights './modules/monitoring/app-insights.bicep' = if (enableMonitoring) {
+  name: take('module.app-insights.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    workspaceResourceId: logAnalyticsWorkspaceResourceId
+    retentionInDays: 365
+    disableIpMasking: false
+  }
+}
+
+// ============================================================================
+// Module: Networking (WAF — conditional on enablePrivateNetworking)
+// ============================================================================
+
+module virtualNetwork './modules/networking/virtual-network.bicep' = if (enablePrivateNetworking) {
+  name: take('module.virtual-network.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+        location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    addressPrefixes: ['10.0.0.0/20'] // 4096 addresses (enough for 8 /23 subnets or 16 /24)
+    logAnalyticsWorkspaceId: logAnalyticsWorkspaceResourceId
+    resourceSuffix: solutionSuffix
+  }
+}
+
+// ========== Bastion Host — secure access to jumpbox VM ========== //
+module bastionHost './modules/networking/bastion-host.bicep' = if (enablePrivateNetworking) {
+  name: take('module.bastion-host.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    virtualNetworkResourceId: virtualNetwork!.outputs.resourceId
+    publicIPDiagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null
+    diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null
+  }
+}
+
+// ========== WAF: Maintenance Configuration for VM patching ========== //
+module maintenanceConfiguration './modules/compute/maintenance-configuration.bicep' = if (enablePrivateNetworking) {
+  name: take('module.maintenance-configuration.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+  }
+}
+
+// ========== WAF: Data Collection Rules for VM monitoring ========== //
+var dataCollectionRulesLocation = useExistingLogAnalytics
+  ? existingLogAnalyticsWorkspace!.location
+  : (enableMonitoring ? log_analytics!.outputs.location : location)
+module windowsVmDataCollectionRules './modules/monitoring/data-collection-rule.bicep' = if (enablePrivateNetworking && enableMonitoring) {
+  name: take('module.data-collection-rule.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: dataCollectionRulesLocation
+    tags: tags
+    enableTelemetry: enableTelemetry
+    logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceResourceId
+  }
+}
+
+// ========== WAF: Proximity Placement Group for VM ========== //
+var virtualMachineAvailabilityZone = 1
+module proximityPlacementGroup './modules/compute/proximity-placement-group.bicep' = if (enablePrivateNetworking) {
+  name: take('module.proximity-placement-group.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    availabilityZone: virtualMachineAvailabilityZone
+    vmSizes: [vmSize]
+  }
+}
+
+// ========== Jumpbox VM — administration access when private networking is enabled ========== //
+// ========== Login is via Microsoft Entra ID through Azure Bastion (not local credentials) ========== //
+module virtualMachine './modules/compute/virtual-machine.bicep' = if (enablePrivateNetworking) {
+  name: take('module.virtual-machine.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    vmSize: vmSize
+    availabilityZone: virtualMachineAvailabilityZone
+    adminUsername: vmAdminUsername ?? 'testvmuser'
+    adminPassword: vmAdminPassword ?? 'Vm!${uniqueString(subscription().subscriptionId, solutionName)}${guid(subscription().subscriptionId, solutionName, 'vm-admin-password')}'
+    subnetResourceId: virtualNetwork!.outputs.administrationSubnetResourceId
+    deployingUserPrincipalId: deployingUserPrincipalId
+    deployingUserPrincipalType: deployingUserPrincipalType
+    roleAssignments: [
+      {
+        roleDefinitionIdOrName: '1c0163c0-47e6-4577-8991-ea5c82e286e4' // Virtual Machine Administrator Login
+        principalId: deployingUserPrincipalId
+        principalType: deployingUserPrincipalType
+      }
+    ]
+    diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null
+    maintenanceConfigurationResourceId: maintenanceConfiguration!.outputs.resourceId
+    proximityPlacementGroupResourceId: proximityPlacementGroup!.outputs.resourceId
+    extensionMonitoringAgentConfig: enableMonitoring ? {
+      dataCollectionRuleAssociations: [
+        {
+          dataCollectionRuleResourceId: windowsVmDataCollectionRules!.outputs.resourceId
+          name: 'send-${logAnalyticsWorkspaceName}'
+        }
+      ]
+      enabled: true
+      tags: tags
+    } : null
+  }
+}
+
+// ========== Private DNS Zones — one per service, linked to VNet ========== //
+@batchSize(5)
+module privateDnsZoneDeployments './modules/networking/private-dns-zone.bicep' = [
+  for (zone, i) in privateDnsZones: if (enablePrivateNetworking) {
+    name: take('module.private-dns-zone.${split(zone, '.')[1]}.${solutionName}', 64)
+    params: {
+      name: zone
+      tags: tags
+      enableTelemetry: enableTelemetry
+      virtualNetworkLinks: [
+        {
+          name: take('vnetlink-${virtualNetwork!.outputs.name}-${split(zone, '.')[1]}', 80)
+          virtualNetworkResourceId: virtualNetwork!.outputs.resourceId
+        }
+      ]
+    }
+  }
+]
+
+// ============================================================================
+// Module: AI Services (conditional — skip if using existing project)
+// ============================================================================
+
+// ========== Existing AI Foundry reference (for cross-subscription support when using existing project) ========== //
+var aiFoundryResourceGroupName = useExistingAIProject
+  ? split(existingFoundryProjectResourceId, '/')[4]
+  : resourceGroup().name
+var aiFoundrySubscriptionId = useExistingAIProject
+  ? split(existingFoundryProjectResourceId, '/')[2]
+  : subscription().subscriptionId
+var aiFoundryResourceName = useExistingAIProject
+  ? split(existingFoundryProjectResourceId, '/')[8]
+  : ai_foundry_project!.outputs.name
+var aiProjectResourceName = useExistingAIProject
+  ? (length(split(existingFoundryProjectResourceId, '/')) > 10 ? split(existingFoundryProjectResourceId, '/')[10] : '')
+  : ai_foundry_project!.outputs.projectName
+
+// ========== Reference existing AI Foundry project (identity only) ========== //
+module existing_project_setup './modules/ai/existing-project-setup.bicep' = if (useExistingAIProject) {
+  name: take('module.existing-project-setup.${solutionName}', 64)
+  scope: resourceGroup(aiFoundrySubscriptionId, aiFoundryResourceGroupName)
+  params: {
+    name: aiFoundryResourceName
+    projectName: aiProjectResourceName
+  }
+}
+
+// ========== Deploy new AI Services account + AI Foundry project (no connections, no deployments) ========== //
+module ai_foundry_project './modules/ai/ai-foundry-project.bicep' = if (!useExistingAIProject) {
+  name: take('module.ai-foundry-project.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: azureAiServiceLocation
+    tags: tags
+    enableTelemetry: enableTelemetry
+    // Temporarily public — AI Search Knowledge Base needs to call the AI Services model endpoint for answer synthesis.
+    publicNetworkAccess: 'Enabled'
+    diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null
+    roleAssignments: [
+      {
+        roleDefinitionIdOrName: 'a97b65f3-24c7-4388-baec-2e87135dc908' // Cognitive Services User
+        principalId: deployingUserPrincipalId
+        principalType: deployingUserPrincipalType
+      }
+      {
+        roleDefinitionIdOrName: '53ca6127-db72-4b80-b1b0-d745d6d5456d' // Foundry User
+        principalId: deployingUserPrincipalId
+        principalType: deployingUserPrincipalType
+      }
+    ]
+  }
+}
+
+// ========== AI outputs (ternary: existing vs new) ========== //
+var aiFoundryEndpoint = useExistingAIProject ? existing_project_setup!.outputs.endpoint : ai_foundry_project!.outputs.endpoint
+var azureOpenAiCuEndpoint = useExistingAIProject ? existing_project_setup!.outputs.azureOpenAiCuEndpoint : ai_foundry_project!.outputs.azureOpenAiCuEndpoint
+var projectEndpoint = useExistingAIProject ? existing_project_setup!.outputs.projectEndpoint : ai_foundry_project!.outputs.projectEndpoint
+var aiFoundryResourceId = useExistingAIProject ? existing_project_setup!.outputs.resourceId : ai_foundry_project!.outputs.resourceId
+var aiProjectPrincipalId = useExistingAIProject ? existing_project_setup!.outputs.projectIdentityPrincipalId : ai_foundry_project!.outputs.projectIdentityPrincipalId
+
+// ========== AI Search connection (single call for both existing and new paths) ========== //
+module foundry_search_connection './modules/ai/ai-foundry-connection.bicep' = {
+  name: take('module.foundry-search-conn.${solutionName}', 64)
+  scope: resourceGroup(aiFoundrySubscriptionId, aiFoundryResourceGroupName)
+  params: {
+    solutionName: solutionSuffix
+    aiServicesAccountName: aiFoundryResourceName
+    projectName: aiProjectResourceName
+    category: 'CognitiveSearch'
+    target: ai_search!.outputs.endpoint
+    authType: 'AAD'
+    metadata: {
+      ApiType: 'Azure'
+      ResourceId: ai_search!.outputs.resourceId
+    }
+  }
+}
+
+// ========== Model deployments (single loop for both existing and new paths) ========== //
+@batchSize(1)
+module model_deployments './modules/ai/ai-foundry-model-deployment.bicep' = [for (deployment, i) in aiModelDeployments: {
+  name: take('module.model-deployment-${i}.${solutionName}', 64)
+  scope: resourceGroup(aiFoundrySubscriptionId, aiFoundryResourceGroupName)
+  params: {
+    aiServicesAccountName: aiFoundryResourceName
+    deploymentName: deployment.name
+    modelName: deployment.model
+    modelVersion: deployment.version
+    raiPolicyName: deployment.raiPolicyName
+    skuName: deployment.sku.name
+    skuCapacity: deployment.sku.capacity
+  }
+}]
+
+// ========== Separate PE for AI Foundry to avoid AccountProvisioningStateInvalid race condition ========== //
+module aifoundry_private_endpoint './modules/networking/private-endpoint.bicep' = if (!useExistingAIProject && enablePrivateNetworking) {
+  name: take('module.pe-ai-foundry.${solutionName}', 64)
+  dependsOn: [model_deployments,foundry_search_connection,privateDnsZoneDeployments]
+  params: {
+    name: 'pep-aif-${solutionSuffix}'
+    location: location
+    tags: tags
+    subnetResourceId: virtualNetwork!.outputs.backendSubnetResourceId
+    customNetworkInterfaceName: 'nic-aif-${solutionSuffix}'
+    privateLinkServiceConnections: [
+      {
+        name: 'pep-aif-${solutionSuffix}-connection'
+        properties: {
+          privateLinkServiceId: ai_foundry_project!.outputs.resourceId
+          groupIds: ['account']
+        }
+      }
+    ]
+    privateDnsZoneGroup: {
+      privateDnsZoneGroupConfigs: [
+        {
+          name: 'ai-services-dns-zone-cognitiveservices'
+          privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.cognitiveServices]!.outputs.resourceId
+        }
+        {
+          name: 'ai-services-dns-zone-openai'
+          privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.openAI]!.outputs.resourceId
+        }
+        {
+          name: 'ai-services-dns-zone-aiservices'
+          privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.aiServices]!.outputs.resourceId
+        }
+      ]
+    }
+  }
+}
+
+// ========== AI Search service (called by Foundry connection module, so deployed after the project) ========== //
+module ai_search './modules/ai/ai-search.bicep' = {
+  name: take('module.ai-search.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    skuName: 'standard'
+    tags: tags
+    enableTelemetry: enableTelemetry
+    // Temporarily public — Foundry Agent runtime runs outside the VNET and cannot resolve private DNS for AI Search.
+    publicNetworkAccess: 'Enabled'
+    diagnosticSettings: monitoringDiagnosticSettings
+    roleAssignments: [
+      {
+        roleDefinitionIdOrName: '8ebe5a00-799e-43f5-93ac-243d3dce84a7' // Search Index Data Contributor
+        principalId: deployingUserPrincipalId
+        principalType: deployingUserPrincipalType
+      }
+      {
+        roleDefinitionIdOrName: '7ca78c08-252a-4471-8644-bb5ff32d4ba0' // Search Service Contributor
+        principalId: deployingUserPrincipalId
+        principalType: deployingUserPrincipalType
+      }
+    ]
+    // Temporarily no private endpoint — Foundry Agent cannot resolve private DNS for AI Search.
+    privateEndpoints: []
+  }
+}
+
+// ============================================================================
+// Module: Data 
+// ============================================================================
+
+module storage_account './modules/data/storage-account.bicep' = {
+  name: take('module.storage-account.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: tags
+    enableHierarchicalNamespace: true
+    enableTelemetry: enableTelemetry
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    diagnosticSettings: monitoringDiagnosticSettings
+    containers: [
+      { name: 'data', publicAccess: 'None' }
+    ]
+    roleAssignments: [
+      {
+        roleDefinitionIdOrName: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe' // Storage Blob Data Contributor
+        principalId: deployingUserPrincipalId
+        principalType: deployingUserPrincipalType
+      }
+    ]
+    privateEndpoints: enablePrivateNetworking ? [
+      {
+        name: 'pep-blob-${solutionSuffix}'
+        customNetworkInterfaceName: 'nic-blob-${solutionSuffix}'
+        service: 'blob'
+        subnetResourceId: virtualNetwork!.outputs.backendSubnetResourceId
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            { privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.storageBlob]!.outputs.resourceId }
+          ]
+        }
+      }
+      {
+        name: 'pep-queue-${solutionSuffix}'
+        customNetworkInterfaceName: 'nic-queue-${solutionSuffix}'
+        service: 'queue'
+        subnetResourceId: virtualNetwork!.outputs.backendSubnetResourceId
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            { privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.storageQueue]!.outputs.resourceId }
+          ]
+        }
+      }
+      {
+        name: 'pep-file-${solutionSuffix}'
+        customNetworkInterfaceName: 'nic-file-${solutionSuffix}'
+        service: 'file'
+        subnetResourceId: virtualNetwork!.outputs.backendSubnetResourceId
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            { privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.storageFile]!.outputs.resourceId }
+          ]
+        }
+      }
+      {
+        name: 'pep-dfs-${solutionSuffix}'
+        customNetworkInterfaceName: 'nic-dfs-${solutionSuffix}'
+        service: 'dfs'
+        subnetResourceId: virtualNetwork!.outputs.backendSubnetResourceId
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            { privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.storageDfs]!.outputs.resourceId }
+          ]
+        }
+      }
+    ] : []
+    networkAcls: {
+      bypass: 'AzureServices, Logging, Metrics'
+      defaultAction: enablePrivateNetworking ? 'Deny' : 'Allow'
+      virtualNetworkRules: []
+    }
+  }
+}
+
+// ========== Cosmos DB module (optional — not required, SQL is the primary database) ========== //
+module cosmosDBModule './modules/data/cosmos-db-nosql.bicep' = if (deployCosmos) {
+  name: take('module.cosmos-db-nosql.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    databaseName: 'km-db'
+    containers: [
+      { name: 'chat_sessions', partitionKeyPath: '/user_id' }
+      { name: 'chat_messages', partitionKeyPath: '/session_id' }
+      { name: 'document_insights', partitionKeyPath: '/dataset_id' }
+      { name: 'enrichment_cache', partitionKeyPath: '/doc_hash' }
+    ]
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    diagnosticSettings: monitoringDiagnosticSettings
+    zoneRedundant: enableRedundancy
+    enableAutomaticFailover: enableRedundancy
+    haLocation: cosmosDbHaLocation
+    privateEndpoints: enablePrivateNetworking ? [
+      {
+        name: 'pep-cosmos-${solutionSuffix}'
+        customNetworkInterfaceName: 'nic-cosmos-${solutionSuffix}'
+        service: 'Sql'
+        subnetResourceId: virtualNetwork!.outputs.backendSubnetResourceId
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            { privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.cosmosDB]!.outputs.resourceId }
+          ]
+        }
+      }
+    ] : []
+  }
+}
+
+// ========== SQL Database module ========== //
+module sqlDBModule './modules/data/sql-database.bicep' = {
+  name: take('module.sql-db.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    name: 'sql-${solutionSuffix}'
+    databaseName: 'sqldb-${solutionSuffix}'
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    deployerPrincipalId: deployingUserPrincipalId
+    deployerPrincipalName: deployingUserPrincipalName
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    privateEndpoints: enablePrivateNetworking ? [
+      {
+        name: 'pep-sql-${solutionSuffix}'
+        customNetworkInterfaceName: 'nic-sql-${solutionSuffix}'
+        service: 'sqlServer'
+        subnetResourceId: virtualNetwork!.outputs.backendSubnetResourceId
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            { privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.sqlServer]!.outputs.resourceId }
+          ]
+        }
+      }
+    ] : []
+  }
+}
+
+// ============================================================================
+// Module: Compute
+// ============================================================================
+
+module hostingplan './modules/compute/app-service-plan.bicep' = {
+  name: take('module.app-service-plan.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    skuName: (enableScalability || enableRedundancy) ? 'P1v3' : appServicePlanSku
+    skuCapacity: enableScalability ? 3 : 1
+    zoneRedundant: enableRedundancy
+    diagnosticSettings: monitoringDiagnosticSettings
+  }
+}
+
+// ========== Container Registry module (dedicated ACR for application images) ========== //
+module container_registry './modules/compute/container-registry.bicep' = {
+  name: take('module.container-registry.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    name: containerRegistryResourceName
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    sku: enablePrivateNetworking ? 'Premium' : 'Standard'
+    // App Services pull images with their system-assigned managed identity (AcrPull granted in
+    // the role-assignments module). Grant the deployer AcrPush so the post-provision build/push
+    // step needs no manual RBAC.
+    adminUserEnabled: false
+    acrPushPrincipalIds: [deployingUserPrincipalId]
+    acrPushPrincipalType: deployingUserPrincipalType == 'User' ? 'User' : 'ServicePrincipal'
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    networkRuleSetDefaultAction: enablePrivateNetworking ? 'Deny' : 'Allow'
+    privateEndpoints: enablePrivateNetworking ? [
+      {
+        name: 'pep-${containerRegistryResourceName}'
+        customNetworkInterfaceName: 'nic-${containerRegistryResourceName}'
+        subnetResourceId: virtualNetwork!.outputs.backendSubnetResourceId
+        service: 'registry'
+        privateDnsZoneGroup: {
+          privateDnsZoneGroupConfigs: [
+            { privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.containerRegistry]!.outputs.resourceId }
+          ]
+        }
+      }
+    ] : []
+  }
+}
+
+var placeholderImageName = 'DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
+
+// ========== Backend Deployment ========== //
+module backend_docker './modules/compute/app-service.bicep' = {
+  name: take('module.app-service-backend.${solutionName}', 64)
+  params: {
+    solutionName: 'api-${solutionSuffix}'
+    location: location
+    tags: union(tags, { 'azd-service-name': 'api' })
+    enableTelemetry: enableTelemetry
+    serverFarmResourceId: hostingplan!.outputs.resourceId
+    kind: kind
+    linuxFxVersion: placeholderImageName
+    virtualNetworkSubnetId: enablePrivateNetworking ? virtualNetwork!.outputs.webserverfarmSubnetResourceId : ''
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    vnetRouteAllEnabled: enablePrivateNetworking ? true : false
+    imagePullTraffic: enablePrivateNetworking ? true : false
+    contentShareTraffic: enablePrivateNetworking ? true : false
+    privateEndpoints: enablePrivateNetworking ? [
+      {
+        name: 'pep-api-${solutionSuffix}'
+        customNetworkInterfaceName: 'nic-api-${solutionSuffix}'
+        subnetResourceId: virtualNetwork!.outputs.backendSubnetResourceId
+        service: 'sites'
+        privateDnsZoneGroup: {
+              privateDnsZoneGroupConfigs: [
+                { privateDnsZoneResourceId: privateDnsZoneDeployments[dnsZoneIndex.webApp]!.outputs.resourceId }
+              ]
+            }
+      }
+    ] : []
+    diagnosticSettings: monitoringDiagnosticSettings
+    managedIdentities: { systemAssigned: true }
+    acrUseManagedIdentityCreds: true
+    appSettings: {
+      WEBSITES_PORT: '8000'
+      AZURE_OPENAI_ENDPOINT: aiFoundryEndpoint
+      AZURE_OPENAI_CHAT_DEPLOYMENT: gptModelName
+      AZURE_OPENAI_EMBEDDING_DEPLOYMENT: embeddingModel
+      AZURE_SEARCH_ENDPOINT: ai_search.outputs.endpoint
+      AZURE_SEARCH_INDEX_NAME: 'knowledge-mining-index'
+      AZURE_CONTENT_UNDERSTANDING_ENDPOINT: azureOpenAiCuEndpoint
+      AZURE_STORAGE_ACCOUNT: storage_account.outputs.name
+      AZURE_SQL_SERVER: sqlDBModule!.outputs.serverFqdn
+      AZURE_SQL_DATABASE: sqlDBModule!.outputs.databaseName
+      AZURE_COSMOS_ENDPOINT: deployCosmos ? cosmosDBModule!.outputs.endpoint : ''
+      AZURE_COSMOS_DATABASE: deployCosmos ? 'km-db' : ''
+      AZURE_AD_TENANT_ID: azureAdTenantId
+      AZURE_AD_CLIENT_ID: azureAdClientId
+      AZURE_AI_AGENT_ENDPOINT: projectEndpoint
+      AZURE_AI_SEARCH_CONNECTION_NAME: foundry_search_connection.outputs.connectionName
+      API_APP_NAME: 'api-${solutionSuffix}'
+      APP_FRONTEND_HOSTNAME: 'https://app-${solutionSuffix}.azurewebsites.net'
+      APP_ENV: 'Prod'
+      ADMIN_API_KEY: adminApiKey
+      SOLUTION_SUFFIX: solutionSuffix
+      APPLICATIONINSIGHTS_CONNECTION_STRING: enableMonitoring ? app_insights!.outputs.connectionString : ''
+    }
+  }
+}
+
+// Frontend
+module frontend_docker './modules/compute/app-service.bicep' = {
+  name: take('module.app-service-frontend.${solutionName}', 64)
+  params: {
+    solutionName: 'app-${solutionSuffix}'
+    location: location
+    tags: union(tags, { 'azd-service-name': 'webapp' })
+    enableTelemetry: enableTelemetry
+    serverFarmResourceId: hostingplan!.outputs.resourceId
+    kind: kind
+    linuxFxVersion: placeholderImageName
+    vnetRouteAllEnabled: enablePrivateNetworking ? true : false
+    imagePullTraffic: enablePrivateNetworking ? true : false
+    contentShareTraffic: enablePrivateNetworking ? true : false
+    virtualNetworkSubnetId: enablePrivateNetworking ? virtualNetwork!.outputs.webserverfarmSubnetResourceId : ''
+    publicNetworkAccess: 'Enabled'
+    diagnosticSettings: monitoringDiagnosticSettings
+    managedIdentities: { systemAssigned: true }
+    acrUseManagedIdentityCreds: true
+    appSettings: {
+      WEBSITES_PORT: '80'
+      APPLICATIONINSIGHTS_CONNECTION_STRING: enableMonitoring ? app_insights!.outputs.connectionString : ''
+      APP_API_BASE_URL: enablePrivateNetworking ? '' : 'https://api-${solutionSuffix}.azurewebsites.net'
+      BACKEND_API_HOST: enablePrivateNetworking ? 'api-${solutionSuffix}.azurewebsites.net' : ''
+    }
+  }
+}
+
+// ============================================================================
+// Module: Role Assignments (centralized)
+// ============================================================================
+
+module role_assignments './modules/identity/role-assignments.bicep' = {
+  name: take('module.role-assignments.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    useExistingAIProject: useExistingAIProject
+    existingFoundryProjectResourceId: existingFoundryProjectResourceId
+    aiFoundryResourceId: !useExistingAIProject ? aiFoundryResourceId : ''
+    aiSearchResourceId: ai_search.outputs.resourceId
+    storageAccountResourceId: storage_account.outputs.resourceId
+    aiProjectPrincipalId: aiProjectPrincipalId
+    aiSearchPrincipalId: ai_search.outputs.identityPrincipalId
+    backendAppServicePrincipalId: backend_docker!.outputs.identityPrincipalId
+    cosmosDbAccountName: deployCosmos ? cosmosDBModule!.outputs.name : ''
+    containerRegistryResourceId: container_registry.outputs.resourceId
+    acrPullPrincipals: [
+      { principalId: backend_docker!.outputs.identityPrincipalId, principalType: 'ServicePrincipal' }
+      { principalId: frontend_docker!.outputs.identityPrincipalId, principalType: 'ServicePrincipal' }
+    ]
+  }
+}
+
+// ============================================================================
+// Outputs (matches infra_old/main.bicep output list)
+// ============================================================================
+
+@description('Azure OpenAI endpoint URL.')
+output AZURE_OPENAI_ENDPOINT string = aiFoundryEndpoint
+
+@description('Azure AI Search endpoint URL.')
+output AZURE_SEARCH_ENDPOINT string = ai_search.outputs.endpoint
+
+@description('Azure Content Understanding endpoint URL.')
+output AZURE_CONTENT_UNDERSTANDING_ENDPOINT string = azureOpenAiCuEndpoint
+
+@description('Azure Storage account name.')
+output AZURE_STORAGE_ACCOUNT string = storage_account.outputs.name
+
+@description('Azure SQL Server FQDN.')
+output AZURE_SQL_SERVER string = sqlDBModule!.outputs.serverFqdn
+
+@description('Azure SQL Database name.')
+output AZURE_SQL_DATABASE string = sqlDBModule!.outputs.databaseName
+
+@description('Backend API application (and SQL contained user) name.')
+output API_APP_NAME string = backend_docker!.outputs.name
+
+@description('Backend API system-assigned managed identity principal ID.')
+output AZURE_API_PRINCIPAL_ID string = backend_docker!.outputs.identityPrincipalId
+
+@description('Azure Cosmos DB endpoint.')
+output AZURE_COSMOS_ENDPOINT string = deployCosmos ? cosmosDBModule!.outputs.endpoint : ''
+
+@description('Azure AI Agent endpoint URL.')
+output AZURE_AI_AGENT_ENDPOINT string = projectEndpoint
+
+@description('Backend API application URL.')
+output API_APP_URL string = backend_docker!.outputs.appUrl
+
+@description('Frontend web application URL.')
+output WEB_APP_URL string = frontend_docker!.outputs.appUrl
+
+@description('Backend service URI (used by azd).')
+output SERVICE_BACKEND_URI string = backend_docker!.outputs.appUrl
+
+@description('Frontend service URI (used by azd).')
+output SERVICE_FRONTEND_URI string = frontend_docker!.outputs.appUrl
+
+@description('AI Search connection name in AI Foundry.')
+output AZURE_AI_SEARCH_CONNECTION_NAME string = foundry_search_connection.outputs.connectionName
+
+@description('Azure Container Registry name.')
+output ACR_NAME string = container_registry.outputs.name
+
+@description('Azure Container Registry login server URL.')
+output ACR_LOGIN_SERVER string = container_registry.outputs.loginServer
+
+@description('Backend container image repository name to build and push to ACR.')
+output BACKEND_CONTAINER_IMAGE_NAME string = backendContainerImageName
+
+@description('Backend container image tag to build and push to ACR.')
+output BACKEND_CONTAINER_IMAGE_TAG string = backendContainerImageTag
+
+@description('Frontend container image repository name to build and push to ACR.')
+output FRONTEND_CONTAINER_IMAGE_NAME string = frontendContainerImageName
+
+@description('Frontend container image tag to build and push to ACR.')
+output FRONTEND_CONTAINER_IMAGE_TAG string = frontendContainerImageTag
+
+@description('Frontend web application (App Service) name.')
+output FRONTEND_APP_NAME string = frontend_docker!.outputs.name
+
+@description('Resource group name.')
+output RESOURCE_GROUP_NAME string = resourceGroup().name
+
+@description('Solution resource token suffix used in resource names.')
+output SOLUTION_SUFFIX string = solutionSuffix
diff --git a/infra/avm/main.json b/infra/avm/main.json
new file mode 100644
index 000000000..49b4c84a3
--- /dev/null
+++ b/infra/avm/main.json
@@ -0,0 +1,91485 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.46.1.21595",
+      "templateHash": "18245163229009051860"
+    }
+  },
+  "parameters": {
+    "solutionName": {
+      "type": "string",
+      "defaultValue": "kmgen",
+      "minLength": 3,
+      "maxLength": 16,
+      "metadata": {
+        "description": "Optional. A unique application/solution name used as base for all resource naming."
+      }
+    },
+    "solutionUniqueText": {
+      "type": "string",
+      "defaultValue": "[substring(uniqueString(subscription().id, resourceGroup().name, parameters('solutionName')), 0, 5)]",
+      "maxLength": 5,
+      "metadata": {
+        "description": "Optional. A unique text suffix appended to resource names for uniqueness."
+      }
+    },
+    "location": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "azd": {
+          "type": "location"
+        },
+        "description": "Optional. Primary Azure region for resource deployment."
+      }
+    },
+    "azureAiServiceLocation": {
+      "type": "string",
+      "allowedValues": [
+        "australiaeast",
+        "swedencentral",
+        "southeastasia"
+      ],
+      "metadata": {
+        "azd": {
+          "type": "location",
+          "usageName": [
+            "OpenAI.GlobalStandard.gpt-5.2,150",
+            "OpenAI.GlobalStandard.text-embedding-3-small,80"
+          ]
+        },
+        "description": "Required. Location for AI Foundry and model deployments."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "defaultValue": {},
+      "metadata": {
+        "description": "Optional. Tags to apply to all resources."
+      }
+    },
+    "enableTelemetry": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Enable/Disable usage telemetry for AVM modules."
+      }
+    },
+    "enableMonitoring": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enable monitoring for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
+      }
+    },
+    "enablePrivateNetworking": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enable private networking for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
+      }
+    },
+    "enableScalability": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enable scalability for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
+      }
+    },
+    "enableRedundancy": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enable redundancy for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
+      }
+    },
+    "vmAdminUsername": {
+      "type": "securestring",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The user name for the administrator account of the virtual machine. Required by Azure at provisioning time but not used for login when Entra ID is enabled."
+      }
+    },
+    "vmAdminPassword": {
+      "type": "securestring",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. The password for the administrator account of the virtual machine. Auto-generated if not provided. Not used for login when Entra ID is enabled."
+      }
+    },
+    "vmSize": {
+      "type": "string",
+      "defaultValue": "Standard_D2s_v5",
+      "metadata": {
+        "description": "Optional. The size of the virtual machine. Defaults to Standard_D2s_v5."
+      }
+    },
+    "deployCosmos": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Set to true to also deploy Cosmos DB (not required — SQL is the primary database)."
+      }
+    },
+    "deploymentType": {
+      "type": "string",
+      "defaultValue": "GlobalStandard",
+      "allowedValues": [
+        "Standard",
+        "GlobalStandard"
+      ],
+      "metadata": {
+        "description": "Optional. GPT model deployment type."
+      }
+    },
+    "gptModelName": {
+      "type": "string",
+      "defaultValue": "gpt-5.2",
+      "metadata": {
+        "description": "Optional. Name of the GPT model to deploy."
+      }
+    },
+    "gptModelVersion": {
+      "type": "string",
+      "defaultValue": "2025-12-11",
+      "metadata": {
+        "description": "Optional. Version of the GPT model to deploy."
+      }
+    },
+    "gptDeploymentCapacity": {
+      "type": "int",
+      "defaultValue": 150,
+      "minValue": 10,
+      "metadata": {
+        "description": "Optional. Capacity of the GPT deployment (TPM in thousands)."
+      }
+    },
+    "embeddingModel": {
+      "type": "string",
+      "defaultValue": "text-embedding-3-small",
+      "allowedValues": [
+        "text-embedding-3-small"
+      ],
+      "metadata": {
+        "description": "Optional. Name of the embedding model to deploy."
+      }
+    },
+    "embeddingDeploymentCapacity": {
+      "type": "int",
+      "defaultValue": 80,
+      "minValue": 10,
+      "metadata": {
+        "description": "Optional. Capacity of the embedding model deployment."
+      }
+    },
+    "containerRegistryName": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Name of the Azure Container Registry. Leave empty to auto-generate a globally unique name (cr<suffix>)."
+      }
+    },
+    "backendContainerImageName": {
+      "type": "string",
+      "defaultValue": "km-api",
+      "metadata": {
+        "description": "Optional. Backend container image name."
+      }
+    },
+    "backendContainerImageTag": {
+      "type": "string",
+      "defaultValue": "latest",
+      "metadata": {
+        "description": "Optional. Backend container image tag."
+      }
+    },
+    "frontendContainerImageName": {
+      "type": "string",
+      "defaultValue": "km-app",
+      "metadata": {
+        "description": "Optional. Frontend container image name."
+      }
+    },
+    "frontendContainerImageTag": {
+      "type": "string",
+      "defaultValue": "latest",
+      "metadata": {
+        "description": "Optional. Frontend container image tag."
+      }
+    },
+    "appServicePlanSku": {
+      "type": "string",
+      "defaultValue": "B3",
+      "allowedValues": [
+        "F1",
+        "D1",
+        "B1",
+        "B2",
+        "B3",
+        "S1",
+        "S2",
+        "S3",
+        "P1",
+        "P2",
+        "P3",
+        "P1v3",
+        "P1v4"
+      ],
+      "metadata": {
+        "description": "Optional. App Service Plan SKU."
+      }
+    },
+    "kind": {
+      "type": "string",
+      "defaultValue": "app,linux,container",
+      "metadata": {
+        "description": "Kind of web app."
+      }
+    },
+    "azureAdTenantId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Azure AD tenant ID for authentication."
+      }
+    },
+    "azureAdClientId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Azure AD client ID for authentication."
+      }
+    },
+    "adminApiKey": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable."
+      }
+    },
+    "existingLogAnalyticsWorkspaceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Resource ID of an existing Log Analytics workspace (empty = create new)."
+      }
+    },
+    "existingFoundryProjectResourceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Resource ID of an existing AI Foundry project (empty = create new)."
+      }
+    },
+    "deployingUserPrincipalType": {
+      "type": "string",
+      "defaultValue": "User",
+      "allowedValues": [
+        "User",
+        "ServicePrincipal"
+      ],
+      "metadata": {
+        "description": "Optional. Principal type of the deploying user."
+      }
+    }
+  },
+  "variables": {
+    "solutionSuffix": "[toLower(trim(replace(replace(replace(replace(replace(replace(format('{0}{1}', parameters('solutionName'), parameters('solutionUniqueText')), '-', ''), '_', ''), '.', ''), '/', ''), ' ', ''), '*', '')))]",
+    "containerRegistryResourceName": "[if(not(empty(parameters('containerRegistryName'))), parameters('containerRegistryName'), format('acrkm{0}', variables('solutionSuffix')))]",
+    "deployerInfo": "[deployer()]",
+    "deployingUserPrincipalId": "[variables('deployerInfo').objectId]",
+    "deployingUserPrincipalName": "[coalesce(tryGet(variables('deployerInfo'), 'userPrincipalName'), variables('deployerInfo').objectId)]",
+    "createdBy": "[if(contains(variables('deployerInfo'), 'userPrincipalName'), split(variables('deployerInfo').userPrincipalName, '@')[0], variables('deployerInfo').objectId)]",
+    "useExistingAIProject": "[not(empty(parameters('existingFoundryProjectResourceId')))]",
+    "existingTags": "[coalesce(resourceGroup().tags, createObject())]",
+    "resourceTags": "[union(variables('existingTags'), parameters('tags'), createObject('TemplateName', 'KM-Generic', 'CreatedBy', variables('createdBy'), 'DeploymentName', deployment().name, 'Type', if(parameters('enablePrivateNetworking'), 'WAF', 'Non-WAF')))]",
+    "replicaRegionPairs": {
+      "australiaeast": "australiasoutheast",
+      "centralus": "westus",
+      "eastasia": "japaneast",
+      "eastus": "centralus",
+      "eastus2": "centralus",
+      "japaneast": "eastasia",
+      "northeurope": "westeurope",
+      "southeastasia": "eastasia",
+      "uksouth": "westeurope",
+      "westeurope": "northeurope"
+    },
+    "replicaLocation": "[variables('replicaRegionPairs')[parameters('location')]]",
+    "cosmosDbHaRegionPairs": {
+      "australiaeast": "uksouth",
+      "centralus": "eastus2",
+      "eastasia": "southeastasia",
+      "eastus": "centralus",
+      "eastus2": "centralus",
+      "japaneast": "australiaeast",
+      "northeurope": "westeurope",
+      "southeastasia": "eastasia",
+      "uksouth": "westeurope",
+      "westeurope": "northeurope"
+    },
+    "cosmosDbHaLocation": "[variables('cosmosDbHaRegionPairs')[parameters('location')]]",
+    "privateDnsZones": [
+      "privatelink.cognitiveservices.azure.com",
+      "privatelink.openai.azure.com",
+      "privatelink.services.ai.azure.com",
+      "[format('privatelink.blob.{0}', environment().suffixes.storage)]",
+      "[format('privatelink.queue.{0}', environment().suffixes.storage)]",
+      "[format('privatelink.file.{0}', environment().suffixes.storage)]",
+      "[format('privatelink.dfs.{0}', environment().suffixes.storage)]",
+      "privatelink.documents.azure.com",
+      "[format('privatelink{0}', environment().suffixes.sqlServerHostname)]",
+      "privatelink.search.windows.net",
+      "privatelink.azurewebsites.net",
+      "privatelink.azurecr.io"
+    ],
+    "dnsZoneIndex": {
+      "cognitiveServices": 0,
+      "openAI": 1,
+      "aiServices": 2,
+      "storageBlob": 3,
+      "storageQueue": 4,
+      "storageFile": 5,
+      "storageDfs": 6,
+      "cosmosDB": 7,
+      "sqlServer": 8,
+      "search": 9,
+      "webApp": 10,
+      "containerRegistry": 11
+    },
+    "aiModelDeployments": [
+      {
+        "name": "[parameters('gptModelName')]",
+        "model": "[parameters('gptModelName')]",
+        "sku": {
+          "name": "[parameters('deploymentType')]",
+          "capacity": "[parameters('gptDeploymentCapacity')]"
+        },
+        "version": "[parameters('gptModelVersion')]",
+        "raiPolicyName": "Microsoft.Default"
+      },
+      {
+        "name": "[parameters('embeddingModel')]",
+        "model": "[parameters('embeddingModel')]",
+        "sku": {
+          "name": "GlobalStandard",
+          "capacity": "[parameters('embeddingDeploymentCapacity')]"
+        },
+        "version": "1",
+        "raiPolicyName": "Microsoft.Default"
+      }
+    ],
+    "useExistingLogAnalytics": "[not(empty(parameters('existingLogAnalyticsWorkspaceId')))]",
+    "virtualMachineAvailabilityZone": 1,
+    "aiFoundryResourceGroupName": "[if(variables('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], resourceGroup().name)]",
+    "aiFoundrySubscriptionId": "[if(variables('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], subscription().subscriptionId)]",
+    "placeholderImageName": "DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
+  },
+  "resources": {
+    "resourceGroupTags": {
+      "type": "Microsoft.Resources/tags",
+      "apiVersion": "2024-11-01",
+      "name": "default",
+      "properties": {
+        "tags": "[variables('resourceTags')]"
+      }
+    },
+    "existingLogAnalyticsWorkspace": {
+      "condition": "[variables('useExistingLogAnalytics')]",
+      "existing": true,
+      "type": "Microsoft.OperationalInsights/workspaces",
+      "apiVersion": "2025-07-01",
+      "subscriptionId": "[split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2]]",
+      "resourceGroup": "[split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]]",
+      "name": "[split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]]"
+    },
+    "log_analytics": {
+      "condition": "[and(parameters('enableMonitoring'), not(variables('useExistingLogAnalytics')))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.log-analytics.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "retentionInDays": {
+            "value": 365
+          },
+          "publicNetworkAccessForIngestion": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "publicNetworkAccessForQuery": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "enableReplication": {
+            "value": "[parameters('enableRedundancy')]"
+          },
+          "replicationLocation": "[if(parameters('enableRedundancy'), createObject('value', variables('replicaLocation')), createObject('value', ''))]",
+          "dailyQuotaGb": "[if(parameters('enableRedundancy'), createObject('value', '150'), createObject('value', ''))]",
+          "dataSources": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('tags', parameters('tags'), 'eventLogName', 'Application', 'eventTypes', createArray(createObject('eventType', 'Error'), createObject('eventType', 'Warning'), createObject('eventType', 'Information')), 'kind', 'WindowsEvent', 'name', 'applicationEvent'), createObject('counterName', '% Processor Time', 'instanceName', '*', 'intervalSeconds', 60, 'kind', 'WindowsPerformanceCounter', 'name', 'windowsPerfCounter1', 'objectName', 'Processor'))), createObject('value', createArray()))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "5005969515455354504"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('log-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the Log Analytics workspace. Defaults to log-{solutionName}."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "retentionInDays": {
+              "type": "int",
+              "defaultValue": 365,
+              "metadata": {
+                "description": "Retention period in days. WAF recommends 365."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "PerGB2018",
+              "metadata": {
+                "description": "SKU name for the workspace."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "publicNetworkAccessForIngestion": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access for ingestion."
+              }
+            },
+            "publicNetworkAccessForQuery": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access for query."
+              }
+            },
+            "enableReplication": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable workspace replication for redundancy."
+              }
+            },
+            "replicationLocation": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Replication location (paired region)."
+              }
+            },
+            "dailyQuotaGb": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Daily quota in GB. WAF recommends 150 GB/day as starting point."
+              }
+            },
+            "dataSources": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Data sources for VM monitoring (Windows events, perf counters)."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "resources": {
+            "workspace": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.operational-insights.workspace.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "dataRetention": {
+                    "value": "[parameters('retentionInDays')]"
+                  },
+                  "skuName": {
+                    "value": "[parameters('skuName')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "features": {
+                    "value": {
+                      "enableLogAccessUsingOnlyResourcePermissions": true
+                    }
+                  },
+                  "diagnosticSettings": {
+                    "value": [
+                      {
+                        "useThisWorkspace": true
+                      }
+                    ]
+                  },
+                  "publicNetworkAccessForIngestion": {
+                    "value": "[parameters('publicNetworkAccessForIngestion')]"
+                  },
+                  "publicNetworkAccessForQuery": {
+                    "value": "[parameters('publicNetworkAccessForQuery')]"
+                  },
+                  "dailyQuotaGb": "[if(not(empty(parameters('dailyQuotaGb'))), createObject('value', parameters('dailyQuotaGb')), createObject('value', null()))]",
+                  "replication": "[if(parameters('enableReplication'), createObject('value', createObject('enabled', true(), 'location', parameters('replicationLocation'))), createObject('value', null()))]",
+                  "dataSources": "[if(not(empty(parameters('dataSources'))), createObject('value', parameters('dataSources')), createObject('value', null()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.39.26.7824",
+                      "templateHash": "14099489006827800075"
+                    },
+                    "name": "Log Analytics Workspaces",
+                    "description": "This module deploys a Log Analytics Workspace."
+                  },
+                  "definitions": {
+                    "diagnosticSettingType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "useThisWorkspace": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      }
+                    },
+                    "gallerySolutionType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
+                          }
+                        },
+                        "plan": {
+                          "$ref": "#/definitions/solutionPlanType",
+                          "metadata": {
+                            "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the gallery solutions to be created in the log analytics workspace."
+                      }
+                    },
+                    "storageInsightsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the storage account to be linked."
+                          }
+                        },
+                        "containers": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The names of the blob containers that the workspace should read."
+                          }
+                        },
+                        "tables": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. List of tables to be read by the workspace."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the storage insights configuration."
+                      }
+                    },
+                    "linkedServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the linked service. E.g., 'Automation' for an automation account, or 'Cluster' for a Log Analytics Cluster."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require read access (e.g., Automation Accounts)."
+                          }
+                        },
+                        "writeAccessResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require write access (e.g., Log Analytics Clusters)."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the linked service."
+                      }
+                    },
+                    "linkedStorageAccountType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the link."
+                          }
+                        },
+                        "storageAccountIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "minLength": 1,
+                          "metadata": {
+                            "description": "Required. Linked storage accounts resources Ids."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the linked storage account."
+                      }
+                    },
+                    "savedSearchType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the saved search."
+                          }
+                        },
+                        "etag": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
+                          }
+                        },
+                        "category": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The category of the saved search. This helps the user to find a saved search faster."
+                          }
+                        },
+                        "displayName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Display name for the search."
+                          }
+                        },
+                        "functionAlias": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The function alias if query serves as a function."
+                          }
+                        },
+                        "functionParameters": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
+                          }
+                        },
+                        "query": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The query expression for the saved search."
+                          }
+                        },
+                        "tags": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The tags attached to the saved search."
+                          }
+                        },
+                        "version": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version number of the query language. The current version is 2 and is the default."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the saved search."
+                      }
+                    },
+                    "dataExportType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the data export."
+                          }
+                        },
+                        "destination": {
+                          "$ref": "#/definitions/destinationType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The destination of the data export."
+                          }
+                        },
+                        "enable": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the data export."
+                          }
+                        },
+                        "tableNames": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. The list of table names to export."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the data export."
+                      }
+                    },
+                    "dataSourceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the data source."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The kind of data source."
+                          }
+                        },
+                        "linkedResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource id of the resource that will be linked to the workspace."
+                          }
+                        },
+                        "eventLogName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the event log to configure when kind is WindowsEvent."
+                          }
+                        },
+                        "eventTypes": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The event types to configure when kind is WindowsEvent."
+                          }
+                        },
+                        "objectName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                          }
+                        },
+                        "instanceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                          }
+                        },
+                        "intervalSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                          }
+                        },
+                        "performanceCounters": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
+                          }
+                        },
+                        "counterName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
+                          }
+                        },
+                        "state": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
+                          }
+                        },
+                        "syslogName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. System log to configure when kind is LinuxSyslog."
+                          }
+                        },
+                        "syslogSeverities": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Severities to configure when kind is LinuxSyslog."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to configure in the resource."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the data source."
+                      }
+                    },
+                    "tableType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the table."
+                          }
+                        },
+                        "plan": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The plan for the table."
+                          }
+                        },
+                        "restoredLogs": {
+                          "$ref": "#/definitions/restoredLogsType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The restored logs for the table."
+                          }
+                        },
+                        "schema": {
+                          "$ref": "#/definitions/schemaType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The schema for the table."
+                          }
+                        },
+                        "searchResults": {
+                          "$ref": "#/definitions/searchResultsType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The search results for the table."
+                          }
+                        },
+                        "retentionInDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 4,
+                          "maxValue": 730,
+                          "metadata": {
+                            "description": "Optional. The retention in days for the table. Don't provide to use the default workspace retention."
+                          }
+                        },
+                        "totalRetentionInDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 4,
+                          "maxValue": 2555,
+                          "metadata": {
+                            "description": "Optional. The total retention in days for the table. Don't provide use the default table retention."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The role assignments for the table."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the custom table."
+                      }
+                    },
+                    "workspaceFeaturesType": {
+                      "type": "object",
+                      "properties": {
+                        "disableLocalAuth": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Disable Non-EntraID based Auth. Default is true."
+                          }
+                        },
+                        "enableDataExport": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Flag that indicate if data should be exported."
+                          }
+                        },
+                        "enableLogAccessUsingOnlyResourcePermissions": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable log access using only resource permissions. Default is false."
+                          }
+                        },
+                        "immediatePurgeDataOn30Days": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Flag that describes if we want to remove the data after 30 days."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Features of the workspace."
+                      }
+                    },
+                    "workspaceReplicationType": {
+                      "type": "object",
+                      "properties": {
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether the replication is enabled or not. When true, workspace configuration and data is replicated to the specified location."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The location to which the workspace is replicated. Required if replication is enabled."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Replication properties of the workspace."
+                      }
+                    },
+                    "_1.columnType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The column name."
+                          }
+                        },
+                        "type": {
+                          "type": "string",
+                          "allowedValues": [
+                            "boolean",
+                            "dateTime",
+                            "dynamic",
+                            "guid",
+                            "int",
+                            "long",
+                            "real",
+                            "string"
+                          ],
+                          "metadata": {
+                            "description": "Required. The column type."
+                          }
+                        },
+                        "dataTypeHint": {
+                          "type": "string",
+                          "allowedValues": [
+                            "armPath",
+                            "guid",
+                            "ip",
+                            "uri"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The column data type logical hint."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The column description."
+                          }
+                        },
+                        "displayName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Column display name."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The parameters of the table column.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table/main.bicep"
+                        }
+                      }
+                    },
+                    "destinationType": {
+                      "type": "object",
+                      "properties": {
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The destination resource ID."
+                          }
+                        },
+                        "metaData": {
+                          "type": "object",
+                          "properties": {
+                            "eventHubName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The destination metadata."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The data export destination properties.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "data-export/main.bicep"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "restoredLogsType": {
+                      "type": "object",
+                      "properties": {
+                        "sourceTable": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The table to restore data from."
+                          }
+                        },
+                        "startRestoreTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to start the restore from (UTC)."
+                          }
+                        },
+                        "endRestoreTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to end the restore by (UTC)."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The parameters of the restore operation that initiated the table.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "schemaType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The table name."
+                          }
+                        },
+                        "columns": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.columnType"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of table custom columns."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The table description."
+                          }
+                        },
+                        "displayName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The table display name."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The table schema.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table/main.bicep"
+                        }
+                      }
+                    },
+                    "searchResultsType": {
+                      "type": "object",
+                      "properties": {
+                        "query": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The search job query."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The search description."
+                          }
+                        },
+                        "limit": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Limit the search job to return up to specified number of rows."
+                          }
+                        },
+                        "startSearchTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to start the search from (UTC)."
+                          }
+                        },
+                        "endSearchTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to end the search by (UTC)."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The parameters of the search job that initiated the table.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table/main.bicep"
+                        }
+                      }
+                    },
+                    "solutionPlanType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
+                          }
+                        },
+                        "product": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
+                          }
+                        },
+                        "publisher": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/operations-management/solution:0.3.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Log Analytics workspace."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "PerGB2018",
+                      "allowedValues": [
+                        "CapacityReservation",
+                        "Free",
+                        "LACluster",
+                        "PerGB2018",
+                        "PerNode",
+                        "Premium",
+                        "Standalone",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The name of the SKU. Must be 'LACluster' to be linked to a Log Analytics cluster."
+                      }
+                    },
+                    "skuCapacityReservationLevel": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "minValue": 100,
+                      "maxValue": 5000,
+                      "metadata": {
+                        "description": "Optional. The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. Must be in increments of 100 between 100 and 5000."
+                      }
+                    },
+                    "storageInsightsConfigs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/storageInsightsConfigType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of storage accounts to be read by the workspace."
+                      }
+                    },
+                    "linkedServices": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/linkedServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of services to be linked."
+                      }
+                    },
+                    "linkedStorageAccounts": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/linkedStorageAccountType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. List of Storage Accounts to be linked. Required if 'forceCmkForQuery' is set to 'true' and 'savedSearches' is not empty."
+                      }
+                    },
+                    "savedSearches": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/savedSearchType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Kusto Query Language searches to save."
+                      }
+                    },
+                    "dataExports": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/dataExportType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. LAW data export instances to be deployed."
+                      }
+                    },
+                    "dataSources": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/dataSourceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. LAW data sources to configure."
+                      }
+                    },
+                    "tables": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/tableType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. LAW custom tables to be deployed."
+                      }
+                    },
+                    "gallerySolutions": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/gallerySolutionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of gallerySolutions to be created in the log analytics workspace."
+                      }
+                    },
+                    "onboardWorkspaceToSentinel": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Onboard the Log Analytics Workspace to Sentinel. Requires 'SecurityInsights' solution to be in gallerySolutions."
+                      }
+                    },
+                    "dataRetention": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "minValue": 0,
+                      "maxValue": 730,
+                      "metadata": {
+                        "description": "Optional. Number of days data will be retained for."
+                      }
+                    },
+                    "dailyQuotaGb": {
+                      "type": "string",
+                      "defaultValue": "-1",
+                      "metadata": {
+                        "description": "Optional. The workspace daily quota for ingestion in GB. Supports decimal values. Example: '0.5' for 0.5 GB, '2' for 2 GB. Default is '-1' (no limit)."
+                      }
+                    },
+                    "defaultDataCollectionRuleResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the default Data Collection Rule to use for this workspace. Note: the default DCR is not applicable on workspace creation and the workspace must be listed as a destination in the DCR."
+                      }
+                    },
+                    "publicNetworkAccessForIngestion": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled",
+                        "SecuredByPerimeter"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Log Analytics ingestion."
+                      }
+                    },
+                    "publicNetworkAccessForQuery": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled",
+                        "SecuredByPerimeter"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Log Analytics query."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource. Only one type of identity is supported: system-assigned or user-assigned, but not both."
+                      }
+                    },
+                    "features": {
+                      "$ref": "#/definitions/workspaceFeaturesType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The workspace features."
+                      }
+                    },
+                    "replication": {
+                      "$ref": "#/definitions/workspaceReplicationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The workspace replication properties."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "forceCmkForQuery": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates whether customer managed storage is mandatory for query management."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.OperationalInsights/workspaces@2025-07-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                      "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                      "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "Security Admin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb1c8493-542b-48eb-b624-b4c8fea62acd')]",
+                      "Security Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '39bc4728-0917-49c7-9d2c-d95423bc2eb4')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.operationalinsights-workspace.{0}.{1}', replace('0.15.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "logAnalyticsWorkspace": {
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2025-07-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "features": {
+                          "searchVersion": 1,
+                          "enableLogAccessUsingOnlyResourcePermissions": "[coalesce(tryGet(parameters('features'), 'enableLogAccessUsingOnlyResourcePermissions'), false())]",
+                          "disableLocalAuth": "[coalesce(tryGet(parameters('features'), 'disableLocalAuth'), true())]",
+                          "enableDataExport": "[tryGet(parameters('features'), 'enableDataExport')]",
+                          "immediatePurgeDataOn30Days": "[tryGet(parameters('features'), 'immediatePurgeDataOn30Days')]"
+                        },
+                        "sku": {
+                          "name": "[parameters('skuName')]",
+                          "capacityReservationLevel": "[if(equals(parameters('skuName'), 'CapacityReservation'), parameters('skuCapacityReservationLevel'), null())]"
+                        },
+                        "retentionInDays": "[parameters('dataRetention')]",
+                        "workspaceCapping": {
+                          "dailyQuotaGb": "[json(parameters('dailyQuotaGb'))]"
+                        },
+                        "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                        "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                        "forceCmkForQuery": "[parameters('forceCmkForQuery')]",
+                        "replication": "[parameters('replication')]",
+                        "defaultDataCollectionRuleResourceId": "[parameters('defaultDataCollectionRuleResourceId')]"
+                      },
+                      "identity": "[variables('identity')]"
+                    },
+                    "logAnalyticsWorkspace_diagnosticSettings": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[if(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'useThisWorkspace'), false()), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_sentinelOnboarding": {
+                      "condition": "[and(not(empty(filter(coalesce(parameters('gallerySolutions'), createArray()), lambda('item', startsWith(lambdaVariables('item').name, 'SecurityInsights'))))), parameters('onboardWorkspaceToSentinel'))]",
+                      "type": "Microsoft.SecurityInsights/onboardingStates",
+                      "apiVersion": "2025-09-01",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "default",
+                      "properties": {},
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_roleAssignments": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_storageInsightConfigs": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_storageInsightConfigs",
+                        "count": "[length(coalesce(parameters('storageInsightsConfigs'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-LAW-StorageInsightsConfig-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "containers": {
+                            "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'containers')]"
+                          },
+                          "tables": {
+                            "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'tables')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()].storageAccountResourceId]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "140290971998938797"
+                            },
+                            "name": "Log Analytics Workspace Storage Insight Configs",
+                            "description": "This module deploys a Log Analytics Workspace Storage Insight Config."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}-stinsconfig', last(split(parameters('storageAccountResourceId'), '/')))]",
+                              "metadata": {
+                                "description": "Optional. The name of the storage insights config."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Azure Resource Manager ID of the storage account resource."
+                              }
+                            },
+                            "containers": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The names of the blob containers that the workspace should read."
+                              }
+                            },
+                            "tables": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The names of the Azure tables that the workspace should read."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs@2025-07-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to configure in the resource."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-06-01",
+                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                            },
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-07-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "storageinsightconfig": {
+                              "type": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs",
+                              "apiVersion": "2025-07-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "containers": "[parameters('containers')]",
+                                "tables": "[parameters('tables')]",
+                                "storageAccount": {
+                                  "id": "[parameters('storageAccountResourceId')]",
+                                  "key": "[listKeys('storageAccount', '2025-06-01').keys[0].value]"
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed storage insights configuration."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/storageInsightConfigs', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the storage insight configuration is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the storage insights configuration."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_linkedServices": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_linkedServices",
+                        "count": "[length(coalesce(parameters('linkedServices'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-LAW-LinkedService-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('linkedServices'), createArray())[copyIndex()].name]"
+                          },
+                          "resourceId": {
+                            "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'resourceId')]"
+                          },
+                          "writeAccessResourceId": {
+                            "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'writeAccessResourceId')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "14482465616812596213"
+                            },
+                            "name": "Log Analytics Workspace Linked Services",
+                            "description": "This module deploys a Log Analytics Workspace Linked Service."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the link."
+                              }
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
+                              }
+                            },
+                            "writeAccessResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.OperationalInsights/workspaces/linkedServices@2025-07-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to configure in the resource."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-07-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "linkedService": {
+                              "type": "Microsoft.OperationalInsights/workspaces/linkedServices",
+                              "apiVersion": "2025-07-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "resourceId": "[parameters('resourceId')]",
+                                "writeAccessResourceId": "[parameters('writeAccessResourceId')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed linked service."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed linked service."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedServices', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the linked service is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_linkedStorageAccounts": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_linkedStorageAccounts",
+                        "count": "[length(coalesce(parameters('linkedStorageAccounts'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-LAW-LinkedStorageAccount-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].name]"
+                          },
+                          "storageAccountIds": {
+                            "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].storageAccountIds]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "14864721709229272590"
+                            },
+                            "name": "Log Analytics Workspace Linked Storage Accounts",
+                            "description": "This module deploys a Log Analytics Workspace Linked Storage Account."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Query",
+                                "Alerts",
+                                "CustomLogs",
+                                "AzureWatson"
+                              ],
+                              "metadata": {
+                                "description": "Required. Name of the link."
+                              }
+                            },
+                            "storageAccountIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "minLength": 1,
+                              "metadata": {
+                                "description": "Required. Linked storage accounts resources Ids."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-07-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "linkedStorageAccount": {
+                              "type": "Microsoft.OperationalInsights/workspaces/linkedStorageAccounts",
+                              "apiVersion": "2025-07-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "properties": {
+                                "storageAccountIds": "[parameters('storageAccountIds')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed linked storage account."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed linked storage account."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedStorageAccounts', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the linked storage account is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_savedSearches": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_savedSearches",
+                        "count": "[length(coalesce(parameters('savedSearches'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-LAW-SavedSearch-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[format('{0}{1}', coalesce(parameters('savedSearches'), createArray())[copyIndex()].name, uniqueString(subscription().id, resourceGroup().id))]"
+                          },
+                          "etag": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'etag')]"
+                          },
+                          "displayName": {
+                            "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].displayName]"
+                          },
+                          "category": {
+                            "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].category]"
+                          },
+                          "query": {
+                            "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].query]"
+                          },
+                          "functionAlias": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionAlias')]"
+                          },
+                          "functionParameters": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionParameters')]"
+                          },
+                          "tags": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'tags')]"
+                          },
+                          "version": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'version')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "17904092372918022238"
+                            },
+                            "name": "Log Analytics Workspace Saved Searches",
+                            "description": "This module deploys a Log Analytics Workspace Saved Search."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the saved search."
+                              }
+                            },
+                            "displayName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Display name for the search."
+                              }
+                            },
+                            "category": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Query category."
+                              }
+                            },
+                            "query": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Kusto Query to be stored."
+                              }
+                            },
+                            "tags": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.OperationalInsights/workspaces/savedSearches@2025-07-01#properties/properties/properties/tags"
+                                },
+                                "description": "Optional. Tags to configure in the resource."
+                              },
+                              "nullable": true
+                            },
+                            "functionAlias": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The function alias if query serves as a function."
+                              }
+                            },
+                            "functionParameters": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: \"param-name1:type1 = default_value1, param-name2:type2 = default_value2\". For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
+                              }
+                            },
+                            "version": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The version number of the query language."
+                              }
+                            },
+                            "etag": {
+                              "type": "string",
+                              "defaultValue": "*",
+                              "metadata": {
+                                "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-07-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "savedSearch": {
+                              "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+                              "apiVersion": "2025-07-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "properties": {
+                                "etag": "[parameters('etag')]",
+                                "tags": "[coalesce(parameters('tags'), createArray())]",
+                                "displayName": "[parameters('displayName')]",
+                                "category": "[parameters('category')]",
+                                "query": "[parameters('query')]",
+                                "functionAlias": "[parameters('functionAlias')]",
+                                "functionParameters": "[parameters('functionParameters')]",
+                                "version": "[parameters('version')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed saved search."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the saved search is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed saved search."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace",
+                        "logAnalyticsWorkspace_linkedStorageAccounts"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_dataExports": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_dataExports",
+                        "count": "[length(coalesce(parameters('dataExports'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-LAW-DataExport-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "workspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('dataExports'), createArray())[copyIndex()].name]"
+                          },
+                          "destination": {
+                            "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'destination')]"
+                          },
+                          "enable": {
+                            "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'enable')]"
+                          },
+                          "tableNames": {
+                            "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'tableNames')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "17943947755417749524"
+                            },
+                            "name": "Log Analytics Workspace Data Exports",
+                            "description": "This module deploys a Log Analytics Workspace Data Export."
+                          },
+                          "definitions": {
+                            "destinationType": {
+                              "type": "object",
+                              "properties": {
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The destination resource ID."
+                                  }
+                                },
+                                "metaData": {
+                                  "type": "object",
+                                  "properties": {
+                                    "eventHubName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The destination metadata."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The data export destination properties."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "minLength": 4,
+                              "maxLength": 63,
+                              "metadata": {
+                                "description": "Required. The data export rule name."
+                              }
+                            },
+                            "workspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "destination": {
+                              "$ref": "#/definitions/destinationType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Destination properties."
+                              }
+                            },
+                            "enable": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Active when enabled."
+                              }
+                            },
+                            "tableNames": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "minLength": 1,
+                              "metadata": {
+                                "description": "Required. An array of tables to export, for example: ['Heartbeat', 'SecurityEvent']."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-07-01",
+                              "name": "[parameters('workspaceName')]"
+                            },
+                            "dataExport": {
+                              "type": "Microsoft.OperationalInsights/workspaces/dataExports",
+                              "apiVersion": "2025-07-01",
+                              "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                              "properties": {
+                                "destination": "[parameters('destination')]",
+                                "enable": "[parameters('enable')]",
+                                "tableNames": "[parameters('tableNames')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the data export."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the data export."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataExports', parameters('workspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the data export was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_dataSources": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_dataSources",
+                        "count": "[length(coalesce(parameters('dataSources'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-LAW-DataSource-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].name]"
+                          },
+                          "kind": {
+                            "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].kind]"
+                          },
+                          "linkedResourceId": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'linkedResourceId')]"
+                          },
+                          "eventLogName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventLogName')]"
+                          },
+                          "eventTypes": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventTypes')]"
+                          },
+                          "objectName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'objectName')]"
+                          },
+                          "instanceName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'instanceName')]"
+                          },
+                          "intervalSeconds": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'intervalSeconds')]"
+                          },
+                          "counterName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'counterName')]"
+                          },
+                          "state": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'state')]"
+                          },
+                          "syslogName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogName')]"
+                          },
+                          "syslogSeverities": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogSeverities')]"
+                          },
+                          "performanceCounters": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'performanceCounters')]"
+                          },
+                          "tags": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'tags')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "15360290236166491819"
+                            },
+                            "name": "Log Analytics Workspace Datasources",
+                            "description": "This module deploys a Log Analytics Workspace Data Source."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the data source."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "defaultValue": "AzureActivityLog",
+                              "allowedValues": [
+                                "AzureActivityLog",
+                                "WindowsEvent",
+                                "WindowsPerformanceCounter",
+                                "IISLogs",
+                                "LinuxSyslog",
+                                "LinuxSyslogCollection",
+                                "LinuxPerformanceObject",
+                                "LinuxPerformanceCollection"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The kind of the data source."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-07-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to configure in the resource."
+                              },
+                              "nullable": true
+                            },
+                            "linkedResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource ID of the resource to be linked."
+                              }
+                            },
+                            "eventLogName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Windows event log name to configure when kind is WindowsEvent."
+                              }
+                            },
+                            "eventTypes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Windows event types to configure when kind is WindowsEvent."
+                              }
+                            },
+                            "objectName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                              }
+                            },
+                            "instanceName": {
+                              "type": "string",
+                              "defaultValue": "*",
+                              "metadata": {
+                                "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                              }
+                            },
+                            "intervalSeconds": {
+                              "type": "int",
+                              "defaultValue": 60,
+                              "metadata": {
+                                "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                              }
+                            },
+                            "performanceCounters": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
+                              }
+                            },
+                            "counterName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
+                              }
+                            },
+                            "state": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
+                              }
+                            },
+                            "syslogName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. System log to configure when kind is LinuxSyslog."
+                              }
+                            },
+                            "syslogSeverities": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Severities to configure when kind is LinuxSyslog."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-07-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "dataSource": {
+                              "type": "Microsoft.OperationalInsights/workspaces/dataSources",
+                              "apiVersion": "2025-07-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "kind": "[parameters('kind')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "linkedResourceId": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'AzureActivityLog')), parameters('linkedResourceId'), null())]",
+                                "eventLogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventLogName'), null())]",
+                                "eventTypes": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventTypes'), null())]",
+                                "objectName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('objectName'), null())]",
+                                "instanceName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('instanceName'), null())]",
+                                "intervalSeconds": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('intervalSeconds'), null())]",
+                                "counterName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsPerformanceCounter')), parameters('counterName'), null())]",
+                                "state": "[if(and(not(empty(parameters('kind'))), or(or(equals(parameters('kind'), 'IISLogs'), equals(parameters('kind'), 'LinuxSyslogCollection')), equals(parameters('kind'), 'LinuxPerformanceCollection'))), parameters('state'), null())]",
+                                "syslogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxSyslog')), parameters('syslogName'), null())]",
+                                "syslogSeverities": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'LinuxSyslog'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('syslogSeverities'), null())]",
+                                "performanceCounters": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxPerformanceObject')), parameters('performanceCounters'), null())]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed data source."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataSources', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the data source is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed data source."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_tables": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_tables",
+                        "count": "[length(coalesce(parameters('tables'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-LAW-Table-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "workspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                          },
+                          "plan": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'plan')]"
+                          },
+                          "schema": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'schema')]"
+                          },
+                          "retentionInDays": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'retentionInDays')]"
+                          },
+                          "totalRetentionInDays": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'totalRetentionInDays')]"
+                          },
+                          "restoredLogs": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'restoredLogs')]"
+                          },
+                          "searchResults": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'searchResults')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "18383178824663161801"
+                            },
+                            "name": "Log Analytics Workspace Tables",
+                            "description": "This module deploys a Log Analytics Workspace Table."
+                          },
+                          "definitions": {
+                            "restoredLogsType": {
+                              "type": "object",
+                              "properties": {
+                                "sourceTable": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The table to restore data from."
+                                  }
+                                },
+                                "startRestoreTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to start the restore from (UTC)."
+                                  }
+                                },
+                                "endRestoreTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to end the restore by (UTC)."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The parameters of the restore operation that initiated the table."
+                              }
+                            },
+                            "schemaType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The table name."
+                                  }
+                                },
+                                "columns": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/columnType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of table custom columns."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The table description."
+                                  }
+                                },
+                                "displayName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The table display name."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The table schema."
+                              }
+                            },
+                            "columnType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The column name."
+                                  }
+                                },
+                                "type": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "boolean",
+                                    "dateTime",
+                                    "dynamic",
+                                    "guid",
+                                    "int",
+                                    "long",
+                                    "real",
+                                    "string"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The column type."
+                                  }
+                                },
+                                "dataTypeHint": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "armPath",
+                                    "guid",
+                                    "ip",
+                                    "uri"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The column data type logical hint."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The column description."
+                                  }
+                                },
+                                "displayName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Column display name."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The parameters of the table column."
+                              }
+                            },
+                            "searchResultsType": {
+                              "type": "object",
+                              "properties": {
+                                "query": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The search job query."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The search description."
+                                  }
+                                },
+                                "limit": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Limit the search job to return up to specified number of rows."
+                                  }
+                                },
+                                "startSearchTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to start the search from (UTC)."
+                                  }
+                                },
+                                "endSearchTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to end the search by (UTC)."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The parameters of the search job that initiated the table."
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the table."
+                              }
+                            },
+                            "workspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "plan": {
+                              "type": "string",
+                              "defaultValue": "Analytics",
+                              "allowedValues": [
+                                "Basic",
+                                "Analytics"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Instruct the system how to handle and charge the logs ingested to this table."
+                              }
+                            },
+                            "restoredLogs": {
+                              "$ref": "#/definitions/restoredLogsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Restore parameters."
+                              }
+                            },
+                            "retentionInDays": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 4,
+                              "maxValue": 730,
+                              "metadata": {
+                                "description": "Optional. The table retention in days, between 4 and 730. Don't provide to use the default workspace retention."
+                              }
+                            },
+                            "schema": {
+                              "$ref": "#/definitions/schemaType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Table's schema."
+                              }
+                            },
+                            "searchResults": {
+                              "$ref": "#/definitions/searchResultsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Parameters of the search job that initiated this table."
+                              }
+                            },
+                            "totalRetentionInDays": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 4,
+                              "maxValue": 2555,
+                              "metadata": {
+                                "description": "Optional. The table total retention in days, between 4 and 2555. Don't provide use the default table retention."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                              "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                              "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-07-01",
+                              "name": "[parameters('workspaceName')]"
+                            },
+                            "table": {
+                              "type": "Microsoft.OperationalInsights/workspaces/tables",
+                              "apiVersion": "2025-07-01",
+                              "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                              "properties": {
+                                "plan": "[parameters('plan')]",
+                                "restoredLogs": "[parameters('restoredLogs')]",
+                                "retentionInDays": "[coalesce(parameters('retentionInDays'), -1)]",
+                                "schema": "[parameters('schema')]",
+                                "searchResults": "[parameters('searchResults')]",
+                                "totalRetentionInDays": "[coalesce(parameters('totalRetentionInDays'), -1)]"
+                              }
+                            },
+                            "table_roleAssignments": {
+                              "copy": {
+                                "name": "table_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}/tables/{1}', parameters('workspaceName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "table"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the table."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the table."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the table was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_solutions": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_solutions",
+                        "count": "[length(coalesce(parameters('gallerySolutions'), createArray()))]"
+                      },
+                      "condition": "[not(empty(parameters('gallerySolutions')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-LAW-Solution-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].name]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "plan": {
+                            "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].plan]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.32.4.45862",
+                              "templateHash": "10255889523646649592"
+                            },
+                            "name": "Operations Management Solutions",
+                            "description": "This module deploys an Operations Management Solution.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "solutionPlanType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
+                                  }
+                                },
+                                "product": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
+                                  }
+                                },
+                                "publisher": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
+                              }
+                            },
+                            "plan": {
+                              "$ref": "#/definitions/solutionPlanType",
+                              "metadata": {
+                                "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
+                              }
+                            },
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Log Analytics workspace where the solution will be deployed/enabled."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.operationsmanagement-solution.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "logAnalyticsWorkspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2021-06-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "solution": {
+                              "type": "Microsoft.OperationsManagement/solutions",
+                              "apiVersion": "2015-11-01-preview",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
+                              },
+                              "plan": {
+                                "name": "[coalesce(tryGet(parameters('plan'), 'name'), parameters('name'))]",
+                                "promotionCode": "",
+                                "product": "[parameters('plan').product]",
+                                "publisher": "[coalesce(tryGet(parameters('plan'), 'publisher'), 'Microsoft')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed solution."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed solution."
+                              },
+                              "value": "[resourceId('Microsoft.OperationsManagement/solutions', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the solution is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('solution', '2015-11-01-preview', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed log analytics workspace."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed log analytics workspace."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed log analytics workspace."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "logAnalyticsWorkspaceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The ID associated with the workspace."
+                      },
+                      "value": "[reference('logAnalyticsWorkspace').customerId]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('logAnalyticsWorkspace', '2025-07-01', 'full').location]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('logAnalyticsWorkspace', '2025-07-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "primarySharedKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary shared key of the log analytics workspace."
+                      },
+                      "value": "[listKeys('logAnalyticsWorkspace', '2025-07-01').primarySharedKey]"
+                    },
+                    "secondarySharedKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary shared key of the log analytics workspace."
+                      },
+                      "value": "[listKeys('logAnalyticsWorkspace', '2025-07-01').secondarySharedKey]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Log Analytics workspace."
+              },
+              "value": "[reference('workspace').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Log Analytics workspace."
+              },
+              "value": "[reference('workspace').outputs.name.value]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Location of the workspace."
+              },
+              "value": "[parameters('location')]"
+            },
+            "logAnalyticsWorkspaceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Log Analytics workspace customer ID."
+              },
+              "value": "[reference('workspace').outputs.logAnalyticsWorkspaceId.value]"
+            }
+          }
+        }
+      }
+    },
+    "app_insights": {
+      "condition": "[parameters('enableMonitoring')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.app-insights.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "workspaceResourceId": "[if(variables('useExistingLogAnalytics'), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8])), if(parameters('enableMonitoring'), createObject('value', reference('log_analytics').outputs.resourceId.value), createObject('value', '')))]",
+          "retentionInDays": {
+            "value": 365
+          },
+          "disableIpMasking": {
+            "value": false
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "1077806126224374403"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('appi-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the Application Insights instance. Defaults to appi-{solutionName}."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "workspaceResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Log Analytics workspace to link to."
+              }
+            },
+            "applicationType": {
+              "type": "string",
+              "defaultValue": "web",
+              "metadata": {
+                "description": "Application type."
+              }
+            },
+            "retentionInDays": {
+              "type": "int",
+              "defaultValue": 365,
+              "metadata": {
+                "description": "Retention period in days. WAF recommends 365."
+              }
+            },
+            "disableIpMasking": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Disable IP masking for security. WAF recommends false."
+              }
+            },
+            "flowType": {
+              "type": "string",
+              "defaultValue": "Bluefield",
+              "metadata": {
+                "description": "Flow type for Application Insights."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "web",
+              "metadata": {
+                "description": "Kind of Application Insights resource."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.insights.component.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "workspaceResourceId": {
+                    "value": "[parameters('workspaceResourceId')]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "applicationType": {
+                    "value": "[parameters('applicationType')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "retentionInDays": {
+                    "value": "[parameters('retentionInDays')]"
+                  },
+                  "disableIpMasking": {
+                    "value": "[parameters('disableIpMasking')]"
+                  },
+                  "flowType": {
+                    "value": "[parameters('flowType')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.39.26.7824",
+                      "templateHash": "17358780145253914698"
+                    },
+                    "name": "Application Insights",
+                    "description": "This component deploys an Application Insights instance."
+                  },
+                  "definitions": {
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Application Insights."
+                      }
+                    },
+                    "applicationType": {
+                      "type": "string",
+                      "defaultValue": "web",
+                      "allowedValues": [
+                        "web",
+                        "other"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Application type."
+                      }
+                    },
+                    "workspaceResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property."
+                      }
+                    },
+                    "disableIpMasking": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Disable IP masking. Default value is set to true."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Disable Non-AAD based Auth. Default value is set to false."
+                      }
+                    },
+                    "forceCustomerStorageForProfiler": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Force users to create their own storage account for profiler and debugger."
+                      }
+                    },
+                    "linkedStorageAccountResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Linked storage account resource ID."
+                      }
+                    },
+                    "publicNetworkAccessForIngestion": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled."
+                      }
+                    },
+                    "publicNetworkAccessForQuery": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled."
+                      }
+                    },
+                    "retentionInDays": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "allowedValues": [
+                        30,
+                        60,
+                        90,
+                        120,
+                        180,
+                        270,
+                        365,
+                        550,
+                        730
+                      ],
+                      "metadata": {
+                        "description": "Optional. Retention period in days."
+                      }
+                    },
+                    "samplingPercentage": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "minValue": 0,
+                      "maxValue": 100,
+                      "metadata": {
+                        "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry."
+                      }
+                    },
+                    "flowType": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Used by the Application Insights system to determine what kind of flow this component was created by. This is to be set to 'Bluefield' when creating/updating a component via the REST API."
+                      }
+                    },
+                    "requestSource": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Describes what tool created this Application Insights component. Customers using this API should set this to the default 'rest'."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone."
+                      }
+                    },
+                    "immediatePurgeDataOn30Days": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Purge data immediately after 30 days."
+                      }
+                    },
+                    "ingestionMode": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "ApplicationInsights",
+                        "ApplicationInsightsWithDiagnosticSettings",
+                        "LogAnalytics"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Indicates the flow of the ingestion."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Insights/components@2020-02-02#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                      "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+                      "Application Insights Component Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e')]",
+                      "Application Insights Snapshot Debugger": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08954f03-6346-4c2e-81c0-ec3a5cfae23b')]",
+                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "appInsights": {
+                      "type": "Microsoft.Insights/components",
+                      "apiVersion": "2020-02-02",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "properties": {
+                        "Application_Type": "[parameters('applicationType')]",
+                        "DisableIpMasking": "[parameters('disableIpMasking')]",
+                        "DisableLocalAuth": "[parameters('disableLocalAuth')]",
+                        "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]",
+                        "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
+                        "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                        "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                        "RetentionInDays": "[parameters('retentionInDays')]",
+                        "SamplingPercentage": "[parameters('samplingPercentage')]",
+                        "Flow_Type": "[parameters('flowType')]",
+                        "Request_Source": "[parameters('requestSource')]",
+                        "ImmediatePurgeDataOn30Days": "[parameters('immediatePurgeDataOn30Days')]",
+                        "IngestionMode": "[parameters('ingestionMode')]"
+                      }
+                    },
+                    "appInsights_roleAssignments": {
+                      "copy": {
+                        "name": "appInsights_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    },
+                    "appInsights_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    },
+                    "appInsights_diagnosticSettings": {
+                      "copy": {
+                        "name": "appInsights_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    },
+                    "linkedStorageAccount": {
+                      "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appInsightsName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[coalesce(parameters('linkedStorageAccountResourceId'), '')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "5059808225314360251"
+                            },
+                            "name": "Application Insights Linked Storage Account",
+                            "description": "This component deploys an Application Insights Linked Storage Account."
+                          },
+                          "parameters": {
+                            "appInsightsName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Linked storage account resource ID."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "microsoft.insights/components/linkedStorageAccounts",
+                              "apiVersion": "2020-03-01-preview",
+                              "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]",
+                              "properties": {
+                                "linkedStorageAccount": "[parameters('storageAccountResourceId')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Linked Storage Account."
+                              },
+                              "value": "ServiceProfiler"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Linked Storage Account."
+                              },
+                              "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the agent pool was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the application insights component."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the application insights component."
+                      },
+                      "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the application insights component was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "applicationId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The application ID of the application insights component."
+                      },
+                      "value": "[reference('appInsights').AppId]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('appInsights', '2020-02-02', 'full').location]"
+                    },
+                    "instrumentationKey": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component."
+                      },
+                      "value": "[reference('appInsights').InstrumentationKey]"
+                    },
+                    "connectionString": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Application Insights Connection String."
+                      },
+                      "value": "[reference('appInsights').ConnectionString]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Application Insights instance."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Application Insights instance."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+            },
+            "instrumentationKey": {
+              "type": "string",
+              "metadata": {
+                "description": "Instrumentation key for the Application Insights instance."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.instrumentationKey.value]"
+            },
+            "connectionString": {
+              "type": "string",
+              "metadata": {
+                "description": "Connection string for the Application Insights instance."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.connectionString.value]"
+            },
+            "applicationId": {
+              "type": "string",
+              "metadata": {
+                "description": "Application ID of the Application Insights instance."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.applicationId.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "log_analytics"
+      ]
+    },
+    "virtualNetwork": {
+      "condition": "[parameters('enablePrivateNetworking')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.virtual-network.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "addressPrefixes": {
+            "value": [
+              "10.0.0.0/20"
+            ]
+          },
+          "logAnalyticsWorkspaceId": "[if(variables('useExistingLogAnalytics'), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8])), if(parameters('enableMonitoring'), createObject('value', reference('log_analytics').outputs.resourceId.value), createObject('value', '')))]",
+          "resourceSuffix": {
+            "value": "[variables('solutionSuffix')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "14375623146044395014"
+            }
+          },
+          "definitions": {
+            "subnetOutputType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The name of the subnet."
+                  }
+                },
+                "resourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "The resource ID of the subnet."
+                  }
+                },
+                "nsgName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "The name of the associated NSG, if any."
+                  }
+                },
+                "nsgResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "The resource ID of the associated NSG, if any."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Subnet output type"
+              }
+            },
+            "subnetType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the subnet."
+                  }
+                },
+                "addressPrefixes": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. Address prefixes for the subnet."
+                  }
+                },
+                "delegation": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Delegation for the subnet."
+                  }
+                },
+                "privateEndpointNetworkPolicies": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Disabled",
+                    "Enabled",
+                    "NetworkSecurityGroupEnabled",
+                    "RouteTableEnabled"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Private endpoint network policies."
+                  }
+                },
+                "privateLinkServiceNetworkPolicies": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Disabled",
+                    "Enabled"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Private link service network policies."
+                  }
+                },
+                "networkSecurityGroup": {
+                  "$ref": "#/definitions/networkSecurityGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. NSG configuration for the subnet."
+                  }
+                },
+                "routeTableResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Route table resource ID."
+                  }
+                },
+                "serviceEndpointPolicies": {
+                  "type": "array",
+                  "items": {
+                    "type": "object"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Service endpoint policies."
+                  }
+                },
+                "serviceEndpoints": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Service endpoints to enable."
+                  }
+                },
+                "defaultOutboundAccess": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Disable default outbound connectivity."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "Subnet configuration type"
+              }
+            },
+            "networkSecurityGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the NSG."
+                  }
+                },
+                "securityRules": {
+                  "type": "array",
+                  "items": {
+                    "type": "object"
+                  },
+                  "metadata": {
+                    "description": "Required. Security rules for the NSG."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_export!": true,
+                "description": "NSG configuration type"
+              }
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "addressPrefixes": {
+              "type": "array",
+              "metadata": {
+                "description": "Address prefixes for the virtual network."
+              }
+            },
+            "subnets": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/subnetType"
+              },
+              "defaultValue": [
+                {
+                  "name": "backend",
+                  "addressPrefixes": [
+                    "10.0.0.0/27"
+                  ],
+                  "networkSecurityGroup": {
+                    "name": "nsg-backend",
+                    "securityRules": [
+                      {
+                        "name": "deny-hop-outbound",
+                        "properties": {
+                          "access": "Deny",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRanges": [
+                            "22",
+                            "3389"
+                          ],
+                          "direction": "Outbound",
+                          "priority": 200,
+                          "protocol": "Tcp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*"
+                        }
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "containers",
+                  "addressPrefixes": [
+                    "10.0.2.0/23"
+                  ],
+                  "delegation": "Microsoft.App/environments",
+                  "privateEndpointNetworkPolicies": "Enabled",
+                  "privateLinkServiceNetworkPolicies": "Enabled",
+                  "networkSecurityGroup": {
+                    "name": "nsg-containers",
+                    "securityRules": [
+                      {
+                        "name": "deny-hop-outbound",
+                        "properties": {
+                          "access": "Deny",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRanges": [
+                            "22",
+                            "3389"
+                          ],
+                          "direction": "Outbound",
+                          "priority": 200,
+                          "protocol": "Tcp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*"
+                        }
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "webserverfarm",
+                  "addressPrefixes": [
+                    "10.0.4.0/27"
+                  ],
+                  "delegation": "Microsoft.Web/serverfarms",
+                  "privateEndpointNetworkPolicies": "Enabled",
+                  "privateLinkServiceNetworkPolicies": "Enabled",
+                  "networkSecurityGroup": {
+                    "name": "nsg-webserverfarm",
+                    "securityRules": [
+                      {
+                        "name": "deny-hop-outbound",
+                        "properties": {
+                          "access": "Deny",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRanges": [
+                            "22",
+                            "3389"
+                          ],
+                          "direction": "Outbound",
+                          "priority": 200,
+                          "protocol": "Tcp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*"
+                        }
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "administration",
+                  "addressPrefixes": [
+                    "10.0.0.32/27"
+                  ],
+                  "networkSecurityGroup": {
+                    "name": "nsg-administration",
+                    "securityRules": [
+                      {
+                        "name": "deny-hop-outbound",
+                        "properties": {
+                          "access": "Deny",
+                          "destinationAddressPrefix": "*",
+                          "destinationPortRanges": [
+                            "22",
+                            "3389"
+                          ],
+                          "direction": "Outbound",
+                          "priority": 200,
+                          "protocol": "Tcp",
+                          "sourceAddressPrefix": "VirtualNetwork",
+                          "sourcePortRange": "*"
+                        }
+                      }
+                    ]
+                  }
+                },
+                {
+                  "name": "AzureBastionSubnet",
+                  "addressPrefixes": [
+                    "10.0.0.64/26"
+                  ],
+                  "networkSecurityGroup": {
+                    "name": "nsg-bastion",
+                    "securityRules": [
+                      {
+                        "name": "AllowGatewayManager",
+                        "properties": {
+                          "access": "Allow",
+                          "direction": "Inbound",
+                          "priority": 2702,
+                          "protocol": "*",
+                          "sourcePortRange": "*",
+                          "destinationPortRange": "443",
+                          "sourceAddressPrefix": "GatewayManager",
+                          "destinationAddressPrefix": "*"
+                        }
+                      },
+                      {
+                        "name": "AllowHttpsInBound",
+                        "properties": {
+                          "access": "Allow",
+                          "direction": "Inbound",
+                          "priority": 2703,
+                          "protocol": "*",
+                          "sourcePortRange": "*",
+                          "destinationPortRange": "443",
+                          "sourceAddressPrefix": "Internet",
+                          "destinationAddressPrefix": "*"
+                        }
+                      },
+                      {
+                        "name": "AllowSshRdpOutbound",
+                        "properties": {
+                          "access": "Allow",
+                          "direction": "Outbound",
+                          "priority": 100,
+                          "protocol": "*",
+                          "sourcePortRange": "*",
+                          "destinationPortRanges": [
+                            "22",
+                            "3389"
+                          ],
+                          "sourceAddressPrefix": "*",
+                          "destinationAddressPrefix": "VirtualNetwork"
+                        }
+                      },
+                      {
+                        "name": "AllowAzureCloudOutbound",
+                        "properties": {
+                          "access": "Allow",
+                          "direction": "Outbound",
+                          "priority": 110,
+                          "protocol": "Tcp",
+                          "sourcePortRange": "*",
+                          "destinationPortRange": "443",
+                          "sourceAddressPrefix": "*",
+                          "destinationAddressPrefix": "AzureCloud"
+                        }
+                      }
+                    ]
+                  }
+                }
+              ],
+              "metadata": {
+                "description": "Subnet configurations."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resources."
+              }
+            },
+            "logAnalyticsWorkspaceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Log Analytics Workspace for diagnostics."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "resourceSuffix": {
+              "type": "string",
+              "metadata": {
+                "description": "Suffix for resource naming."
+              }
+            }
+          },
+          "variables": {
+            "name": "[format('vnet-{0}', parameters('solutionName'))]"
+          },
+          "resources": {
+            "nsgs": {
+              "copy": {
+                "name": "nsgs",
+                "count": "[length(parameters('subnets'))]",
+                "mode": "serial",
+                "batchSize": 1
+              },
+              "condition": "[not(empty(tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup')))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.network.nsg.{0}.{1}', tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup', 'name'), parameters('resourceSuffix')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[format('{0}-{1}', tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup', 'name'), parameters('resourceSuffix'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "securityRules": {
+                    "value": "[tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup', 'securityRules')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.41.2.15936",
+                      "templateHash": "7311263652424030280"
+                    },
+                    "name": "Network Security Groups",
+                    "description": "This module deploys a Network security Group (NSG)."
+                  },
+                  "definitions": {
+                    "securityRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the security rule."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "access": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "metadata": {
+                                "description": "Required. Whether network traffic is allowed or denied."
+                              }
+                            },
+                            "description": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The description of the security rule."
+                              }
+                            },
+                            "destinationAddressPrefix": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                              }
+                            },
+                            "destinationAddressPrefixes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                              }
+                            },
+                            "destinationApplicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource IDs of the application security groups specified as destination."
+                              }
+                            },
+                            "destinationPortRange": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                              }
+                            },
+                            "destinationPortRanges": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The destination port ranges."
+                              }
+                            },
+                            "direction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Inbound",
+                                "Outbound"
+                              ],
+                              "metadata": {
+                                "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                              }
+                            },
+                            "priority": {
+                              "type": "int",
+                              "minValue": 100,
+                              "maxValue": 4096,
+                              "metadata": {
+                                "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                              }
+                            },
+                            "protocol": {
+                              "type": "string",
+                              "allowedValues": [
+                                "*",
+                                "Ah",
+                                "Esp",
+                                "Icmp",
+                                "Tcp",
+                                "Udp"
+                              ],
+                              "metadata": {
+                                "description": "Required. Network protocol this rule applies to."
+                              }
+                            },
+                            "sourceAddressPrefix": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                              }
+                            },
+                            "sourceAddressPrefixes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The CIDR or source IP ranges."
+                              }
+                            },
+                            "sourceApplicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource IDs of the application security groups specified as source."
+                              }
+                            },
+                            "sourcePortRange": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                              }
+                            },
+                            "sourcePortRanges": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The source port ranges."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The properties of the security rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a security rule."
+                      }
+                    },
+                    "diagnosticSettingLogsOnlyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Network Security Group."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "securityRules": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/securityRuleType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+                      }
+                    },
+                    "flushConnection": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Network/networkSecurityGroups@2025-05-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the NSG resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "networkSecurityGroup": {
+                      "type": "Microsoft.Network/networkSecurityGroups",
+                      "apiVersion": "2025-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "securityRules",
+                            "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
+                            "input": {
+                              "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
+                              "properties": {
+                                "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
+                                "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
+                                "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
+                                "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
+                                "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
+                                "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
+                                "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
+                                "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
+                                "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
+                                "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
+                                "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
+                                "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
+                                "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
+                                "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
+                                "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
+                              }
+                            }
+                          }
+                        ],
+                        "flushConnection": "[parameters('flushConnection')]"
+                      }
+                    },
+                    "networkSecurityGroup_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_diagnosticSettings": {
+                      "copy": {
+                        "name": "networkSecurityGroup_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    },
+                    "networkSecurityGroup_roleAssignments": {
+                      "copy": {
+                        "name": "networkSecurityGroup_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "networkSecurityGroup"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the network security group was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the network security group."
+                      },
+                      "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the network security group."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('networkSecurityGroup', '2025-05-01', 'full').location]"
+                    }
+                  }
+                }
+              }
+            },
+            "virtualNetwork": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.network.virtual-network.{0}', variables('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[variables('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "addressPrefixes": {
+                    "value": "[parameters('addressPrefixes')]"
+                  },
+                  "subnets": {
+                    "copy": [
+                      {
+                        "name": "value",
+                        "count": "[length(parameters('subnets'))]",
+                        "input": "[createObject('name', parameters('subnets')[copyIndex('value')].name, 'addressPrefixes', tryGet(parameters('subnets')[copyIndex('value')], 'addressPrefixes'), 'networkSecurityGroupResourceId', if(not(empty(tryGet(parameters('subnets')[copyIndex('value')], 'networkSecurityGroup'))), reference(format('nsgs[{0}]', copyIndex('value'))).outputs.resourceId.value, null()), 'privateEndpointNetworkPolicies', tryGet(parameters('subnets')[copyIndex('value')], 'privateEndpointNetworkPolicies'), 'privateLinkServiceNetworkPolicies', tryGet(parameters('subnets')[copyIndex('value')], 'privateLinkServiceNetworkPolicies'), 'delegation', tryGet(parameters('subnets')[copyIndex('value')], 'delegation'))]"
+                      }
+                    ]
+                  },
+                  "diagnosticSettings": {
+                    "value": [
+                      {
+                        "name": "vnetDiagnostics",
+                        "workspaceResourceId": "[parameters('logAnalyticsWorkspaceId')]",
+                        "logCategoriesAndGroups": [
+                          {
+                            "categoryGroup": "allLogs",
+                            "enabled": true
+                          }
+                        ],
+                        "metricCategories": [
+                          {
+                            "category": "AllMetrics",
+                            "enabled": true
+                          }
+                        ]
+                      }
+                    ]
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.41.2.15936",
+                      "templateHash": "11272001757446231867"
+                    },
+                    "name": "Virtual Networks",
+                    "description": "This module deploys a Virtual Network (vNet)."
+                  },
+                  "definitions": {
+                    "peeringType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be peer-localVnetName-remoteVnetName."
+                          }
+                        },
+                        "remoteVirtualNetworkResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                          }
+                        },
+                        "allowForwardedTraffic": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                          }
+                        },
+                        "allowGatewayTransit": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                          }
+                        },
+                        "allowVirtualNetworkAccess": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                          }
+                        },
+                        "doNotVerifyRemoteGateways": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Do not verify the provisioning state of the remote gateway. Default is true."
+                          }
+                        },
+                        "useRemoteGateways": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                          }
+                        },
+                        "remotePeeringEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Deploy the outbound and the inbound peering."
+                          }
+                        },
+                        "remotePeeringName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the VNET Peering resource in the remove Virtual Network. If not provided, default value will be peer-remoteVnetName-localVnetName."
+                          }
+                        },
+                        "remotePeeringAllowForwardedTraffic": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                          }
+                        },
+                        "remotePeeringAllowGatewayTransit": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                          }
+                        },
+                        "remotePeeringAllowVirtualNetworkAccess": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                          }
+                        },
+                        "remotePeeringDoNotVerifyRemoteGateways": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Do not verify the provisioning state of the remote gateway. Default is true."
+                          }
+                        },
+                        "remotePeeringUseRemoteGateways": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "subnetType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The Name of the subnet resource."
+                          }
+                        },
+                        "addressPrefix": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
+                          }
+                        },
+                        "addressPrefixes": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
+                          }
+                        },
+                        "ipamPoolPrefixAllocations": {
+                          "type": "array",
+                          "prefixItems": [
+                            {
+                              "type": "object",
+                              "properties": {
+                                "pool": {
+                                  "type": "object",
+                                  "properties": {
+                                    "id": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The Resource ID of the IPAM pool."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The Resource ID of the IPAM pool."
+                                  }
+                                },
+                                "numberOfIpAddresses": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Number of IP addresses allocated from the pool."
+                                  }
+                                }
+                              }
+                            }
+                          ],
+                          "items": false,
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The address space for the subnet, deployed from IPAM Pool. Required if `addressPrefixes` and `addressPrefix` is empty and the VNet address space configured to use IPAM Pool."
+                          }
+                        },
+                        "applicationGatewayIPConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "type": "object"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application gateway IP configurations of virtual network resource."
+                          }
+                        },
+                        "delegation": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The delegation to enable on the subnet."
+                          }
+                        },
+                        "natGatewayResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
+                          }
+                        },
+                        "networkSecurityGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the network security group to assign to the subnet."
+                          }
+                        },
+                        "privateEndpointNetworkPolicies": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled",
+                            "NetworkSecurityGroupEnabled",
+                            "RouteTableEnabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. enable or disable apply network policies on private endpoint in the subnet."
+                          }
+                        },
+                        "privateLinkServiceNetworkPolicies": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. enable or disable apply network policies on private link service in the subnet."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "routeTableResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the route table to assign to the subnet."
+                          }
+                        },
+                        "serviceEndpointPolicies": {
+                          "type": "array",
+                          "items": {
+                            "type": "object"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. An array of service endpoint policies."
+                          }
+                        },
+                        "serviceEndpoints": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The service endpoints to enable on the subnet."
+                          }
+                        },
+                        "defaultOutboundAccess": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
+                          }
+                        },
+                        "sharingScope": {
+                          "type": "string",
+                          "allowedValues": [
+                            "DelegatedServices",
+                            "Tenant"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Set this property to Tenant to allow sharing subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if subnet is empty."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the Virtual Network (vNet)."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "addressPrefixes": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "Required. An Array of 1 or more IP Address Prefixes OR the resource ID of the IPAM pool to be used for the Virtual Network. When specifying an IPAM pool resource ID you must also set a value for the parameter called `ipamPoolNumberOfIpAddresses`."
+                      }
+                    },
+                    "ipamPoolNumberOfIpAddresses": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Number of IP addresses allocated from the pool. To be used only when the addressPrefix param is defined with a resource ID of an IPAM pool."
+                      }
+                    },
+                    "virtualNetworkBgpCommunity": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The BGP community associated with the virtual network."
+                      }
+                    },
+                    "subnets": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/subnetType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. An Array of subnets to deploy to the Virtual Network."
+                      }
+                    },
+                    "dnsServers": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. DNS Servers associated to the Virtual Network."
+                      }
+                    },
+                    "ddosProtectionPlanResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource ID of the DDoS protection plan to assign the VNET to. If it's left blank, DDoS protection will not be configured. If it's provided, the VNET created by this template will be attached to the referenced DDoS protection plan. The DDoS protection plan can exist in the same or in a different subscription."
+                      }
+                    },
+                    "peerings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/peeringType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Virtual Network Peering configurations."
+                      }
+                    },
+                    "vnetEncryption": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates if encryption is enabled on virtual network and if VM without encryption is allowed in encrypted VNet. Requires the EnableVNetEncryption feature to be registered for the subscription and a supported region to use this property."
+                      }
+                    },
+                    "vnetEncryptionEnforcement": {
+                      "type": "string",
+                      "defaultValue": "AllowUnencrypted",
+                      "allowedValues": [
+                        "AllowUnencrypted",
+                        "DropUnencrypted"
+                      ],
+                      "metadata": {
+                        "description": "Optional. If the encrypted VNet allows VM that does not support encryption. Can only be used when vnetEncryption is enabled."
+                      }
+                    },
+                    "flowTimeoutInMinutes": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "maxValue": 30,
+                      "metadata": {
+                        "description": "Optional. The flow timeout in minutes for the Virtual Network, which is used to enable connection tracking for intra-VM flows. Possible values are between 4 and 30 minutes. Default value 0 will set the property to null."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "enableVmProtection": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Indicates if VM protection is enabled for all the subnets in the virtual network."
+                      }
+                    },
+                    "enablePrivateEndpointVNetPolicies": {
+                      "type": "string",
+                      "defaultValue": "Disabled",
+                      "allowedValues": [
+                        "Basic",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Enables high scale private endpoints for the virtual network. This is necessary if the virtual network requires more than 1000 private endpoints or is peered to virtual networks with a total of more than 4000 private endpoints."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-virtualnetwork.{0}.{1}', replace('0.8.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "virtualNetwork": {
+                      "type": "Microsoft.Network/virtualNetworks",
+                      "apiVersion": "2024-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "addressSpace": "[if(contains(parameters('addressPrefixes')[0], '/Microsoft.Network/networkManagers/'), createObject('ipamPoolPrefixAllocations', createArray(createObject('pool', createObject('id', parameters('addressPrefixes')[0]), 'numberOfIpAddresses', parameters('ipamPoolNumberOfIpAddresses')))), createObject('addressPrefixes', parameters('addressPrefixes')))]",
+                        "bgpCommunities": "[if(not(empty(parameters('virtualNetworkBgpCommunity'))), createObject('virtualNetworkCommunity', parameters('virtualNetworkBgpCommunity')), null())]",
+                        "ddosProtectionPlan": "[if(not(empty(parameters('ddosProtectionPlanResourceId'))), createObject('id', parameters('ddosProtectionPlanResourceId')), null())]",
+                        "dhcpOptions": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', array(parameters('dnsServers'))), null())]",
+                        "enableDdosProtection": "[not(empty(parameters('ddosProtectionPlanResourceId')))]",
+                        "encryption": "[if(equals(parameters('vnetEncryption'), true()), createObject('enabled', parameters('vnetEncryption'), 'enforcement', parameters('vnetEncryptionEnforcement')), null())]",
+                        "flowTimeoutInMinutes": "[if(not(equals(parameters('flowTimeoutInMinutes'), 0)), parameters('flowTimeoutInMinutes'), null())]",
+                        "enableVmProtection": "[parameters('enableVmProtection')]",
+                        "privateEndpointVNetPolicies": "[parameters('enablePrivateEndpointVNetPolicies')]"
+                      }
+                    },
+                    "virtualNetwork_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    },
+                    "virtualNetwork_diagnosticSettings": {
+                      "copy": {
+                        "name": "virtualNetwork_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    },
+                    "virtualNetwork_roleAssignments": {
+                      "copy": {
+                        "name": "virtualNetwork_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    },
+                    "virtualNetwork_subnets": {
+                      "copy": {
+                        "name": "virtualNetwork_subnets",
+                        "count": "[length(coalesce(parameters('subnets'), createArray()))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-subnet-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualNetworkName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('subnets'), createArray())[copyIndex()].name]"
+                          },
+                          "addressPrefix": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'addressPrefix')]"
+                          },
+                          "addressPrefixes": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'addressPrefixes')]"
+                          },
+                          "ipamPoolPrefixAllocations": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'ipamPoolPrefixAllocations')]"
+                          },
+                          "applicationGatewayIPConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'applicationGatewayIPConfigurations')]"
+                          },
+                          "delegation": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'delegation')]"
+                          },
+                          "natGatewayResourceId": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'natGatewayResourceId')]"
+                          },
+                          "networkSecurityGroupResourceId": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'networkSecurityGroupResourceId')]"
+                          },
+                          "privateEndpointNetworkPolicies": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'privateEndpointNetworkPolicies')]"
+                          },
+                          "privateLinkServiceNetworkPolicies": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'privateLinkServiceNetworkPolicies')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "routeTableResourceId": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'routeTableResourceId')]"
+                          },
+                          "serviceEndpointPolicies": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'serviceEndpointPolicies')]"
+                          },
+                          "serviceEndpoints": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'serviceEndpoints')]"
+                          },
+                          "defaultOutboundAccess": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'defaultOutboundAccess')]"
+                          },
+                          "sharingScope": {
+                            "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'sharingScope')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "13992200806189615656"
+                            },
+                            "name": "Virtual Network Subnets",
+                            "description": "This module deploys a Virtual Network Subnet."
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Name of the subnet resource."
+                              }
+                            },
+                            "virtualNetworkName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual network. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "addressPrefix": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
+                              }
+                            },
+                            "ipamPoolPrefixAllocations": {
+                              "type": "array",
+                              "items": {
+                                "type": "object"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. The address space for the subnet, deployed from IPAM Pool. Required if `addressPrefixes` and `addressPrefix` is empty."
+                              }
+                            },
+                            "networkSecurityGroupResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the network security group to assign to the subnet."
+                              }
+                            },
+                            "routeTableResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the route table to assign to the subnet."
+                              }
+                            },
+                            "serviceEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The service endpoints to enable on the subnet."
+                              }
+                            },
+                            "delegation": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The delegation to enable on the subnet."
+                              }
+                            },
+                            "natGatewayResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
+                              }
+                            },
+                            "privateEndpointNetworkPolicies": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled",
+                                "NetworkSecurityGroupEnabled",
+                                "RouteTableEnabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Enable or disable apply network policies on private endpoint in the subnet."
+                              }
+                            },
+                            "privateLinkServiceNetworkPolicies": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Enable or disable apply network policies on private link service in the subnet."
+                              }
+                            },
+                            "addressPrefixes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
+                              }
+                            },
+                            "defaultOutboundAccess": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
+                              }
+                            },
+                            "sharingScope": {
+                              "type": "string",
+                              "allowedValues": [
+                                "DelegatedServices",
+                                "Tenant"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set this property to Tenant to allow sharing the subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if the subnet is empty."
+                              }
+                            },
+                            "applicationGatewayIPConfigurations": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Application gateway IP configurations of virtual network resource."
+                              }
+                            },
+                            "serviceEndpointPolicies": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. An array of service endpoint policies."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-virtualnetworksubnet.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "virtualNetwork": {
+                              "existing": true,
+                              "type": "Microsoft.Network/virtualNetworks",
+                              "apiVersion": "2024-01-01",
+                              "name": "[parameters('virtualNetworkName')]"
+                            },
+                            "subnet": {
+                              "type": "Microsoft.Network/virtualNetworks/subnets",
+                              "apiVersion": "2024-05-01",
+                              "name": "[format('{0}/{1}', parameters('virtualNetworkName'), parameters('name'))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "serviceEndpoints",
+                                    "count": "[length(parameters('serviceEndpoints'))]",
+                                    "input": {
+                                      "service": "[parameters('serviceEndpoints')[copyIndex('serviceEndpoints')]]"
+                                    }
+                                  }
+                                ],
+                                "addressPrefix": "[parameters('addressPrefix')]",
+                                "addressPrefixes": "[parameters('addressPrefixes')]",
+                                "ipamPoolPrefixAllocations": "[parameters('ipamPoolPrefixAllocations')]",
+                                "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]",
+                                "routeTable": "[if(not(empty(parameters('routeTableResourceId'))), createObject('id', parameters('routeTableResourceId')), null())]",
+                                "natGateway": "[if(not(empty(parameters('natGatewayResourceId'))), createObject('id', parameters('natGatewayResourceId')), null())]",
+                                "delegations": "[if(not(empty(parameters('delegation'))), createArray(createObject('name', parameters('delegation'), 'properties', createObject('serviceName', parameters('delegation')))), createArray())]",
+                                "privateEndpointNetworkPolicies": "[parameters('privateEndpointNetworkPolicies')]",
+                                "privateLinkServiceNetworkPolicies": "[parameters('privateLinkServiceNetworkPolicies')]",
+                                "applicationGatewayIPConfigurations": "[parameters('applicationGatewayIPConfigurations')]",
+                                "serviceEndpointPolicies": "[parameters('serviceEndpointPolicies')]",
+                                "defaultOutboundAccess": "[parameters('defaultOutboundAccess')]",
+                                "sharingScope": "[parameters('sharingScope')]"
+                              }
+                            },
+                            "subnet_roleAssignments": {
+                              "copy": {
+                                "name": "subnet_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "subnet"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the virtual network peering was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the virtual network peering."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the virtual network peering."
+                              },
+                              "value": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name'))]"
+                            },
+                            "addressPrefix": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The address prefix for the subnet."
+                              },
+                              "value": "[coalesce(tryGet(reference('subnet'), 'addressPrefix'), '')]"
+                            },
+                            "addressPrefixes": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "List of address prefixes for the subnet."
+                              },
+                              "value": "[coalesce(tryGet(reference('subnet'), 'addressPrefixes'), createArray())]"
+                            },
+                            "ipamPoolPrefixAllocations": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "The IPAM pool prefix allocations for the subnet."
+                              },
+                              "value": "[coalesce(tryGet(reference('subnet'), 'ipamPoolPrefixAllocations'), createArray())]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "virtualNetwork"
+                      ]
+                    },
+                    "virtualNetwork_peering_local": {
+                      "copy": {
+                        "name": "virtualNetwork_peering_local",
+                        "count": "[length(coalesce(parameters('peerings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-virtualNetworkPeering-local-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "localVnetName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "remoteVirtualNetworkResourceId": {
+                            "value": "[coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "allowForwardedTraffic": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowForwardedTraffic')]"
+                          },
+                          "allowGatewayTransit": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowGatewayTransit')]"
+                          },
+                          "allowVirtualNetworkAccess": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowVirtualNetworkAccess')]"
+                          },
+                          "doNotVerifyRemoteGateways": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'doNotVerifyRemoteGateways')]"
+                          },
+                          "useRemoteGateways": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'useRemoteGateways')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "6939030350004475953"
+                            },
+                            "name": "Virtual Network Peerings",
+                            "description": "This module deploys a Virtual Network Peering."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('peer-{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkResourceId'), '/')))]",
+                              "metadata": {
+                                "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
+                              }
+                            },
+                            "localVnetName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "remoteVirtualNetworkResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                              }
+                            },
+                            "allowForwardedTraffic": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                              }
+                            },
+                            "allowGatewayTransit": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                              }
+                            },
+                            "allowVirtualNetworkAccess": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                              }
+                            },
+                            "doNotVerifyRemoteGateways": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
+                              }
+                            },
+                            "useRemoteGateways": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
+                              "apiVersion": "2024-01-01",
+                              "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
+                              "properties": {
+                                "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
+                                "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
+                                "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
+                                "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
+                                "useRemoteGateways": "[parameters('useRemoteGateways')]",
+                                "remoteVirtualNetwork": {
+                                  "id": "[parameters('remoteVirtualNetworkResourceId')]"
+                                }
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the virtual network peering was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the virtual network peering."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the virtual network peering."
+                              },
+                              "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "virtualNetwork",
+                        "virtualNetwork_subnets"
+                      ]
+                    },
+                    "virtualNetwork_peering_remote": {
+                      "copy": {
+                        "name": "virtualNetwork_peering_remote",
+                        "count": "[length(coalesce(parameters('peerings'), createArray()))]"
+                      },
+                      "condition": "[coalesce(tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringEnabled'), false())]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-virtualNetworkPeering-remote-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/')[2]]",
+                      "resourceGroup": "[split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "localVnetName": {
+                            "value": "[last(split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/'))]"
+                          },
+                          "remoteVirtualNetworkResourceId": {
+                            "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringName')]"
+                          },
+                          "allowForwardedTraffic": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowForwardedTraffic')]"
+                          },
+                          "allowGatewayTransit": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowGatewayTransit')]"
+                          },
+                          "allowVirtualNetworkAccess": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowVirtualNetworkAccess')]"
+                          },
+                          "doNotVerifyRemoteGateways": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringDoNotVerifyRemoteGateways')]"
+                          },
+                          "useRemoteGateways": {
+                            "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringUseRemoteGateways')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "6939030350004475953"
+                            },
+                            "name": "Virtual Network Peerings",
+                            "description": "This module deploys a Virtual Network Peering."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('peer-{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkResourceId'), '/')))]",
+                              "metadata": {
+                                "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
+                              }
+                            },
+                            "localVnetName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "remoteVirtualNetworkResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                              }
+                            },
+                            "allowForwardedTraffic": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                              }
+                            },
+                            "allowGatewayTransit": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                              }
+                            },
+                            "allowVirtualNetworkAccess": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                              }
+                            },
+                            "doNotVerifyRemoteGateways": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
+                              }
+                            },
+                            "useRemoteGateways": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
+                              "apiVersion": "2024-01-01",
+                              "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
+                              "properties": {
+                                "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
+                                "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
+                                "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
+                                "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
+                                "useRemoteGateways": "[parameters('useRemoteGateways')]",
+                                "remoteVirtualNetwork": {
+                                  "id": "[parameters('remoteVirtualNetworkResourceId')]"
+                                }
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the virtual network peering was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the virtual network peering."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the virtual network peering."
+                              },
+                              "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "virtualNetwork",
+                        "virtualNetwork_subnets"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the virtual network was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the virtual network."
+                      },
+                      "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the virtual network."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "subnetNames": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The names of the deployed subnets."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('subnets'), createArray()))]",
+                        "input": "[reference(format('virtualNetwork_subnets[{0}]', copyIndex())).outputs.name.value]"
+                      }
+                    },
+                    "subnetResourceIds": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The resource IDs of the deployed subnets."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('subnets'), createArray()))]",
+                        "input": "[reference(format('virtualNetwork_subnets[{0}]', copyIndex())).outputs.resourceId.value]"
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('virtualNetwork', '2024-05-01', 'full').location]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "nsgs"
+              ]
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "value": "[reference('virtualNetwork').outputs.name.value]"
+            },
+            "resourceId": {
+              "type": "string",
+              "value": "[reference('virtualNetwork').outputs.resourceId.value]"
+            },
+            "subnets": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/subnetOutputType"
+              },
+              "copy": {
+                "count": "[length(parameters('subnets'))]",
+                "input": {
+                  "name": "[parameters('subnets')[copyIndex()].name]",
+                  "resourceId": "[reference('virtualNetwork').outputs.subnetResourceIds.value[copyIndex()]]",
+                  "nsgName": "[if(not(empty(tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup'))), tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup', 'name'), null())]",
+                  "nsgResourceId": "[if(not(empty(tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup'))), reference(format('nsgs[{0}]', copyIndex())).outputs.resourceId.value, null())]"
+                }
+              }
+            },
+            "backendSubnetResourceId": {
+              "type": "string",
+              "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'backend'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'backend')], '')]"
+            },
+            "containerSubnetResourceId": {
+              "type": "string",
+              "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'containers'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'containers')], '')]"
+            },
+            "webserverfarmSubnetResourceId": {
+              "type": "string",
+              "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'webserverfarm'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'webserverfarm')], '')]"
+            },
+            "administrationSubnetResourceId": {
+              "type": "string",
+              "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'administration'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'administration')], '')]"
+            },
+            "bastionSubnetResourceId": {
+              "type": "string",
+              "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'AzureBastionSubnet'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'AzureBastionSubnet')], '')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "log_analytics"
+      ]
+    },
+    "bastionHost": {
+      "condition": "[parameters('enablePrivateNetworking')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.bastion-host.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "virtualNetworkResourceId": {
+            "value": "[reference('virtualNetwork').outputs.resourceId.value]"
+          },
+          "publicIPDiagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', null()))]",
+          "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', null()))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "4613446280405157854"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "virtualNetworkResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the virtual network."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Diagnostic settings for the resource."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "Standard",
+              "metadata": {
+                "description": "SKU name for the Bastion Host."
+              }
+            },
+            "scaleUnits": {
+              "type": "int",
+              "defaultValue": 4,
+              "metadata": {
+                "description": "Number of scale units."
+              }
+            },
+            "disableCopyPaste": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Disable copy/paste functionality."
+              }
+            },
+            "enableFileCopy": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable file copy functionality."
+              }
+            },
+            "enableIpConnect": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable IP Connect functionality."
+              }
+            },
+            "enableShareableLink": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable shareable link functionality."
+              }
+            },
+            "availabilityZones": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Availability zones for the Bastion Host public IP. Pass empty array to disable zone redundancy."
+              }
+            },
+            "publicIPDiagnosticSettings": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Diagnostic settings for the public IP address."
+              }
+            }
+          },
+          "variables": {
+            "name": "[format('bas-{0}', parameters('solutionName'))]"
+          },
+          "resources": {
+            "bastionHost": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.network.bastion-host.{0}', variables('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[variables('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "skuName": {
+                    "value": "[parameters('skuName')]"
+                  },
+                  "virtualNetworkResourceId": {
+                    "value": "[parameters('virtualNetworkResourceId')]"
+                  },
+                  "availabilityZones": {
+                    "value": "[parameters('availabilityZones')]"
+                  },
+                  "publicIPAddressObject": {
+                    "value": {
+                      "name": "[format('pip-{0}', variables('name'))]",
+                      "diagnosticSettings": "[parameters('publicIPDiagnosticSettings')]",
+                      "tags": "[parameters('tags')]"
+                    }
+                  },
+                  "disableCopyPaste": {
+                    "value": "[parameters('disableCopyPaste')]"
+                  },
+                  "enableFileCopy": {
+                    "value": "[parameters('enableFileCopy')]"
+                  },
+                  "enableIpConnect": {
+                    "value": "[parameters('enableIpConnect')]"
+                  },
+                  "enableShareableLink": {
+                    "value": "[parameters('enableShareableLink')]"
+                  },
+                  "scaleUnits": {
+                    "value": "[parameters('scaleUnits')]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[parameters('diagnosticSettings')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.39.26.7824",
+                      "templateHash": "7741601918225805390"
+                    },
+                    "name": "Bastion Hosts",
+                    "description": "This module deploys a Bastion Host."
+                  },
+                  "definitions": {
+                    "publicIPAddressObjectType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the Public IP Address."
+                          }
+                        },
+                        "publicIpPrefixResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                          }
+                        },
+                        "publicIPAllocationMethod": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Dynamic",
+                            "Static"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The public IP address allocation method."
+                          }
+                        },
+                        "availabilityZones": {
+                          "type": "array",
+                          "items": {
+                            "type": "int"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                          }
+                        },
+                        "publicIPAddressVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "IPv4",
+                            "IPv6"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. IP address version."
+                          }
+                        },
+                        "dnsSettings": {
+                          "$ref": "#/definitions/dnsSettingsType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The DNS settings of the public IP address."
+                          }
+                        },
+                        "ipTags": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/ipTagType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The list of tags associated with the public IP address."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The lock settings of the service."
+                          }
+                        },
+                        "skuName": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Basic",
+                            "Standard"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of a public IP address SKU."
+                          }
+                        },
+                        "skuTier": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Global",
+                            "Regional"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tier of a public IP address SKU."
+                          }
+                        },
+                        "ddosSettings": {
+                          "$ref": "#/definitions/ddosSettingsType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for the Public IP resource."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create for the Public IP resource."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable usage telemetry for the Public IP module."
+                          }
+                        },
+                        "idleTimeoutInMinutes": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Idle timeout in minutes for the Public IP resource."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/publicIPAddresses@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to apply to the Public IP resource."
+                          },
+                          "nullable": true
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Diagnostic settings for the Public IP resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the properties of the Public IP to create and be used by Azure Bastion, if no existing public IP was provided."
+                      }
+                    },
+                    "ddosSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "ddosProtectionPlan": {
+                          "type": "object",
+                          "properties": {
+                            "id": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The DDoS protection plan associated with the public IP address."
+                          }
+                        },
+                        "protectionMode": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Enabled"
+                          ],
+                          "metadata": {
+                            "description": "Required. The DDoS protection policy customizations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.10.0"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "diagnosticSettingLogsOnlyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "dnsSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "domainNameLabel": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                          }
+                        },
+                        "domainNameLabelScope": {
+                          "type": "string",
+                          "allowedValues": [
+                            "NoReuse",
+                            "ResourceGroupReuse",
+                            "SubscriptionReuse",
+                            "TenantReuse"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                          }
+                        },
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                          }
+                        },
+                        "reverseFqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.10.0"
+                        }
+                      }
+                    },
+                    "ipTagType": {
+                      "type": "object",
+                      "properties": {
+                        "ipTagType": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IP tag type."
+                          }
+                        },
+                        "tag": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IP tag."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.10.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Azure Bastion resource."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "virtualNetworkResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Shared services Virtual Network resource Id."
+                      }
+                    },
+                    "bastionSubnetPublicIpResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The Public IP resource ID to associate to the azureBastionSubnet. If empty, then the Public IP that is created as part of this module will be applied to the azureBastionSubnet. This parameter is ignored when enablePrivateOnlyBastion is true."
+                      }
+                    },
+                    "publicIPAddressObject": {
+                      "$ref": "#/definitions/publicIPAddressObjectType",
+                      "defaultValue": {
+                        "name": "[format('{0}-pip', parameters('name'))]"
+                      },
+                      "metadata": {
+                        "description": "Optional. Specifies the properties of the Public IP to create and be used by Azure Bastion, if no existing public IP was provided. This parameter is ignored when enablePrivateOnlyBastion is true."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "Basic",
+                      "allowedValues": [
+                        "Basic",
+                        "Developer",
+                        "Premium",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The SKU of this Bastion Host."
+                      }
+                    },
+                    "disableCopyPaste": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Choose to disable or enable Copy Paste. For Basic and Developer SKU Copy/Paste is always enabled."
+                      }
+                    },
+                    "enableFileCopy": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Choose to disable or enable File Copy. Not supported for Basic and Developer SKU."
+                      }
+                    },
+                    "enableIpConnect": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Choose to disable or enable IP Connect. Not supported for Basic and Developer SKU."
+                      }
+                    },
+                    "enableKerberos": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Choose to disable or enable Kerberos authentication. Not supported for Developer SKU."
+                      }
+                    },
+                    "enableShareableLink": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Choose to disable or enable Shareable Link. Not supported for Basic and Developer SKU."
+                      }
+                    },
+                    "enableSessionRecording": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Choose to disable or enable Session Recording feature. The Premium SKU is required for this feature. If Session Recording is enabled, the Native client support will be disabled."
+                      }
+                    },
+                    "enablePrivateOnlyBastion": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Choose to disable or enable Private-only Bastion deployment. The Premium SKU is required for this feature."
+                      }
+                    },
+                    "scaleUnits": {
+                      "type": "int",
+                      "defaultValue": 2,
+                      "metadata": {
+                        "description": "Optional. The scale units for the Bastion Host resource. The Basic and Developer SKU only support 2 scale units."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Network/bastionHosts@2024-07-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "availabilityZones": {
+                      "type": "array",
+                      "items": {
+                        "type": "int"
+                      },
+                      "defaultValue": [],
+                      "allowedValues": [
+                        1,
+                        2,
+                        3
+                      ],
+                      "metadata": {
+                        "description": "Optional. The list of Availability zones to use for the zone-redundant resources."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-bastionhost.{0}.{1}', replace('0.8.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "azureBastion": {
+                      "type": "Microsoft.Network/bastionHosts",
+                      "apiVersion": "2025-01-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[coalesce(parameters('tags'), createObject())]",
+                      "sku": {
+                        "name": "[parameters('skuName')]"
+                      },
+                      "zones": "[if(equals(parameters('skuName'), 'Developer'), createArray(), map(parameters('availabilityZones'), lambda('zone', format('{0}', lambdaVariables('zone')))))]",
+                      "properties": "[union(createObject('scaleUnits', if(or(equals(parameters('skuName'), 'Basic'), equals(parameters('skuName'), 'Developer')), 2, parameters('scaleUnits')), 'ipConfigurations', if(equals(parameters('skuName'), 'Developer'), createArray(), createArray(createObject('name', 'IpConfAzureBastionSubnet', 'properties', union(createObject('subnet', createObject('id', format('{0}/subnets/AzureBastionSubnet', parameters('virtualNetworkResourceId')))), if(not(parameters('enablePrivateOnlyBastion')), createObject('publicIPAddress', createObject('id', if(not(empty(parameters('bastionSubnetPublicIpResourceId'))), parameters('bastionSubnetPublicIpResourceId'), reference('publicIPAddress').outputs.resourceId.value))), createObject())))))), if(equals(parameters('skuName'), 'Developer'), createObject('virtualNetwork', createObject('id', parameters('virtualNetworkResourceId'))), createObject()), if(or(or(equals(parameters('skuName'), 'Basic'), equals(parameters('skuName'), 'Standard')), equals(parameters('skuName'), 'Premium')), createObject('enableKerberos', parameters('enableKerberos')), createObject()), if(or(equals(parameters('skuName'), 'Standard'), equals(parameters('skuName'), 'Premium')), createObject('enableTunneling', if(equals(parameters('skuName'), 'Standard'), true(), if(parameters('enableSessionRecording'), false(), true())), 'disableCopyPaste', parameters('disableCopyPaste'), 'enableFileCopy', parameters('enableFileCopy'), 'enableIpConnect', parameters('enableIpConnect'), 'enableShareableLink', parameters('enableShareableLink')), createObject()), if(equals(parameters('skuName'), 'Premium'), createObject('enableSessionRecording', parameters('enableSessionRecording'), 'enablePrivateOnlyBastion', parameters('enablePrivateOnlyBastion')), createObject()))]",
+                      "dependsOn": [
+                        "publicIPAddress"
+                      ]
+                    },
+                    "azureBastion_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "azureBastion"
+                      ]
+                    },
+                    "azureBastion_diagnosticSettings": {
+                      "copy": {
+                        "name": "azureBastion_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "azureBastion"
+                      ]
+                    },
+                    "azureBastion_roleAssignments": {
+                      "copy": {
+                        "name": "azureBastion_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/bastionHosts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "azureBastion"
+                      ]
+                    },
+                    "publicIPAddress": {
+                      "condition": "[and(and(empty(parameters('bastionSubnetPublicIpResourceId')), not(equals(parameters('skuName'), 'Developer'))), not(parameters('enablePrivateOnlyBastion')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Bastion-PIP', uniqueString(subscription().id, resourceGroup().id, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('publicIPAddressObject').name]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "lock": {
+                            "value": "[parameters('lock')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'diagnosticSettings')]"
+                          },
+                          "ddosSettings": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'ddosSettings')]"
+                          },
+                          "dnsSettings": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'dnsSettings')]"
+                          },
+                          "idleTimeoutInMinutes": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'idleTimeoutInMinutes')]"
+                          },
+                          "ipTags": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'ipTags')]"
+                          },
+                          "publicIPAddressVersion": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAddressVersion')]"
+                          },
+                          "publicIPAllocationMethod": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAllocationMethod')]"
+                          },
+                          "publicIpPrefixResourceId": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIpPrefixResourceId')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'roleAssignments')]"
+                          },
+                          "skuName": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'skuName')]"
+                          },
+                          "skuTier": {
+                            "value": "[tryGet(parameters('publicIPAddressObject'), 'skuTier')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('publicIPAddressObject'), 'tags'), parameters('tags'))]"
+                          },
+                          "availabilityZones": {
+                            "value": "[coalesce(tryGet(parameters('publicIPAddressObject'), 'availabilityZones'), if(not(empty(parameters('availabilityZones'))), parameters('availabilityZones'), null()))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "16564959277054027786"
+                            },
+                            "name": "Public IP Addresses",
+                            "description": "This module deploys a Public IP Address."
+                          },
+                          "definitions": {
+                            "dnsSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "domainNameLabel": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                  }
+                                },
+                                "domainNameLabelScope": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "NoReuse",
+                                    "ResourceGroupReuse",
+                                    "SubscriptionReuse",
+                                    "TenantReuse"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                  }
+                                },
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                  }
+                                },
+                                "reverseFqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "ddosSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "ddosProtectionPlan": {
+                                  "type": "object",
+                                  "properties": {
+                                    "id": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                  }
+                                },
+                                "protectionMode": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Enabled"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The DDoS protection policy customizations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "ipTagType": {
+                              "type": "object",
+                              "properties": {
+                                "ipTagType": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IP tag type."
+                                  }
+                                },
+                                "tag": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IP tag."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Public IP Address."
+                              }
+                            },
+                            "publicIpPrefixResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                              }
+                            },
+                            "publicIPAllocationMethod": {
+                              "type": "string",
+                              "defaultValue": "Static",
+                              "allowedValues": [
+                                "Dynamic",
+                                "Static"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The public IP address allocation method."
+                              }
+                            },
+                            "availabilityZones": {
+                              "type": "array",
+                              "items": {
+                                "type": "int"
+                              },
+                              "defaultValue": [
+                                1,
+                                2,
+                                3
+                              ],
+                              "allowedValues": [
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                              }
+                            },
+                            "publicIPAddressVersion": {
+                              "type": "string",
+                              "defaultValue": "IPv4",
+                              "allowedValues": [
+                                "IPv4",
+                                "IPv6"
+                              ],
+                              "metadata": {
+                                "description": "Optional. IP address version."
+                              }
+                            },
+                            "dnsSettings": {
+                              "$ref": "#/definitions/dnsSettingsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The DNS settings of the public IP address."
+                              }
+                            },
+                            "ipTags": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/ipTagType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The list of tags associated with the public IP address."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "skuName": {
+                              "type": "string",
+                              "defaultValue": "Standard",
+                              "allowedValues": [
+                                "Basic",
+                                "Standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Name of a public IP address SKU."
+                              }
+                            },
+                            "skuTier": {
+                              "type": "string",
+                              "defaultValue": "Regional",
+                              "allowedValues": [
+                                "Global",
+                                "Regional"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Tier of a public IP address SKU."
+                              }
+                            },
+                            "ddosSettings": {
+                              "$ref": "#/definitions/ddosSettingsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                              }
+                            },
+                            "deleteOption": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Delete",
+                                "Detach"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The delete option for the public IP address."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "idleTimeoutInMinutes": {
+                              "type": "int",
+                              "defaultValue": 4,
+                              "metadata": {
+                                "description": "Optional. The idle timeout of the public IP address."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.10.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "publicIpAddress": {
+                              "type": "Microsoft.Network/publicIPAddresses",
+                              "apiVersion": "2025-01-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "sku": {
+                                "name": "[parameters('skuName')]",
+                                "tier": "[parameters('skuTier')]"
+                              },
+                              "zones": "[map(parameters('availabilityZones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                              "properties": {
+                                "ddosSettings": "[parameters('ddosSettings')]",
+                                "dnsSettings": "[parameters('dnsSettings')]",
+                                "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                                "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                                "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                                "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                                "ipTags": "[parameters('ipTags')]",
+                                "deleteOption": "[parameters('deleteOption')]"
+                              }
+                            },
+                            "publicIpAddress_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "publicIpAddress"
+                              ]
+                            },
+                            "publicIpAddress_roleAssignments": {
+                              "copy": {
+                                "name": "publicIpAddress_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "publicIpAddress"
+                              ]
+                            },
+                            "publicIpAddress_diagnosticSettings": {
+                              "copy": {
+                                "name": "publicIpAddress_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "publicIpAddress"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the public IP address was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the public IP address."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the public IP address."
+                              },
+                              "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                            },
+                            "ipAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The public IP address of the public IP address resource."
+                              },
+                              "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('publicIpAddress', '2025-01-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the Azure Bastion was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name the Azure Bastion."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID the Azure Bastion."
+                      },
+                      "value": "[resourceId('Microsoft.Network/bastionHosts', parameters('name'))]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('azureBastion', '2025-01-01', 'full').location]"
+                    },
+                    "ipConfAzureBastionSubnet": {
+                      "type": "object",
+                      "metadata": {
+                        "description": "The Public IPconfiguration object for the AzureBastionSubnet."
+                      },
+                      "value": "[if(equals(parameters('skuName'), 'Developer'), createObject(), reference('azureBastion').ipConfigurations[0])]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Bastion Host."
+              },
+              "value": "[reference('bastionHost').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Bastion Host."
+              },
+              "value": "[reference('bastionHost').outputs.name.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "log_analytics",
+        "virtualNetwork"
+      ]
+    },
+    "maintenanceConfiguration": {
+      "condition": "[parameters('enablePrivateNetworking')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.maintenance-configuration.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "8420279536133240728"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('mc-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the maintenance configuration."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "maintenanceScope": {
+              "type": "string",
+              "defaultValue": "InGuestPatch",
+              "metadata": {
+                "description": "Maintenance scope."
+              }
+            },
+            "visibility": {
+              "type": "string",
+              "defaultValue": "Custom",
+              "metadata": {
+                "description": "Visibility of the configuration."
+              }
+            },
+            "extensionProperties": {
+              "type": "object",
+              "defaultValue": {
+                "InGuestPatchMode": "User"
+              },
+              "metadata": {
+                "description": "Extension properties."
+              }
+            },
+            "maintenanceWindow": {
+              "type": "object",
+              "defaultValue": {
+                "startDateTime": "2024-06-16 00:00",
+                "duration": "03:55",
+                "timeZone": "W. Europe Standard Time",
+                "recurEvery": "1Day"
+              },
+              "metadata": {
+                "description": "Maintenance window configuration."
+              }
+            },
+            "installPatches": {
+              "type": "object",
+              "defaultValue": {
+                "rebootSetting": "IfRequired",
+                "windowsParameters": {
+                  "classificationsToInclude": [
+                    "Critical",
+                    "Security"
+                  ]
+                },
+                "linuxParameters": {
+                  "classificationsToInclude": [
+                    "Critical",
+                    "Security"
+                  ]
+                }
+              },
+              "metadata": {
+                "description": "Install patches configuration."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable Azure telemetry collection."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.maintenance.maintenance-configuration.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "extensionProperties": {
+                    "value": "[parameters('extensionProperties')]"
+                  },
+                  "maintenanceScope": {
+                    "value": "[parameters('maintenanceScope')]"
+                  },
+                  "maintenanceWindow": {
+                    "value": "[parameters('maintenanceWindow')]"
+                  },
+                  "visibility": {
+                    "value": "[parameters('visibility')]"
+                  },
+                  "installPatches": {
+                    "value": "[parameters('installPatches')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.41.2.15936",
+                      "templateHash": "14895287194406877557"
+                    },
+                    "name": "Maintenance Configurations",
+                    "description": "This module deploys a Maintenance Configuration."
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Maintenance Configuration Name."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "extensionProperties": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/extensionProperties"
+                        },
+                        "description": "Optional. Gets or sets extensionProperties of the maintenanceConfiguration."
+                      },
+                      "defaultValue": {}
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "maintenanceScope": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/maintenanceScope"
+                        },
+                        "description": "Optional. Gets or sets maintenanceScope of the configuration."
+                      },
+                      "defaultValue": "Host"
+                    },
+                    "maintenanceWindow": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/maintenanceWindow"
+                        },
+                        "description": "Optional. Definition of a MaintenanceWindow."
+                      },
+                      "defaultValue": {}
+                    },
+                    "namespace": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Gets or sets namespace of the resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/tags"
+                        },
+                        "description": "Optional. Gets or sets tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "visibility": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/visibility"
+                        },
+                        "description": "Optional. Gets or sets the visibility of the configuration. The default value is 'Custom'."
+                      },
+                      "nullable": true
+                    },
+                    "installPatches": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/installPatches"
+                        },
+                        "description": "Optional. Configuration settings for VM guest patching with Azure Update Manager."
+                      },
+                      "defaultValue": {}
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "Scheduled Patching Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cd08ab90-6b14-449c-ad9a-8f8e549482c6')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('46d3xbcp.res.maintenance-maintenanceconfiguration.{0}.{1}', replace('0.4.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "maintenanceConfiguration": {
+                      "type": "Microsoft.Maintenance/maintenanceConfigurations",
+                      "apiVersion": "2023-04-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "extensionProperties": "[parameters('extensionProperties')]",
+                        "maintenanceScope": "[parameters('maintenanceScope')]",
+                        "maintenanceWindow": "[parameters('maintenanceWindow')]",
+                        "namespace": "[parameters('namespace')]",
+                        "visibility": "[parameters('visibility')]",
+                        "installPatches": "[if(equals(parameters('maintenanceScope'), 'InGuestPatch'), parameters('installPatches'), null())]"
+                      }
+                    },
+                    "maintenanceConfiguration_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "maintenanceConfiguration"
+                      ]
+                    },
+                    "maintenanceConfiguration_roleAssignments": {
+                      "copy": {
+                        "name": "maintenanceConfiguration_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Maintenance/maintenanceConfigurations', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "maintenanceConfiguration"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Maintenance Configuration."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Maintenance Configuration."
+                      },
+                      "value": "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the Maintenance Configuration was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the Maintenance Configuration was created in."
+                      },
+                      "value": "[reference('maintenanceConfiguration', '2023-04-01', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the maintenance configuration."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.maintenance.maintenance-configuration.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the maintenance configuration."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.maintenance.maintenance-configuration.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+            }
+          }
+        }
+      }
+    },
+    "windowsVmDataCollectionRules": {
+      "condition": "[and(parameters('enablePrivateNetworking'), parameters('enableMonitoring'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.data-collection-rule.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": "[if(variables('useExistingLogAnalytics'), createObject('value', reference('existingLogAnalyticsWorkspace', '2025-07-01', 'full').location), if(parameters('enableMonitoring'), createObject('value', reference('log_analytics').outputs.location.value), createObject('value', parameters('location'))))]",
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "logAnalyticsWorkspaceResourceId": "[if(variables('useExistingLogAnalytics'), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8])), if(parameters('enableMonitoring'), createObject('value', reference('log_analytics').outputs.resourceId.value), createObject('value', '')))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "14701803776432038764"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('dcr-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the data collection rule. Defaults to dcr-{solutionName}."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "logAnalyticsWorkspaceResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Log Analytics workspace destination."
+              }
+            },
+            "logAnalyticsWorkspaceName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Name of the Log Analytics workspace (used for destination naming)."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "variables": {
+            "dcrLogAnalyticsDestinationName": "[if(not(empty(parameters('logAnalyticsWorkspaceName'))), format('la-{0}-destination', parameters('logAnalyticsWorkspaceName')), format('la-{0}-destination', parameters('name')))]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.insights.data-collection-rule.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "dataCollectionRuleProperties": {
+                    "value": {
+                      "kind": "Windows",
+                      "dataSources": {
+                        "performanceCounters": [
+                          {
+                            "streams": [
+                              "Microsoft-Perf"
+                            ],
+                            "samplingFrequencyInSeconds": 60,
+                            "counterSpecifiers": [
+                              "\\Processor Information(_Total)\\% Processor Time",
+                              "\\Processor Information(_Total)\\% Privileged Time",
+                              "\\Processor Information(_Total)\\% User Time",
+                              "\\Processor Information(_Total)\\Processor Frequency",
+                              "\\System\\Processes",
+                              "\\Process(_Total)\\Thread Count",
+                              "\\Process(_Total)\\Handle Count",
+                              "\\System\\System Up Time",
+                              "\\System\\Context Switches/sec",
+                              "\\System\\Processor Queue Length",
+                              "\\Memory\\% Committed Bytes In Use",
+                              "\\Memory\\Available Bytes",
+                              "\\Memory\\Committed Bytes",
+                              "\\Memory\\Cache Bytes",
+                              "\\Memory\\Pool Paged Bytes",
+                              "\\Memory\\Pool Nonpaged Bytes",
+                              "\\Memory\\Pages/sec",
+                              "\\Memory\\Page Faults/sec",
+                              "\\Process(_Total)\\Working Set",
+                              "\\Process(_Total)\\Working Set - Private",
+                              "\\LogicalDisk(_Total)\\% Disk Time",
+                              "\\LogicalDisk(_Total)\\% Disk Read Time",
+                              "\\LogicalDisk(_Total)\\% Disk Write Time",
+                              "\\LogicalDisk(_Total)\\% Idle Time",
+                              "\\LogicalDisk(_Total)\\Disk Bytes/sec",
+                              "\\LogicalDisk(_Total)\\Disk Read Bytes/sec",
+                              "\\LogicalDisk(_Total)\\Disk Write Bytes/sec",
+                              "\\LogicalDisk(_Total)\\Disk Transfers/sec",
+                              "\\LogicalDisk(_Total)\\Disk Reads/sec",
+                              "\\LogicalDisk(_Total)\\Disk Writes/sec",
+                              "\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer",
+                              "\\LogicalDisk(_Total)\\Avg. Disk sec/Read",
+                              "\\LogicalDisk(_Total)\\Avg. Disk sec/Write",
+                              "\\LogicalDisk(_Total)\\Avg. Disk Queue Length",
+                              "\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length",
+                              "\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length",
+                              "\\LogicalDisk(_Total)\\% Free Space",
+                              "\\LogicalDisk(_Total)\\Free Megabytes",
+                              "\\Network Interface(*)\\Bytes Total/sec",
+                              "\\Network Interface(*)\\Bytes Sent/sec",
+                              "\\Network Interface(*)\\Bytes Received/sec",
+                              "\\Network Interface(*)\\Packets/sec",
+                              "\\Network Interface(*)\\Packets Sent/sec",
+                              "\\Network Interface(*)\\Packets Received/sec",
+                              "\\Network Interface(*)\\Packets Outbound Errors",
+                              "\\Network Interface(*)\\Packets Received Errors"
+                            ],
+                            "name": "perfCounterDataSource60"
+                          }
+                        ],
+                        "windowsEventLogs": [
+                          {
+                            "name": "SecurityAuditEvents",
+                            "streams": [
+                              "Microsoft-WindowsEvent"
+                            ],
+                            "xPathQueries": [
+                              "Security!*[System[(EventID=4624 or EventID=4625)]]"
+                            ]
+                          },
+                          {
+                            "name": "AuditSuccessFailure",
+                            "streams": [
+                              "Microsoft-Event"
+                            ],
+                            "xPathQueries": [
+                              "Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]"
+                            ]
+                          }
+                        ]
+                      },
+                      "destinations": {
+                        "logAnalytics": [
+                          {
+                            "workspaceResourceId": "[parameters('logAnalyticsWorkspaceResourceId')]",
+                            "name": "[variables('dcrLogAnalyticsDestinationName')]"
+                          }
+                        ]
+                      },
+                      "dataFlows": [
+                        {
+                          "streams": [
+                            "Microsoft-Perf"
+                          ],
+                          "destinations": [
+                            "[variables('dcrLogAnalyticsDestinationName')]"
+                          ],
+                          "transformKql": "source",
+                          "outputStream": "Microsoft-Perf"
+                        },
+                        {
+                          "streams": [
+                            "Microsoft-Event"
+                          ],
+                          "destinations": [
+                            "[variables('dcrLogAnalyticsDestinationName')]"
+                          ],
+                          "transformKql": "source",
+                          "outputStream": "Microsoft-Event"
+                        }
+                      ]
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.41.2.15936",
+                      "templateHash": "2441324888126124697"
+                    },
+                    "name": "Data Collection Rules",
+                    "description": "This module deploys a Data Collection Rule."
+                  },
+                  "definitions": {
+                    "dataCollectionRulePropertiesType": {
+                      "type": "object",
+                      "discriminator": {
+                        "propertyName": "kind",
+                        "mapping": {
+                          "Linux": {
+                            "$ref": "#/definitions/linuxDcrPropertiesType"
+                          },
+                          "Windows": {
+                            "$ref": "#/definitions/windowsDcrPropertiesType"
+                          },
+                          "All": {
+                            "$ref": "#/definitions/allPlatformsDcrPropertiesType"
+                          },
+                          "AgentSettings": {
+                            "$ref": "#/definitions/agentSettingsDcrPropertiesType"
+                          },
+                          "Direct": {
+                            "$ref": "#/definitions/directDcrPropertiesType"
+                          },
+                          "WorkspaceTransforms": {
+                            "$ref": "#/definitions/workspaceTransformsDcrPropertiesType"
+                          },
+                          "PlatformTelemetry": {
+                            "$ref": "#/definitions/platformTelemetryDcrPropertiesType"
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Required. The type for data collection rule properties. Depending on the kind, the properties will be different."
+                      }
+                    },
+                    "linuxDcrPropertiesType": {
+                      "type": "object",
+                      "properties": {
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Linux"
+                          ],
+                          "metadata": {
+                            "description": "Required. The kind of the resource."
+                          }
+                        },
+                        "dataSources": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataSources"
+                            },
+                            "description": "Required. Specification of data sources that will be collected."
+                          }
+                        },
+                        "dataFlows": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                            },
+                            "description": "Required. The specification of data flows."
+                          }
+                        },
+                        "destinations": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                            },
+                            "description": "Required. Specification of destinations that can be used in data flows."
+                          }
+                        },
+                        "dataCollectionEndpointResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+                          }
+                        },
+                        "streamDeclarations": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/streamDeclarations"
+                            },
+                            "description": "Optional. Declaration of custom streams used in this rule."
+                          },
+                          "nullable": true
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Description of the data collection rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the properties of the 'Linux' data collection rule."
+                      }
+                    },
+                    "windowsDcrPropertiesType": {
+                      "type": "object",
+                      "properties": {
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Windows"
+                          ],
+                          "metadata": {
+                            "description": "Required. The kind of the resource."
+                          }
+                        },
+                        "dataSources": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataSources"
+                            },
+                            "description": "Required. Specification of data sources that will be collected."
+                          }
+                        },
+                        "dataFlows": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                            },
+                            "description": "Required. The specification of data flows."
+                          }
+                        },
+                        "destinations": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                            },
+                            "description": "Required. Specification of destinations that can be used in data flows."
+                          }
+                        },
+                        "dataCollectionEndpointResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+                          }
+                        },
+                        "streamDeclarations": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/streamDeclarations"
+                            },
+                            "description": "Optional. Declaration of custom streams used in this rule."
+                          },
+                          "nullable": true
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Description of the data collection rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the properties of the 'Windows' data collection rule."
+                      }
+                    },
+                    "allPlatformsDcrPropertiesType": {
+                      "type": "object",
+                      "properties": {
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "All"
+                          ],
+                          "metadata": {
+                            "description": "Required. The kind of the resource."
+                          }
+                        },
+                        "dataSources": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataSources"
+                            },
+                            "description": "Required. Specification of data sources that will be collected."
+                          }
+                        },
+                        "dataFlows": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                            },
+                            "description": "Required. The specification of data flows."
+                          }
+                        },
+                        "destinations": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                            },
+                            "description": "Required. Specification of destinations that can be used in data flows."
+                          }
+                        },
+                        "dataCollectionEndpointResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+                          }
+                        },
+                        "streamDeclarations": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/streamDeclarations"
+                            },
+                            "description": "Optional. Declaration of custom streams used in this rule."
+                          },
+                          "nullable": true
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Description of the data collection rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the properties of the data collection rule of the kind 'All'."
+                      }
+                    },
+                    "agentSettingsDcrPropertiesType": {
+                      "type": "object",
+                      "properties": {
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AgentSettings"
+                          ],
+                          "metadata": {
+                            "description": "Required. The kind of the resource."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Description of the data collection rule."
+                          }
+                        },
+                        "agentSettings": {
+                          "$ref": "#/definitions/agentSettingsType",
+                          "metadata": {
+                            "description": "Required. Agent settings used to modify agent behavior on a given host."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the properties of the 'AgentSettings' data collection rule."
+                      }
+                    },
+                    "agentSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "logs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/agentSettingType"
+                          },
+                          "metadata": {
+                            "description": "Required. All the settings that are applicable to the logs agent (AMA)."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the agent settings."
+                      }
+                    },
+                    "agentSettingType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "MaxDiskQuotaInMB",
+                            "UseTimeReceivedForForwardedEvents"
+                          ],
+                          "metadata": {
+                            "description": "Required. The name of the agent setting."
+                          }
+                        },
+                        "value": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The value of the agent setting."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the (single) agent setting."
+                      }
+                    },
+                    "directDcrPropertiesType": {
+                      "type": "object",
+                      "properties": {
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Direct"
+                          ],
+                          "metadata": {
+                            "description": "Required. The kind of the resource."
+                          }
+                        },
+                        "dataFlows": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                            },
+                            "description": "Required. The specification of data flows."
+                          }
+                        },
+                        "destinations": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                            },
+                            "description": "Required. Specification of destinations that can be used in data flows."
+                          }
+                        },
+                        "dataCollectionEndpointResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+                          }
+                        },
+                        "streamDeclarations": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/streamDeclarations"
+                            },
+                            "description": "Required. Declaration of custom streams used in this rule."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Description of the data collection rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the properties of the 'Direct' data collection rule."
+                      }
+                    },
+                    "workspaceTransformsDcrPropertiesType": {
+                      "type": "object",
+                      "properties": {
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "WorkspaceTransforms"
+                          ],
+                          "metadata": {
+                            "description": "Required. The kind of the resource."
+                          }
+                        },
+                        "dataFlows": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                            },
+                            "description": "Required. The specification of data flows. Should include a separate dataflow for each table that will have a transformation. Use a where clause in the query if only certain records should be transformed."
+                          }
+                        },
+                        "destinations": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                            },
+                            "description": "Required. Specification of destinations that can be used in data flows. For WorkspaceTransforms, only one Log Analytics workspace destination is supported."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Description of the data collection rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the properties of the 'WorkspaceTransforms' data collection rule."
+                      }
+                    },
+                    "platformTelemetryDcrPropertiesType": {
+                      "type": "object",
+                      "properties": {
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "PlatformTelemetry"
+                          ],
+                          "metadata": {
+                            "description": "Required. The kind of the resource."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Description of the data collection rule."
+                          }
+                        },
+                        "dataSources": {
+                          "type": "object",
+                          "properties": {
+                            "platformTelemetry": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataSources/properties/platformTelemetry"
+                                },
+                                "description": "Required. The list of platform telemetry configurations."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Specification of data sources that will be collected."
+                          }
+                        },
+                        "destinations": {
+                          "type": "object",
+                          "properties": {
+                            "logAnalytics": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations/properties/logAnalytics"
+                                },
+                                "description": "Optional. The list of Log Analytics destinations."
+                              },
+                              "nullable": true
+                            },
+                            "storageAccounts": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations/properties/storageAccounts"
+                                },
+                                "description": "Optional. The list of Storage Account destinations."
+                              },
+                              "nullable": true
+                            },
+                            "eventHubs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations/properties/eventHubs"
+                                },
+                                "description": "Optional. The list of Event Hub destinations."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Specification of destinations. Choose a single destination type of either logAnalytics, storageAccounts, or eventHubs."
+                          }
+                        },
+                        "dataFlows": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                            },
+                            "description": "Required. The specification of data flows."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the properties of the 'PlatformTelemetry' data collection rule."
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the data collection rule. The name is case insensitive."
+                      }
+                    },
+                    "dataCollectionRuleProperties": {
+                      "$ref": "#/definitions/dataCollectionRulePropertiesType",
+                      "metadata": {
+                        "description": "Required. The kind of data collection rule."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/tags"
+                        },
+                        "description": "Optional. Resource tags."
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    },
+                    "dataCollectionRulePropertiesUnion": "[union(createObject('description', tryGet(parameters('dataCollectionRuleProperties'), 'description')), if(contains(createArray('Linux', 'Windows', 'All', 'PlatformTelemetry'), parameters('dataCollectionRuleProperties').kind), createObject('dataSources', parameters('dataCollectionRuleProperties').dataSources), createObject()), if(contains(createArray('Linux', 'Windows', 'All', 'Direct', 'WorkspaceTransforms', 'PlatformTelemetry'), parameters('dataCollectionRuleProperties').kind), createObject('dataFlows', parameters('dataCollectionRuleProperties').dataFlows, 'destinations', parameters('dataCollectionRuleProperties').destinations), createObject()), if(contains(createArray('Linux', 'Windows', 'All', 'Direct', 'WorkspaceTransforms'), parameters('dataCollectionRuleProperties').kind), createObject('dataCollectionEndpointId', tryGet(parameters('dataCollectionRuleProperties'), 'dataCollectionEndpointResourceId'), 'streamDeclarations', tryGet(parameters('dataCollectionRuleProperties'), 'streamDeclarations')), createObject()), if(equals(parameters('dataCollectionRuleProperties').kind, 'AgentSettings'), createObject('agentSettings', parameters('dataCollectionRuleProperties').agentSettings), createObject()))]",
+                    "enableReferencedModulesTelemetry": false
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('46d3xbcp.res.insights-datacollectionrule.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "dataCollectionRule": {
+                      "condition": "[not(equals(parameters('dataCollectionRuleProperties').kind, 'All'))]",
+                      "type": "Microsoft.Insights/dataCollectionRules",
+                      "apiVersion": "2024-03-11",
+                      "name": "[parameters('name')]",
+                      "kind": "[parameters('dataCollectionRuleProperties').kind]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "properties": "[variables('dataCollectionRulePropertiesUnion')]"
+                    },
+                    "dataCollectionRuleAll": {
+                      "condition": "[equals(parameters('dataCollectionRuleProperties').kind, 'All')]",
+                      "type": "Microsoft.Insights/dataCollectionRules",
+                      "apiVersion": "2024-03-11",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "properties": "[variables('dataCollectionRulePropertiesUnion')]"
+                    },
+                    "dataCollectionRule_conditionalScopeLock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-DCR-Lock', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "dataCollectionRuleName": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), createObject('value', parameters('name')), createObject('value', parameters('name')))]",
+                          "lock": {
+                            "value": "[parameters('lock')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "2876136109547890997"
+                            }
+                          },
+                          "definitions": {
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "dataCollectionRuleName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Data Collection Rule to assign the role(s) to."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "dataCollectionRule": {
+                              "existing": true,
+                              "type": "Microsoft.Insights/dataCollectionRules",
+                              "apiVersion": "2024-03-11",
+                              "name": "[parameters('dataCollectionRuleName')]"
+                            },
+                            "dataCollectionRule_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('dataCollectionRuleName')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "dataCollectionRule",
+                        "dataCollectionRuleAll"
+                      ]
+                    },
+                    "dataCollectionRule_roleAssignments": {
+                      "copy": {
+                        "name": "dataCollectionRule_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-DCR-RoleAssignments-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "resourceId": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), createObject('value', resourceId('Microsoft.Insights/dataCollectionRules', parameters('name'))), createObject('value', resourceId('Microsoft.Insights/dataCollectionRules', parameters('name'))))]",
+                          "name": {
+                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                          },
+                          "principalId": {
+                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]"
+                          },
+                          "description": {
+                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]"
+                          },
+                          "principalType": {
+                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.32.4.45862",
+                              "templateHash": "14634305923902101494"
+                            },
+                            "name": "Resource-scoped role assignment",
+                            "description": "This module deploys a Role Assignment for a specific resource."
+                          },
+                          "parameters": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The scope for the role assignment, fully qualified resourceId."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[guid(parameters('resourceId'), parameters('principalId'), if(contains(parameters('roleDefinitionId'), '/providers/Microsoft.Authorization/roleDefinitions/'), parameters('roleDefinitionId'), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('roleDefinitionId'))))]",
+                              "metadata": {
+                                "description": "Optional. The unique guid name for the role assignment."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The role definition ID for the role assignment."
+                              }
+                            },
+                            "roleName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The name for the role, used for logging."
+                              }
+                            },
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Principal or Object ID of the Security Principal (User, Group, Service Principal, Managed Identity)."
+                              }
+                            },
+                            "principalType": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "ServicePrincipal",
+                                "Group",
+                                "User",
+                                "ForeignGroup",
+                                "Device",
+                                ""
+                              ],
+                              "metadata": {
+                                "description": "Optional. The principal type of the assigned principal ID."
+                              }
+                            },
+                            "description": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The description of role assignment."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "$fxv#0": {
+                              "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                              "contentVersion": "1.0.0.0",
+                              "parameters": {
+                                "scope": {
+                                  "type": "string"
+                                },
+                                "name": {
+                                  "type": "string"
+                                },
+                                "roleDefinitionId": {
+                                  "type": "string"
+                                },
+                                "principalId": {
+                                  "type": "string"
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User",
+                                    ""
+                                  ],
+                                  "defaultValue": "",
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string"
+                                }
+                              },
+                              "resources": [
+                                {
+                                  "type": "Microsoft.Authorization/roleAssignments",
+                                  "apiVersion": "2022-04-01",
+                                  "scope": "[[parameters('scope')]",
+                                  "name": "[[parameters('name')]",
+                                  "properties": {
+                                    "roleDefinitionId": "[[parameters('roleDefinitionId')]",
+                                    "principalId": "[[parameters('principalId')]",
+                                    "principalType": "[[parameters('principalType')]",
+                                    "description": "[[parameters('description')]"
+                                  }
+                                }
+                              ],
+                              "outputs": {
+                                "roleAssignmentId": {
+                                  "type": "string",
+                                  "value": "[[extensionResourceId(parameters('scope'), 'Microsoft.Authorization/roleAssignments', parameters('name'))]"
+                                }
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.ptn.authorization-resourceroleassignment.{0}.{1}', replace('0.1.2', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            {
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2023-07-01",
+                              "name": "[format('{0}-ResourceRoleAssignment', guid(parameters('resourceId'), parameters('principalId'), parameters('roleDefinitionId')))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "expressionEvaluationOptions": {
+                                  "scope": "Outer"
+                                },
+                                "template": "[variables('$fxv#0')]",
+                                "parameters": {
+                                  "scope": {
+                                    "value": "[parameters('resourceId')]"
+                                  },
+                                  "name": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "roleDefinitionId": {
+                                    "value": "[if(contains(parameters('roleDefinitionId'), '/providers/Microsoft.Authorization/roleDefinitions/'), parameters('roleDefinitionId'), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('roleDefinitionId')))]"
+                                  },
+                                  "principalId": {
+                                    "value": "[parameters('principalId')]"
+                                  },
+                                  "principalType": {
+                                    "value": "[parameters('principalType')]"
+                                  },
+                                  "description": {
+                                    "value": "[parameters('description')]"
+                                  }
+                                }
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The GUID of the Role Assignment."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "roleName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name for the role, used for logging."
+                              },
+                              "value": "[parameters('roleName')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Role Assignment."
+                              },
+                              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}-ResourceRoleAssignment', guid(parameters('resourceId'), parameters('principalId'), parameters('roleDefinitionId')))), '2023-07-01').outputs.roleAssignmentId.value]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the role assignment was applied at."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "dataCollectionRule",
+                        "dataCollectionRuleAll"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the dataCollectionRule."
+                      },
+                      "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), parameters('name'), parameters('name'))]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the dataCollectionRule."
+                      },
+                      "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), resourceId('Microsoft.Insights/dataCollectionRules', parameters('name')), resourceId('Microsoft.Insights/dataCollectionRules', parameters('name')))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the dataCollectionRule was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), reference('dataCollectionRuleAll', '2024-03-11', 'full').location, reference('dataCollectionRule', '2024-03-11', 'full').location)]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), tryGet(tryGet(if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), reference('dataCollectionRuleAll', '2024-03-11', 'full'), null()), 'identity'), 'principalId'), tryGet(tryGet(if(not(equals(parameters('dataCollectionRuleProperties').kind, 'All')), reference('dataCollectionRule', '2024-03-11', 'full'), null()), 'identity'), 'principalId'))]"
+                    },
+                    "endpoints": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/endpoints",
+                          "output": true
+                        },
+                        "description": "The endpoints of the dataCollectionRule, if created."
+                      },
+                      "nullable": true,
+                      "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), tryGet(reference('dataCollectionRuleAll'), 'endpoints'), tryGet(reference('dataCollectionRule'), 'endpoints'))]"
+                    },
+                    "immutableId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The ImmutableId of the dataCollectionRule."
+                      },
+                      "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), tryGet(reference('dataCollectionRuleAll'), 'immutableId'), tryGet(reference('dataCollectionRule'), 'immutableId'))]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the data collection rule."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.data-collection-rule.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the data collection rule."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.data-collection-rule.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "existingLogAnalyticsWorkspace",
+        "log_analytics"
+      ]
+    },
+    "proximityPlacementGroup": {
+      "condition": "[parameters('enablePrivateNetworking')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.proximity-placement-group.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "availabilityZone": {
+            "value": "[variables('virtualMachineAvailabilityZone')]"
+          },
+          "vmSizes": {
+            "value": [
+              "[parameters('vmSize')]"
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "13006336383696924611"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('ppg-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the proximity placement group."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "availabilityZone": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Availability zone for the proximity placement group."
+              }
+            },
+            "vmSizes": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "VM sizes intent for the proximity placement group."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable Azure telemetry collection."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.compute.proximity-placement-group.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "availabilityZone": {
+                    "value": "[parameters('availabilityZone')]"
+                  },
+                  "intent": "[if(not(empty(parameters('vmSizes'))), createObject('value', createObject('vmSizes', parameters('vmSizes'))), createObject('value', null()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.37.4.10188",
+                      "templateHash": "14590939924256334253"
+                    },
+                    "name": "Proximity Placement Groups",
+                    "description": "This module deploys a Proximity Placement Group."
+                  },
+                  "definitions": {
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the proximity placement group that is being created."
+                      }
+                    },
+                    "type": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "allowedValues": [
+                        "Standard",
+                        "Ultra"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Specifies the type of the proximity placement group."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Resource location."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Compute/proximityPlacementGroups@2024-11-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the proximity placement group resource."
+                      },
+                      "nullable": true
+                    },
+                    "availabilityZone": {
+                      "type": "int",
+                      "allowedValues": [
+                        -1,
+                        1,
+                        2,
+                        3
+                      ],
+                      "metadata": {
+                        "description": "Required. Specifies the Availability Zone where virtual machine, virtual machine scale set or availability set associated with the proximity placement group can be created. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                      }
+                    },
+                    "colocationStatus": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Compute/proximityPlacementGroups@2024-11-01#properties/properties/properties/colocationStatus"
+                        },
+                        "description": "Optional. Describes colocation status of the Proximity Placement Group."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "intent": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Compute/proximityPlacementGroups@2024-11-01#properties/properties/properties/intent"
+                        },
+                        "description": "Optional. Specifies the user intent of the proximity placement group."
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.compute-proximityplacementgroup.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "proximityPlacementGroup": {
+                      "type": "Microsoft.Compute/proximityPlacementGroups",
+                      "apiVersion": "2022-08-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "zones": "[if(not(equals(parameters('availabilityZone'), -1)), array(string(parameters('availabilityZone'))), null())]",
+                      "properties": {
+                        "proximityPlacementGroupType": "[parameters('type')]",
+                        "colocationStatus": "[parameters('colocationStatus')]",
+                        "intent": "[parameters('intent')]"
+                      }
+                    },
+                    "proximityPlacementGroup_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Compute/proximityPlacementGroups/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "proximityPlacementGroup"
+                      ]
+                    },
+                    "proximityPlacementGroup_roleAssignments": {
+                      "copy": {
+                        "name": "proximityPlacementGroup_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Compute/proximityPlacementGroups/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Compute/proximityPlacementGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "proximityPlacementGroup"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the proximity placement group."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resourceId the proximity placement group."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/proximityPlacementGroups', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the proximity placement group was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('proximityPlacementGroup', '2022-08-01', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the proximity placement group."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.compute.proximity-placement-group.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the proximity placement group."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.compute.proximity-placement-group.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+            }
+          }
+        }
+      }
+    },
+    "virtualMachine": {
+      "condition": "[parameters('enablePrivateNetworking')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.virtual-machine.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "vmSize": {
+            "value": "[parameters('vmSize')]"
+          },
+          "availabilityZone": {
+            "value": "[variables('virtualMachineAvailabilityZone')]"
+          },
+          "adminUsername": {
+            "value": "[coalesce(parameters('vmAdminUsername'), 'testvmuser')]"
+          },
+          "adminPassword": {
+            "value": "[coalesce(parameters('vmAdminPassword'), format('Vm!{0}{1}', uniqueString(subscription().subscriptionId, parameters('solutionName')), guid(subscription().subscriptionId, parameters('solutionName'), 'vm-admin-password')))]"
+          },
+          "subnetResourceId": {
+            "value": "[reference('virtualNetwork').outputs.administrationSubnetResourceId.value]"
+          },
+          "deployingUserPrincipalId": {
+            "value": "[variables('deployingUserPrincipalId')]"
+          },
+          "deployingUserPrincipalType": {
+            "value": "[parameters('deployingUserPrincipalType')]"
+          },
+          "roleAssignments": {
+            "value": [
+              {
+                "roleDefinitionIdOrName": "1c0163c0-47e6-4577-8991-ea5c82e286e4",
+                "principalId": "[variables('deployingUserPrincipalId')]",
+                "principalType": "[parameters('deployingUserPrincipalType')]"
+              }
+            ]
+          },
+          "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', null()))]",
+          "maintenanceConfigurationResourceId": {
+            "value": "[reference('maintenanceConfiguration').outputs.resourceId.value]"
+          },
+          "proximityPlacementGroupResourceId": {
+            "value": "[reference('proximityPlacementGroup').outputs.resourceId.value]"
+          },
+          "extensionMonitoringAgentConfig": "[if(parameters('enableMonitoring'), createObject('value', createObject('dataCollectionRuleAssociations', createArray(createObject('dataCollectionRuleResourceId', reference('windowsVmDataCollectionRules').outputs.resourceId.value, 'name', format('send-{0}', if(variables('useExistingLogAnalytics'), split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8], if(parameters('enableMonitoring'), reference('log_analytics').outputs.name.value, ''))))), 'enabled', true(), 'tags', parameters('tags'))), createObject('value', null()))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "6809285625079537766"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('vm-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the virtual machine."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "vmSize": {
+              "type": "string",
+              "defaultValue": "Standard_D2s_v5",
+              "metadata": {
+                "description": "VM size."
+              }
+            },
+            "adminUsername": {
+              "type": "securestring",
+              "metadata": {
+                "description": "Local admin username. Required by Azure at provisioning time but not used for login when Entra ID is enabled."
+              }
+            },
+            "adminPassword": {
+              "type": "securestring",
+              "metadata": {
+                "description": "Local admin password. Required by Azure at provisioning time but not used for login when Entra ID is enabled."
+              }
+            },
+            "subnetResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the subnet for the VM NIC."
+              }
+            },
+            "osType": {
+              "type": "string",
+              "defaultValue": "Windows",
+              "metadata": {
+                "description": "OS type for the VM."
+              }
+            },
+            "availabilityZone": {
+              "type": "int",
+              "defaultValue": -1,
+              "metadata": {
+                "description": "Availability zone for the VM."
+              }
+            },
+            "imageReference": {
+              "type": "object",
+              "defaultValue": {
+                "publisher": "microsoft-dsvm",
+                "offer": "dsvm-win-2022",
+                "sku": "winserver-2022",
+                "version": "latest"
+              },
+              "metadata": {
+                "description": "Image reference for the VM."
+              }
+            },
+            "osDiskSizeGB": {
+              "type": "int",
+              "defaultValue": 128,
+              "metadata": {
+                "description": "OS disk size in GB."
+              }
+            },
+            "maintenanceConfigurationResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Resource ID of the maintenance configuration."
+              }
+            },
+            "proximityPlacementGroupResourceId": {
+              "type": "string",
+              "nullable": true,
+              "metadata": {
+                "description": "Resource ID of the proximity placement group."
+              }
+            },
+            "extensionMonitoringAgentConfig": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Monitoring agent extension configuration (data collection rule associations)."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Diagnostic settings for the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable Azure telemetry collection."
+              }
+            },
+            "deployingUserPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "Deploying user principal ID. Used for default role assignment to grant the deploying user login access to the VM. This is required because with Entra ID authentication enabled, local accounts cannot be used to access the VM, including the local admin account created at provisioning."
+              }
+            },
+            "deployingUserPrincipalType": {
+              "type": "string",
+              "defaultValue": "User",
+              "metadata": {
+                "description": "Deploying user principal type. Used for default role assignment to grant the deploying user login access to the VM. This is required because with Entra ID authentication enabled, local accounts cannot be used to access the VM, including the local admin account created at provisioning."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "defaultValue": [
+                {
+                  "roleDefinitionIdOrName": "1c0163c0-47e6-4577-8991-ea5c82e286e4",
+                  "principalId": "[parameters('deployingUserPrincipalId')]",
+                  "principalType": "[parameters('deployingUserPrincipalType')]"
+                }
+              ],
+              "metadata": {
+                "description": "Role assignments to apply to the virtual machine."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "resources": {
+            "virtualMachine": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.compute.virtual-machine.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "computerName": {
+                    "value": "[take(parameters('name'), 15)]"
+                  },
+                  "osType": {
+                    "value": "[parameters('osType')]"
+                  },
+                  "vmSize": {
+                    "value": "[parameters('vmSize')]"
+                  },
+                  "adminUsername": {
+                    "value": "[parameters('adminUsername')]"
+                  },
+                  "adminPassword": {
+                    "value": "[parameters('adminPassword')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "patchMode": {
+                    "value": "AutomaticByPlatform"
+                  },
+                  "bypassPlatformSafetyChecksOnUserSchedule": {
+                    "value": true
+                  },
+                  "maintenanceConfigurationResourceId": {
+                    "value": "[parameters('maintenanceConfigurationResourceId')]"
+                  },
+                  "enableAutomaticUpdates": {
+                    "value": true
+                  },
+                  "encryptionAtHost": {
+                    "value": true
+                  },
+                  "availabilityZone": {
+                    "value": "[parameters('availabilityZone')]"
+                  },
+                  "proximityPlacementGroupResourceId": {
+                    "value": "[parameters('proximityPlacementGroupResourceId')]"
+                  },
+                  "imageReference": {
+                    "value": "[parameters('imageReference')]"
+                  },
+                  "osDisk": {
+                    "value": {
+                      "name": "[format('osdisk-{0}', parameters('name'))]",
+                      "caching": "ReadWrite",
+                      "createOption": "FromImage",
+                      "deleteOption": "Delete",
+                      "diskSizeGB": "[parameters('osDiskSizeGB')]",
+                      "managedDisk": {
+                        "storageAccountType": "Premium_LRS"
+                      }
+                    }
+                  },
+                  "nicConfigurations": {
+                    "value": [
+                      {
+                        "name": "[format('nic-{0}', parameters('name'))]",
+                        "tags": "[parameters('tags')]",
+                        "deleteOption": "Delete",
+                        "diagnosticSettings": "[parameters('diagnosticSettings')]",
+                        "ipConfigurations": [
+                          {
+                            "name": "[format('{0}-nic01-ipconfig01', parameters('name'))]",
+                            "subnetResourceId": "[parameters('subnetResourceId')]",
+                            "diagnosticSettings": "[parameters('diagnosticSettings')]"
+                          }
+                        ]
+                      }
+                    ]
+                  },
+                  "roleAssignments": {
+                    "value": "[parameters('roleAssignments')]"
+                  },
+                  "extensionAadJoinConfig": {
+                    "value": {
+                      "enabled": true,
+                      "tags": "[parameters('tags')]",
+                      "typeHandlerVersion": "2.0",
+                      "settings": {
+                        "mdmId": ""
+                      }
+                    }
+                  },
+                  "extensionAntiMalwareConfig": {
+                    "value": {
+                      "enabled": true,
+                      "settings": {
+                        "AntimalwareEnabled": "true",
+                        "Exclusions": {},
+                        "RealtimeProtectionEnabled": "true",
+                        "ScheduledScanSettings": {
+                          "day": "7",
+                          "isEnabled": "true",
+                          "scanType": "Quick",
+                          "time": "120"
+                        }
+                      },
+                      "tags": "[parameters('tags')]"
+                    }
+                  },
+                  "extensionMonitoringAgentConfig": {
+                    "value": "[parameters('extensionMonitoringAgentConfig')]"
+                  },
+                  "extensionNetworkWatcherAgentConfig": {
+                    "value": {
+                      "enabled": true,
+                      "tags": "[parameters('tags')]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.41.2.15936",
+                      "templateHash": "17174537341033050778"
+                    },
+                    "name": "Virtual Machines",
+                    "description": "This module deploys a Virtual Machine with one or multiple NICs and optionally one or multiple public IPs."
+                  },
+                  "definitions": {
+                    "osDiskType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The disk name."
+                          }
+                        },
+                        "diskSizeGB": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the size of an empty data disk in gigabytes."
+                          }
+                        },
+                        "createOption": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Attach",
+                            "Empty",
+                            "FromImage"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies how the virtual machine should be created."
+                          }
+                        },
+                        "deleteOption": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Delete",
+                            "Detach"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                          }
+                        },
+                        "caching": {
+                          "type": "string",
+                          "allowedValues": [
+                            "None",
+                            "ReadOnly",
+                            "ReadWrite"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the caching requirements."
+                          }
+                        },
+                        "diffDiskSettings": {
+                          "type": "object",
+                          "properties": {
+                            "placement": {
+                              "type": "string",
+                              "allowedValues": [
+                                "CacheDisk",
+                                "NvmeDisk",
+                                "ResourceDisk"
+                              ],
+                              "metadata": {
+                                "description": "Required. Specifies the ephemeral disk placement for the operating system disk."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the ephemeral Disk Settings for the operating system disk."
+                          }
+                        },
+                        "managedDisk": {
+                          "type": "object",
+                          "properties": {
+                            "storageAccountType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "PremiumV2_LRS",
+                                "Premium_LRS",
+                                "Premium_ZRS",
+                                "StandardSSD_LRS",
+                                "StandardSSD_ZRS",
+                                "Standard_LRS",
+                                "UltraSSD_LRS"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the storage account type for the managed disk."
+                              }
+                            },
+                            "diskEncryptionSetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                              }
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the resource id of a pre-existing managed disk. If the disk should be created, this property should be empty."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The managed disk parameters."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type describing an OS disk."
+                      }
+                    },
+                    "dataDiskType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The disk name. When attaching a pre-existing disk, this name is ignored and the name of the existing disk is used."
+                          }
+                        },
+                        "lun": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the logical unit number of the data disk."
+                          }
+                        },
+                        "diskSizeGB": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the size of an empty data disk in gigabytes. This property is ignored when attaching a pre-existing disk."
+                          }
+                        },
+                        "createOption": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Attach",
+                            "Empty",
+                            "FromImage"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies how the virtual machine should be created. This property is automatically set to 'Attach' when attaching a pre-existing disk."
+                          }
+                        },
+                        "deleteOption": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Delete",
+                            "Detach"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion. This property is automatically set to 'Detach' when attaching a pre-existing disk."
+                          }
+                        },
+                        "caching": {
+                          "type": "string",
+                          "allowedValues": [
+                            "None",
+                            "ReadOnly",
+                            "ReadWrite"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the caching requirements. This property is automatically set to 'None' when attaching a pre-existing disk."
+                          }
+                        },
+                        "diskIOPSReadWrite": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The number of IOPS allowed for this disk; only settable for UltraSSD disks. One operation can transfer between 4k and 256k bytes. Ignored when attaching a pre-existing disk."
+                          }
+                        },
+                        "diskMBpsReadWrite": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The bandwidth allowed for this disk; only settable for UltraSSD disks. MBps means millions of bytes per second - MB here uses the ISO notation, of powers of 10. Ignored when attaching a pre-existing disk."
+                          }
+                        },
+                        "managedDisk": {
+                          "type": "object",
+                          "properties": {
+                            "storageAccountType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "PremiumV2_LRS",
+                                "Premium_LRS",
+                                "Premium_ZRS",
+                                "StandardSSD_LRS",
+                                "StandardSSD_ZRS",
+                                "Standard_LRS",
+                                "UltraSSD_LRS"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the storage account type for the managed disk. Ignored when attaching a pre-existing disk."
+                              }
+                            },
+                            "diskEncryptionSetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                              }
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the resource id of a pre-existing managed disk. If the disk should be created, this property should be empty."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The managed disk parameters."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Compute/disks@2025-01-02#properties/tags"
+                            },
+                            "description": "Optional. The tags of the public IP address. Valid only when creating a new managed disk."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type describing a data disk."
+                      }
+                    },
+                    "publicKeyType": {
+                      "type": "object",
+                      "properties": {
+                        "keyData": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Specifies the SSH public key data used to authenticate through ssh."
+                          }
+                        },
+                        "path": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Specifies the full path on the created VM where ssh public key is stored. If the file already exists, the specified key is appended to the file."
+                          }
+                        }
+                      }
+                    },
+                    "nicConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the NIC configuration."
+                          }
+                        },
+                        "nicSuffix": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The suffix to append to the NIC name."
+                          }
+                        },
+                        "enableIPForwarding": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Indicates whether IP forwarding is enabled on this network interface."
+                          }
+                        },
+                        "enableAcceleratedNetworking": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If the network interface is accelerated networking enabled."
+                          }
+                        },
+                        "deleteOption": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Delete",
+                            "Detach"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify what happens to the network interface when the VM is deleted."
+                          }
+                        },
+                        "dnsServers": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. List of DNS servers IP addresses. Use 'AzureProvidedDNS' to switch to azure provided DNS resolution. 'AzureProvidedDNS' value cannot be combined with other IPs, it must be the only value in dnsServers collection."
+                          }
+                        },
+                        "networkSecurityGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The network security group (NSG) to attach to the network interface."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/ipConfigurationType"
+                          },
+                          "metadata": {
+                            "description": "Required. The IP configurations of the network interface."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The lock settings of the service."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The tags of the public IP address."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for the module."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the IP configuration."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the NIC configuration."
+                      }
+                    },
+                    "imageReferenceType": {
+                      "type": "object",
+                      "properties": {
+                        "communityGalleryImageId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specified the community gallery image unique id for vm deployment. This can be fetched from community gallery image GET call."
+                          }
+                        },
+                        "id": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource Id of the image reference."
+                          }
+                        },
+                        "offer": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the offer of the platform image or marketplace image used to create the virtual machine."
+                          }
+                        },
+                        "publisher": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The image publisher."
+                          }
+                        },
+                        "sku": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The SKU of the image."
+                          }
+                        },
+                        "version": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the version of the platform image or marketplace image used to create the virtual machine. The allowed formats are Major.Minor.Build or 'latest'. Even if you use 'latest', the VM image will not automatically update after deploy time even if a new version becomes available."
+                          }
+                        },
+                        "sharedGalleryImageId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specified the shared gallery image unique id for vm deployment. This can be fetched from shared gallery image GET call."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type describing the image reference."
+                      }
+                    },
+                    "planType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the plan."
+                          }
+                        },
+                        "product": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the product of the image from the marketplace."
+                          }
+                        },
+                        "publisher": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The publisher ID."
+                          }
+                        },
+                        "promotionCode": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The promotion code."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Specifies information about the marketplace image used to create the virtual machine."
+                      }
+                    },
+                    "autoShutDownConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "status": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The status of the auto shutdown configuration."
+                          }
+                        },
+                        "timeZone": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The time zone ID (e.g. China Standard Time, Greenland Standard Time, Pacific Standard time, etc.)."
+                          }
+                        },
+                        "dailyRecurrenceTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The time of day the schedule will occur."
+                          }
+                        },
+                        "notificationSettings": {
+                          "type": "object",
+                          "properties": {
+                            "status": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The status of the notification settings."
+                              }
+                            },
+                            "emailRecipient": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The email address to send notifications to (can be a list of semi-colon separated email addresses)."
+                              }
+                            },
+                            "notificationLocale": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The locale to use when sending a notification (fallback for unsupported languages is EN)."
+                              }
+                            },
+                            "webhookUrl": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The webhook URL to which the notification will be sent."
+                              }
+                            },
+                            "timeInMinutes": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The time in minutes before shutdown to send notifications."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the schedule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type describing the configuration profile."
+                      }
+                    },
+                    "vaultSecretGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "sourceVault": {
+                          "$ref": "#/definitions/subResourceType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The relative URL of the Key Vault containing all of the certificates in VaultCertificates."
+                          }
+                        },
+                        "vaultCertificates": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "certificateStore": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. For Windows VMs, specifies the certificate store on the Virtual Machine to which the certificate should be added. The specified certificate store is implicitly in the LocalMachine account. For Linux VMs, the certificate file is placed under the /var/lib/waagent directory, with the file name <UppercaseThumbprint>.crt for the X509 certificate file and <UppercaseThumbprint>.prv for private key. Both of these files are .pem formatted."
+                                }
+                              },
+                              "certificateUrl": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. This is the URL of a certificate that has been uploaded to Key Vault as a secret."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The list of key vault references in SourceVault which contain certificates."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type describing the set of certificates that should be installed onto the virtual machine."
+                      }
+                    },
+                    "vmGalleryApplicationType": {
+                      "type": "object",
+                      "properties": {
+                        "packageReferenceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Specifies the GalleryApplicationVersion resource id on the form of /subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/applications/{application}/versions/{version}."
+                          }
+                        },
+                        "configurationReference": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the uri to an azure blob that will replace the default configuration for the package if provided."
+                          }
+                        },
+                        "enableAutomaticUpgrade": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If set to true, when a new Gallery Application version is available in PIR/SIG, it will be automatically updated for the VM/VMSS."
+                          }
+                        },
+                        "order": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the order in which the packages have to be installed."
+                          }
+                        },
+                        "tags": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies a passthrough value for more generic context."
+                          }
+                        },
+                        "treatFailureAsDeploymentFailure": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If true, any failure for any operation in the VmApplication will fail the deployment."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type describing the gallery application that should be made available to the VM/VMSS."
+                      }
+                    },
+                    "additionalUnattendContentType": {
+                      "type": "object",
+                      "properties": {
+                        "settingName": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AutoLogon",
+                            "FirstLogonCommands"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the name of the setting to which the content applies."
+                          }
+                        },
+                        "content": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the XML formatted content that is added to the unattend.xml file for the specified path and component. The XML must be less than 4KB and must include the root element for the setting or feature that is being inserted."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type describing additional base-64 encoded XML formatted information that can be included in the Unattend.xml file, which is used by Windows Setup."
+                      }
+                    },
+                    "winRMListenerType": {
+                      "type": "object",
+                      "properties": {
+                        "certificateUrl": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The URL of a certificate that has been uploaded to Key Vault as a secret."
+                          }
+                        },
+                        "protocol": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Http",
+                            "Https"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the protocol of WinRM listener."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type describing a Windows Remote Management listener."
+                      }
+                    },
+                    "nicConfigurationOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the NIC configuration."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/networkInterfaceIPConfigurationOutputType"
+                          },
+                          "metadata": {
+                            "description": "Required. List of IP configurations of the NIC configuration."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type describing the network interface configuration output."
+                      }
+                    },
+                    "extensionCustomScriptConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the virtual machine extension. Defaults to `CustomScriptExtension`."
+                          }
+                        },
+                        "typeHandlerVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the version of the script handler. Defaults to `1.10` for Windows and `2.1` for Linux."
+                          }
+                        },
+                        "autoUpgradeMinorVersion": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true. Defaults to `true`."
+                          }
+                        },
+                        "forceUpdateTag": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                          }
+                        },
+                        "settings": {
+                          "type": "object",
+                          "properties": {
+                            "commandToExecute": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. The entry point script to run. If the command contains any credentials, use the same property of the `protectedSettings` instead. Required if `protectedSettings.commandToExecute` is not provided."
+                              }
+                            },
+                            "fileUris": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. URLs for files to be downloaded. If URLs are sensitive, for example, if they contain keys, this field should be specified in `protectedSettings`."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The configuration of the custom script extension. Note: You can provide any property either in the `settings` or `protectedSettings` but not both. If your property contains secrets, use `protectedSettings`."
+                          }
+                        },
+                        "protectedSettings": {
+                          "type": "secureObject",
+                          "properties": {
+                            "commandToExecute": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. The entry point script to run. Use this property if your command contains secrets such as passwords or if your file URIs are sensitive. Required if `settings.commandToExecute` is not provided."
+                              }
+                            },
+                            "storageAccountName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The name of storage account. If you specify storage credentials, all fileUris values must be URLs for Azure blobs.."
+                              }
+                            },
+                            "storageAccountKey": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The access key of the storage account."
+                              }
+                            },
+                            "managedIdentityResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity for downloading files. Must not be used in conjunction with the `storageAccountName` or `storageAccountKey` property. If you want to use the VM's system assigned identity, set the `value` to an empty string."
+                              }
+                            },
+                            "fileUris": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. URLs for files to be downloaded."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The configuration of the custom script extension. Note: You can provide any property either in the `settings` or `protectedSettings` but not both. If your property contains secrets, use `protectedSettings`."
+                          }
+                        },
+                        "supressFailures": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). Defaults to `false`."
+                          }
+                        },
+                        "enableAutomaticUpgrade": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available. Defaults to `false`."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        },
+                        "protectedSettingsFromKeyVault": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                            },
+                            "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                          },
+                          "nullable": true
+                        },
+                        "provisionAfterExtensions": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                            },
+                            "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a 'CustomScriptExtension' extension."
+                      }
+                    },
+                    "_1.applicationGatewayBackendAddressPoolsType": {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the backend address pool."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the backend address pool that is unique within an Application Gateway."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "backendAddresses": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "ipAddress": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. IP address of the backend address."
+                                    }
+                                  },
+                                  "fqdn": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. FQDN of the backend address."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Backend addresses."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Properties of the application gateway backend address pool."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the application gateway backend address pool.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.applicationSecurityGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the application security group."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location of the application security group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Properties of the application security group."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags of the application security group."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the application security group.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.backendAddressPoolType": {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the backend address pool."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the backend address pool."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The properties of the backend address pool."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a backend address pool.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.inboundNatRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the inbound NAT rule."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the resource that is unique within the set of inbound NAT rules used by the load balancer. This name can be used to access the resource."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "backendAddressPool": {
+                              "$ref": "#/definitions/_1.subResourceType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A reference to backendAddressPool resource."
+                              }
+                            },
+                            "backendPort": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The port used for the internal endpoint. Acceptable values range from 1 to 65535."
+                              }
+                            },
+                            "enableFloatingIP": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configures a virtual machine's endpoint for the floating IP capability required to configure a SQL AlwaysOn Availability Group. This setting is required when using the SQL AlwaysOn Availability Groups in SQL server. This setting can't be changed after you create the endpoint."
+                              }
+                            },
+                            "enableTcpReset": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Receive bidirectional TCP Reset on TCP flow idle timeout or unexpected connection termination. This element is only used when the protocol is set to TCP."
+                              }
+                            },
+                            "frontendIPConfiguration": {
+                              "$ref": "#/definitions/_1.subResourceType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A reference to frontend IP addresses."
+                              }
+                            },
+                            "frontendPort": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The port for the external endpoint. Port numbers for each rule must be unique within the Load Balancer. Acceptable values range from 1 to 65534."
+                              }
+                            },
+                            "frontendPortRangeStart": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The port range start for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeEnd. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                              }
+                            },
+                            "frontendPortRangeEnd": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The port range end for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeStart. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                              }
+                            },
+                            "protocol": {
+                              "type": "string",
+                              "allowedValues": [
+                                "All",
+                                "Tcp",
+                                "Udp"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The reference to the transport protocol used by the load balancing rule."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Properties of the inbound NAT rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the inbound NAT rule.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.subResourceType": {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the sub resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the sub resource.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.virtualNetworkTapType": {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the virtual network tap."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location of the virtual network tap."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Properties of the virtual network tap."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags of the virtual network tap."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the virtual network tap.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                        }
+                      }
+                    },
+                    "_2.ddosSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "ddosProtectionPlan": {
+                          "type": "object",
+                          "properties": {
+                            "id": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The DDoS protection plan associated with the public IP address."
+                          }
+                        },
+                        "protectionMode": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Enabled"
+                          ],
+                          "metadata": {
+                            "description": "Required. The DDoS protection policy customizations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                        }
+                      }
+                    },
+                    "_2.dnsSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "domainNameLabel": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                          }
+                        },
+                        "domainNameLabelScope": {
+                          "type": "string",
+                          "allowedValues": [
+                            "NoReuse",
+                            "ResourceGroupReuse",
+                            "SubscriptionReuse",
+                            "TenantReuse"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                          }
+                        },
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                          }
+                        },
+                        "reverseFqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                        }
+                      }
+                    },
+                    "_2.ipTagType": {
+                      "type": "object",
+                      "properties": {
+                        "ipTagType": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IP tag type."
+                          }
+                        },
+                        "tag": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The IP tag."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                        }
+                      }
+                    },
+                    "_3.diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_3.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_3.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_4.publicIPConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Public IP Address."
+                          }
+                        },
+                        "publicIPAddressResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the public IP address."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_3.diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Diagnostic settings for the public IP address."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The idle timeout in minutes."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_3.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The lock settings of the public IP address."
+                          }
+                        },
+                        "idleTimeoutInMinutes": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The idle timeout of the public IP address."
+                          }
+                        },
+                        "ddosSettings": {
+                          "$ref": "#/definitions/_2.ddosSettingsType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                          }
+                        },
+                        "dnsSettings": {
+                          "$ref": "#/definitions/_2.dnsSettingsType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The DNS settings of the public IP address."
+                          }
+                        },
+                        "publicIPAddressVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "IPv4",
+                            "IPv6"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The public IP address version."
+                          }
+                        },
+                        "publicIPAllocationMethod": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Dynamic",
+                            "Static"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The public IP address allocation method."
+                          }
+                        },
+                        "publicIpPrefixResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                          }
+                        },
+                        "publicIpNameSuffix": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name suffix of the public IP address resource."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_3.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "skuName": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Basic",
+                            "Standard"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The SKU name of the public IP address."
+                          }
+                        },
+                        "skuTier": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Global",
+                            "Regional"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The SKU tier of the public IP address."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/publicIPAddresses@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. The tags of the public IP address."
+                          },
+                          "nullable": true
+                        },
+                        "availabilityZones": {
+                          "type": "array",
+                          "allowedValues": [
+                            1,
+                            2,
+                            3
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The zones of the public IP address."
+                          }
+                        },
+                        "ipTags": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_2.ipTagType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The list of tags associated with the public IP address."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for the module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the public IP address configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "modules/nic-configuration.bicep"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "ipConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the IP configuration."
+                          }
+                        },
+                        "privateIPAllocationMethod": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Dynamic",
+                            "Static"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private IP address allocation method."
+                          }
+                        },
+                        "privateIPAddress": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private IP address."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the subnet."
+                          }
+                        },
+                        "loadBalancerBackendAddressPools": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.backendAddressPoolType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The load balancer backend address pools."
+                          }
+                        },
+                        "applicationSecurityGroups": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.applicationSecurityGroupType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The application security groups."
+                          }
+                        },
+                        "applicationGatewayBackendAddressPools": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.applicationGatewayBackendAddressPoolsType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The application gateway backend address pools."
+                          }
+                        },
+                        "gatewayLoadBalancer": {
+                          "$ref": "#/definitions/_1.subResourceType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The gateway load balancer settings."
+                          }
+                        },
+                        "loadBalancerInboundNatRules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.inboundNatRuleType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The load balancer inbound NAT rules."
+                          }
+                        },
+                        "privateIPAddressVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "IPv4",
+                            "IPv6"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private IP address version."
+                          }
+                        },
+                        "virtualNetworkTaps": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.virtualNetworkTapType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The virtual network taps."
+                          }
+                        },
+                        "pipConfiguration": {
+                          "$ref": "#/definitions/_4.publicIPConfigurationType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The public IP address configuration."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_3.diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the IP configuration."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/networkInterfaces@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. The tags of the public IP address."
+                          },
+                          "nullable": true
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for the module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the IP configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "modules/nic-configuration.bicep"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "networkInterfaceIPConfigurationOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the IP configuration."
+                          }
+                        },
+                        "privateIP": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The private IP address."
+                          }
+                        },
+                        "publicIP": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The public IP address."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the network interface IP configuration output.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.3"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "subResourceType": {
+                      "type": "object",
+                      "properties": {
+                        "id": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the sub resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the sub resource.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.3"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the virtual machine to be created. You should use a unique prefix to reduce name collisions in Active Directory."
+                      }
+                    },
+                    "computerName": {
+                      "type": "string",
+                      "defaultValue": "[parameters('name')]",
+                      "metadata": {
+                        "description": "Optional. Can be used if the computer name needs to be different from the Azure VM resource name. If not used, the resource name will be used as computer name."
+                      }
+                    },
+                    "vmSize": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Specifies the size for the VMs."
+                      }
+                    },
+                    "encryptionAtHost": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                      }
+                    },
+                    "securityType": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Compute/virtualMachines@2025-04-01#properties/properties/properties/securityProfile/properties/securityType"
+                        },
+                        "description": "Optional. Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. The default behavior is: UefiSettings will not be enabled unless this property is set."
+                      },
+                      "nullable": true
+                    },
+                    "secureBootEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings."
+                      }
+                    },
+                    "vTpmEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Specifies whether vTPM should be enabled on the virtual machine. This parameter is part of the UefiSettings.  SecurityType should be set to TrustedLaunch to enable UefiSettings."
+                      }
+                    },
+                    "imageReference": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Compute/virtualMachines@2025-04-01#properties/properties/properties/storageProfile/properties/imageReference"
+                        },
+                        "description": "Conditional. OS image reference. In case of marketplace images, it's the combination of the publisher, offer, sku, version attributes. In case of custom images it's the resource ID of the custom image. Required if not creating the VM from an existing os-disk via the `osDisk.managedDisk.resourceId` parameter."
+                      },
+                      "nullable": true
+                    },
+                    "plan": {
+                      "$ref": "#/definitions/planType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies information about the marketplace image used to create the virtual machine. This element is only used for marketplace images. Before you can use a marketplace image from an API, you must enable the image for programmatic use."
+                      }
+                    },
+                    "osDisk": {
+                      "$ref": "#/definitions/osDiskType",
+                      "metadata": {
+                        "description": "Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object.  Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                      }
+                    },
+                    "dataDisks": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/dataDiskType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                      }
+                    },
+                    "ultraSSDEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled."
+                      }
+                    },
+                    "hibernationEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. The flag that enables or disables hibernation capability on the VM."
+                      }
+                    },
+                    "adminUsername": {
+                      "type": "securestring",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. Administrator username. Required if no pre-existing OS-Disk is provided (osDisk.managedDisk.resourceId is not empty)."
+                      }
+                    },
+                    "adminPassword": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. When specifying a Windows Virtual Machine, and no pre-existing OS-Disk is provided (osDisk.managedDisk.resourceId is not empty), this value should be passed."
+                      }
+                    },
+                    "userData": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. UserData for the VM, which must be base-64 encoded. Customer should not pass any secrets in here."
+                      }
+                    },
+                    "customData": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Custom data associated to the VM, this value will be automatically converted into base64 to account for the expected VM format."
+                      }
+                    },
+                    "certificatesToBeInstalled": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/vaultSecretGroupType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies set of certificates that should be installed onto the virtual machine."
+                      }
+                    },
+                    "priority": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Regular",
+                        "Low",
+                        "Spot"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Specifies the priority for the virtual machine."
+                      }
+                    },
+                    "evictionPolicy": {
+                      "type": "string",
+                      "defaultValue": "Deallocate",
+                      "allowedValues": [
+                        "Deallocate",
+                        "Delete"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Specifies the eviction policy for the low priority virtual machine."
+                      }
+                    },
+                    "maxPriceForLowPriorityVm": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Specifies the maximum price you are willing to pay for a low priority VM/VMSS. This price is in US Dollars."
+                      }
+                    },
+                    "dedicatedHostResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Specifies resource ID about the dedicated host that the virtual machine resides in."
+                      }
+                    },
+                    "licenseType": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "RHEL_BYOS",
+                        "SLES_BYOS",
+                        "Windows_Client",
+                        "Windows_Server"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Specifies that the image or disk that is being used was licensed on-premises."
+                      }
+                    },
+                    "publicKeys": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/publicKeyType"
+                      },
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. The list of SSH public keys used to authenticate with linux based VMs."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource. The system-assigned managed identity will automatically be enabled if extensionAadJoinConfig.enabled = \"True\"."
+                      }
+                    },
+                    "bootDiagnostics": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether boot diagnostics should be enabled on the Virtual Machine. Boot diagnostics will be enabled with a managed storage account if no bootDiagnosticsStorageAccountName value is provided. If bootDiagnostics and bootDiagnosticsStorageAccountName values are not provided, boot diagnostics will be disabled."
+                      }
+                    },
+                    "bootDiagnosticStorageAccountName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Custom storage account used to store boot diagnostic information. Boot diagnostics will be enabled with a custom storage account if a value is provided."
+                      }
+                    },
+                    "bootDiagnosticStorageAccountUri": {
+                      "type": "string",
+                      "defaultValue": "[format('.blob.{0}/', environment().suffixes.storage)]",
+                      "metadata": {
+                        "description": "Optional. Storage account boot diagnostic base URI."
+                      }
+                    },
+                    "proximityPlacementGroupResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Resource ID of a proximity placement group."
+                      }
+                    },
+                    "virtualMachineScaleSetResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Resource ID of a virtual machine scale set, where the VM should be added."
+                      }
+                    },
+                    "availabilitySetResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Resource ID of an availability set. Cannot be used in combination with availability zone nor scale set."
+                      }
+                    },
+                    "galleryApplications": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/vmGalleryApplicationType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the gallery applications that should be made available to the VM/VMSS."
+                      }
+                    },
+                    "availabilityZone": {
+                      "type": "int",
+                      "allowedValues": [
+                        -1,
+                        1,
+                        2,
+                        3
+                      ],
+                      "metadata": {
+                        "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                      }
+                    },
+                    "nicConfigurations": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/nicConfigurationType"
+                      },
+                      "metadata": {
+                        "description": "Required. Configures NICs and PIPs."
+                      }
+                    },
+                    "backupVaultName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Recovery service vault name to add VMs to backup."
+                      }
+                    },
+                    "backupVaultResourceGroup": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().name]",
+                      "metadata": {
+                        "description": "Optional. Resource group of the backup recovery service vault. If not provided the current resource group name is considered by default."
+                      }
+                    },
+                    "backupPolicyName": {
+                      "type": "string",
+                      "defaultValue": "DefaultPolicy",
+                      "metadata": {
+                        "description": "Optional. Backup policy the VMs should be using for backup. If not provided, it will use the DefaultPolicy from the backup recovery service vault."
+                      }
+                    },
+                    "autoShutdownConfig": {
+                      "$ref": "#/definitions/autoShutDownConfigType",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The configuration for auto-shutdown."
+                      }
+                    },
+                    "maintenanceConfigurationResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The resource Id of a maintenance configuration for this VM."
+                      }
+                    },
+                    "allowExtensionOperations": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Specifies whether extension operations should be allowed on the virtual machine. This may only be set to False when no extensions are present on the virtual machine."
+                      }
+                    },
+                    "extensionDomainJoinPassword": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Required if name is specified. Password of the user specified in user parameter."
+                      }
+                    },
+                    "extensionDomainJoinConfig": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Domain Join] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                      }
+                    },
+                    "extensionAadJoinConfig": {
+                      "type": "object",
+                      "defaultValue": {
+                        "enabled": false
+                      },
+                      "metadata": {
+                        "description": "Optional. The configuration for the [AAD Join] extension. Must at least contain the [\"enabled\": true] property to be executed. To enroll in Intune, add the setting mdmId: \"0000000a-0000-0000-c000-000000000000\"."
+                      }
+                    },
+                    "extensionAntiMalwareConfig": {
+                      "type": "object",
+                      "defaultValue": "[if(equals(parameters('osType'), 'Windows'), createObject('enabled', true()), createObject('enabled', false()))]",
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Anti Malware] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                      }
+                    },
+                    "extensionMonitoringAgentConfig": {
+                      "type": "object",
+                      "defaultValue": {
+                        "enabled": false,
+                        "dataCollectionRuleAssociations": []
+                      },
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Monitoring Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                      }
+                    },
+                    "extensionDependencyAgentConfig": {
+                      "type": "object",
+                      "defaultValue": {
+                        "enabled": false
+                      },
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Dependency Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                      }
+                    },
+                    "extensionNetworkWatcherAgentConfig": {
+                      "type": "object",
+                      "defaultValue": {
+                        "enabled": false
+                      },
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Network Watcher Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                      }
+                    },
+                    "extensionAzureDiskEncryptionConfig": {
+                      "type": "object",
+                      "defaultValue": {
+                        "enabled": false
+                      },
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Azure Disk Encryption] extension. Must at least contain the [\"enabled\": true] property to be executed. Restrictions: Cannot be enabled on disks that have encryption at host enabled. Managed disks encrypted using Azure Disk Encryption cannot be encrypted using customer-managed keys."
+                      }
+                    },
+                    "extensionDSCConfig": {
+                      "type": "object",
+                      "defaultValue": {
+                        "enabled": false
+                      },
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Desired State Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                      }
+                    },
+                    "extensionCustomScriptConfig": {
+                      "$ref": "#/definitions/extensionCustomScriptConfigType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Custom Script] extension."
+                      }
+                    },
+                    "extensionNvidiaGpuDriverWindows": {
+                      "type": "object",
+                      "defaultValue": {
+                        "enabled": false
+                      },
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Nvidia Gpu Driver Windows] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                      }
+                    },
+                    "extensionHostPoolRegistration": {
+                      "type": "secureObject",
+                      "defaultValue": {
+                        "enabled": false
+                      },
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Host Pool Registration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identity."
+                      }
+                    },
+                    "extensionGuestConfigurationExtension": {
+                      "type": "object",
+                      "defaultValue": {
+                        "enabled": false
+                      },
+                      "metadata": {
+                        "description": "Optional. The configuration for the [Guest Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identity."
+                      }
+                    },
+                    "guestConfiguration": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. The guest configuration for the virtual machine. Needs the Guest Configuration extension to be enabled."
+                      }
+                    },
+                    "extensionGuestConfigurationExtensionProtectedSettings": {
+                      "type": "secureObject",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. An object that contains the extension specific protected settings."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Compute/virtualMachines@2024-11-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "osType": {
+                      "type": "string",
+                      "allowedValues": [
+                        "Windows",
+                        "Linux"
+                      ],
+                      "metadata": {
+                        "description": "Required. The chosen OS type."
+                      }
+                    },
+                    "disablePasswordAuthentication": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Specifies whether password authentication should be disabled."
+                      }
+                    },
+                    "provisionVMAgent": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates whether virtual machine agent should be provisioned on the virtual machine. When this property is not specified in the request body, default behavior is to set it to true. This will ensure that VM Agent is installed on the VM so that extensions can be added to the VM later."
+                      }
+                    },
+                    "enableAutomaticUpdates": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates whether Automatic Updates is enabled for the Windows virtual machine. Default value is true. When patchMode is set to Manual, this parameter must be set to false. For virtual machine scale sets, this property can be updated and updates will take effect on OS reprovisioning."
+                      }
+                    },
+                    "patchMode": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "allowedValues": [
+                        "AutomaticByPlatform",
+                        "AutomaticByOS",
+                        "Manual",
+                        "ImageDefault",
+                        ""
+                      ],
+                      "metadata": {
+                        "description": "Optional. VM guest patching orchestration mode. 'AutomaticByOS' & 'Manual' are for Windows only, 'ImageDefault' for Linux only. Refer to 'https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching'."
+                      }
+                    },
+                    "bypassPlatformSafetyChecksOnUserSchedule": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enables customer to schedule patching without accidental upgrades."
+                      }
+                    },
+                    "rebootSetting": {
+                      "type": "string",
+                      "defaultValue": "IfRequired",
+                      "allowedValues": [
+                        "Always",
+                        "IfRequired",
+                        "Never",
+                        "Unknown"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Specifies the reboot setting for all AutomaticByPlatform patch installation operations."
+                      }
+                    },
+                    "patchAssessmentMode": {
+                      "type": "string",
+                      "defaultValue": "ImageDefault",
+                      "allowedValues": [
+                        "AutomaticByPlatform",
+                        "ImageDefault"
+                      ],
+                      "metadata": {
+                        "description": "Optional. VM guest patching assessment mode. Set it to 'AutomaticByPlatform' to enable automatically check for updates every 24 hours."
+                      }
+                    },
+                    "enableHotpatching": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enables customers to patch their Azure VMs without requiring a reboot. For enableHotpatching, the 'provisionVMAgent' must be set to true and 'patchMode' must be set to 'AutomaticByPlatform'."
+                      }
+                    },
+                    "timeZone": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be `TimeZoneInfo.id` value from time zones returned by `TimeZoneInfo.GetSystemTimeZones`."
+                      }
+                    },
+                    "additionalUnattendContent": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/additionalUnattendContentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies additional XML formatted information that can be included in the Unattend.xml file, which is used by Windows Setup. Contents are defined by setting name, component name, and the pass in which the content is applied."
+                      }
+                    },
+                    "winRMListeners": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/winRMListenerType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies the Windows Remote Management listeners. This enables remote Windows PowerShell."
+                      }
+                    },
+                    "configurationProfile": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The configuration profile of automanage. Either '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction', 'providers/Microsoft.Automanage/bestPractices/AzureBestPracticesDevTest' or the resource Id of custom profile."
+                      }
+                    },
+                    "capacityReservationGroupResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Capacity reservation group resource id that should be used for allocating the virtual machine vm instances provided enough capacity has been reserved."
+                      }
+                    },
+                    "networkAccessPolicy": {
+                      "type": "string",
+                      "defaultValue": "DenyAll",
+                      "allowedValues": [
+                        "AllowAll",
+                        "AllowPrivate",
+                        "DenyAll"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Policy for accessing the disk via network."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Disabled",
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Policy for controlling export on the disk."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "publicKeysFormatted",
+                        "count": "[length(parameters('publicKeys'))]",
+                        "input": {
+                          "path": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].path]",
+                          "keyData": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].keyData]"
+                        }
+                      },
+                      {
+                        "name": "additionalUnattendContentFormatted",
+                        "count": "[length(coalesce(parameters('additionalUnattendContent'), createArray()))]",
+                        "input": {
+                          "settingName": "[coalesce(parameters('additionalUnattendContent'), createArray())[copyIndex('additionalUnattendContentFormatted')].settingName]",
+                          "content": "[coalesce(parameters('additionalUnattendContent'), createArray())[copyIndex('additionalUnattendContentFormatted')].content]",
+                          "componentName": "Microsoft-Windows-Shell-Setup",
+                          "passName": "OobeSystem"
+                        }
+                      },
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "linuxConfiguration": {
+                      "disablePasswordAuthentication": "[parameters('disablePasswordAuthentication')]",
+                      "ssh": {
+                        "publicKeys": "[variables('publicKeysFormatted')]"
+                      },
+                      "provisionVMAgent": "[parameters('provisionVMAgent')]",
+                      "patchSettings": "[if(and(parameters('provisionVMAgent'), or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('ImageDefault')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]"
+                    },
+                    "windowsConfiguration": {
+                      "provisionVMAgent": "[parameters('provisionVMAgent')]",
+                      "enableAutomaticUpdates": "[parameters('enableAutomaticUpdates')]",
+                      "patchSettings": "[if(and(parameters('provisionVMAgent'), or(or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('AutomaticByOS'))), equals(toLower(parameters('patchMode')), toLower('Manual')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'enableHotpatching', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), parameters('enableHotpatching'), false()), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]",
+                      "timeZone": "[if(empty(parameters('timeZone')), null(), parameters('timeZone'))]",
+                      "additionalUnattendContent": "[if(empty(parameters('additionalUnattendContent')), null(), variables('additionalUnattendContentFormatted'))]",
+                      "winRM": "[if(not(empty(parameters('winRMListeners'))), createObject('listeners', parameters('winRMListeners')), null())]"
+                    },
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(if(parameters('extensionAadJoinConfig').enabled, true(), coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false())), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Data Operator for Managed Disks": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '959f8984-c045-4866-89c7-12bf9737be2e')]",
+                      "Desktop Virtualization Power On Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '489581de-a3bd-480d-9518-53dea7416b33')]",
+                      "Desktop Virtualization Power On Off Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '40c5ff49-9181-41f8-ae61-143b0e78555e')]",
+                      "Desktop Virtualization Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a959dbd1-f747-45e3-8ba6-dd80f235f97c')]",
+                      "DevTest Labs User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76283e04-6283-4c54-8f91-bcf1374a3c64')]",
+                      "Disk Backup Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3e5e47e6-65f7-47ef-90b5-e5dd4d455f24')]",
+                      "Disk Pool Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '60fc6e62-5479-42d4-8bf4-67625fcc2840')]",
+                      "Disk Restore Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b50d9833-a0cb-478e-945f-707fcc997c13')]",
+                      "Disk Snapshot Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7efff54f-a5b4-42b5-a1c5-5411624893ce')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                      "Virtual Machine Administrator Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1c0163c0-47e6-4577-8991-ea5c82e286e4')]",
+                      "Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')]",
+                      "Virtual Machine User Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb879df8-f326-4884-b1cf-06f3ad86be52')]",
+                      "VM Scanner Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'd24ecba3-c1f4-40fa-a7bb-4588a071e8fd')]"
+                    },
+                    "aadJoinSettings": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'settings'), createObject())]",
+                    "filteredAadJoinSettings": "[if(and(contains(variables('aadJoinSettings'), 'mdmId'), empty(variables('aadJoinSettings').mdmId)), reduce(items(variables('aadJoinSettings')), createObject(), lambda('cur', 'item', if(equals(lambdaVariables('item').key, 'mdmId'), lambdaVariables('cur'), union(lambdaVariables('cur'), createObject(format('{0}', lambdaVariables('item').key), lambdaVariables('item').value))))), variables('aadJoinSettings'))]"
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-07-01",
+                      "name": "[format('46d3xbcp.res.compute-virtualmachine.{0}.{1}', replace('0.22.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "managedDataDisks": {
+                      "copy": {
+                        "name": "managedDataDisks",
+                        "count": "[length(coalesce(parameters('dataDisks'), createArray()))]"
+                      },
+                      "condition": "[and(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk, 'resourceId')), not(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'createOption'), 'Empty'), 'FromImage')))]",
+                      "type": "Microsoft.Compute/disks",
+                      "apiVersion": "2025-01-02",
+                      "name": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex(), 1), 2, '0')))]",
+                      "location": "[parameters('location')]",
+                      "sku": {
+                        "name": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk, 'storageAccountType')]"
+                      },
+                      "properties": {
+                        "diskSizeGB": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskSizeGB')]",
+                        "creationData": {
+                          "createOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'createOption'), 'Empty')]"
+                        },
+                        "diskIOPSReadWrite": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskIOPSReadWrite')]",
+                        "diskMBpsReadWrite": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskMBpsReadWrite')]",
+                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                        "networkAccessPolicy": "[parameters('networkAccessPolicy')]"
+                      },
+                      "zones": "[if(and(not(equals(parameters('availabilityZone'), -1)), not(contains(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk, 'storageAccountType'), ''), 'ZRS'))), array(string(parameters('availabilityZone'))), null())]",
+                      "tags": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                    },
+                    "vm": {
+                      "type": "Microsoft.Compute/virtualMachines",
+                      "apiVersion": "2024-07-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "identity": "[variables('identity')]",
+                      "tags": "[parameters('tags')]",
+                      "zones": "[if(not(equals(parameters('availabilityZone'), -1)), array(string(parameters('availabilityZone'))), null())]",
+                      "plan": "[parameters('plan')]",
+                      "properties": {
+                        "hardwareProfile": {
+                          "vmSize": "[parameters('vmSize')]"
+                        },
+                        "securityProfile": "[shallowMerge(createArray(if(parameters('encryptionAtHost'), createObject('encryptionAtHost', parameters('encryptionAtHost')), createObject()), createObject('securityType', parameters('securityType'), 'uefiSettings', if(equals(parameters('securityType'), 'TrustedLaunch'), createObject('secureBootEnabled', parameters('secureBootEnabled'), 'vTpmEnabled', parameters('vTpmEnabled')), null()))))]",
+                        "storageProfile": {
+                          "copy": [
+                            {
+                              "name": "dataDisks",
+                              "count": "[length(coalesce(parameters('dataDisks'), createArray()))]",
+                              "input": {
+                                "lun": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'lun'), copyIndex('dataDisks'))]",
+                                "name": "[if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId'))), last(split(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.resourceId, '/')), coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0'))))]",
+                                "createOption": "[if(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'), 'FromImage', if(or(not(equals(if(and(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId')), not(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'))), resourceId('Microsoft.Compute/disks', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))), null()), null())), not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId')))), 'Attach', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty')))]",
+                                "deleteOption": "[if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId'))), 'Detach', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'deleteOption'), 'Delete'))]",
+                                "caching": "[if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId'))), 'None', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'caching'), 'ReadOnly'))]",
+                                "diskSizeGB": "[if(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'), null(), tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'diskSizeGB'))]",
+                                "managedDisk": "[if(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'), createObject('storageAccountType', tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'storageAccountType'), 'diskEncryptionSet', if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'diskEncryptionSetResourceId'))), createObject('id', coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.diskEncryptionSetResourceId), null())), createObject('id', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId'), if(and(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId')), not(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'))), resourceId('Microsoft.Compute/disks', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))), null())), 'diskEncryptionSet', if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'diskEncryptionSetResourceId'))), createObject('id', coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.diskEncryptionSetResourceId), null())))]"
+                              }
+                            }
+                          ],
+                          "imageReference": "[parameters('imageReference')]",
+                          "osDisk": {
+                            "name": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId'))), last(split(parameters('osDisk').managedDisk.resourceId, '/')), coalesce(tryGet(parameters('osDisk'), 'name'), format('{0}-disk-os-01', parameters('name'))))]",
+                            "createOption": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId'))), 'Attach', coalesce(tryGet(parameters('osDisk'), 'createOption'), 'FromImage'))]",
+                            "osType": "[parameters('osType')]",
+                            "deleteOption": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId'))), 'Detach', coalesce(tryGet(parameters('osDisk'), 'deleteOption'), 'Delete'))]",
+                            "diffDiskSettings": "[if(empty(coalesce(tryGet(parameters('osDisk'), 'diffDiskSettings'), createObject())), null(), createObject('option', 'Local', 'placement', parameters('osDisk').diffDiskSettings.placement))]",
+                            "diskSizeGB": "[tryGet(parameters('osDisk'), 'diskSizeGB')]",
+                            "caching": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId'))), 'None', coalesce(tryGet(parameters('osDisk'), 'caching'), 'ReadOnly'))]",
+                            "managedDisk": {
+                              "storageAccountType": "[tryGet(parameters('osDisk').managedDisk, 'storageAccountType')]",
+                              "diskEncryptionSet": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'diskEncryptionSetResourceId'))), createObject('id', tryGet(parameters('osDisk').managedDisk, 'diskEncryptionSetResourceId')), null())]",
+                              "id": "[tryGet(parameters('osDisk').managedDisk, 'resourceId')]"
+                            }
+                          }
+                        },
+                        "additionalCapabilities": {
+                          "ultraSSDEnabled": "[parameters('ultraSSDEnabled')]",
+                          "hibernationEnabled": "[parameters('hibernationEnabled')]"
+                        },
+                        "osProfile": "[if(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId')), createObject('computerName', parameters('computerName'), 'adminUsername', parameters('adminUsername'), 'adminPassword', parameters('adminPassword'), 'customData', if(not(empty(parameters('customData'))), base64(parameters('customData')), null()), 'windowsConfiguration', if(equals(parameters('osType'), 'Windows'), variables('windowsConfiguration'), null()), 'linuxConfiguration', if(equals(parameters('osType'), 'Linux'), variables('linuxConfiguration'), null()), 'secrets', parameters('certificatesToBeInstalled'), 'allowExtensionOperations', parameters('allowExtensionOperations')), null())]",
+                        "networkProfile": {
+                          "copy": [
+                            {
+                              "name": "networkInterfaces",
+                              "count": "[length(parameters('nicConfigurations'))]",
+                              "input": {
+                                "properties": {
+                                  "deleteOption": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'deleteOption'), 'Delete')]",
+                                  "primary": "[if(equals(copyIndex('networkInterfaces'), 0), true(), false())]"
+                                },
+                                "id": "[resourceId('Microsoft.Network/networkInterfaces', coalesce(tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'name'), format('{0}{1}', parameters('name'), tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'nicSuffix'))))]"
+                              }
+                            }
+                          ]
+                        },
+                        "capacityReservation": "[if(not(empty(parameters('capacityReservationGroupResourceId'))), createObject('capacityReservationGroup', createObject('id', parameters('capacityReservationGroupResourceId'))), null())]",
+                        "diagnosticsProfile": {
+                          "bootDiagnostics": {
+                            "enabled": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), true(), parameters('bootDiagnostics'))]",
+                            "storageUri": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), format('https://{0}{1}', parameters('bootDiagnosticStorageAccountName'), parameters('bootDiagnosticStorageAccountUri')), null())]"
+                          }
+                        },
+                        "applicationProfile": "[if(not(empty(parameters('galleryApplications'))), createObject('galleryApplications', parameters('galleryApplications')), null())]",
+                        "availabilitySet": "[if(not(empty(parameters('availabilitySetResourceId'))), createObject('id', parameters('availabilitySetResourceId')), null())]",
+                        "proximityPlacementGroup": "[if(not(empty(parameters('proximityPlacementGroupResourceId'))), createObject('id', parameters('proximityPlacementGroupResourceId')), null())]",
+                        "virtualMachineScaleSet": "[if(not(empty(parameters('virtualMachineScaleSetResourceId'))), createObject('id', parameters('virtualMachineScaleSetResourceId')), null())]",
+                        "priority": "[parameters('priority')]",
+                        "evictionPolicy": "[if(and(not(empty(parameters('priority'))), not(equals(parameters('priority'), 'Regular'))), parameters('evictionPolicy'), null())]",
+                        "billingProfile": "[if(and(not(empty(parameters('priority'))), not(empty(parameters('maxPriceForLowPriorityVm')))), createObject('maxPrice', json(parameters('maxPriceForLowPriorityVm'))), null())]",
+                        "host": "[if(not(empty(parameters('dedicatedHostResourceId'))), createObject('id', parameters('dedicatedHostResourceId')), null())]",
+                        "licenseType": "[parameters('licenseType')]",
+                        "userData": "[if(not(empty(parameters('userData'))), base64(parameters('userData')), null())]"
+                      },
+                      "dependsOn": [
+                        "managedDataDisks",
+                        "vm_nic"
+                      ]
+                    },
+                    "vm_configurationAssignment": {
+                      "condition": "[not(empty(parameters('maintenanceConfigurationResourceId')))]",
+                      "type": "Microsoft.Maintenance/configurationAssignments",
+                      "apiVersion": "2023-04-01",
+                      "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                      "name": "[format('{0}assignment', parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "properties": {
+                        "maintenanceConfigurationId": "[parameters('maintenanceConfigurationResourceId')]",
+                        "resourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                      },
+                      "dependsOn": [
+                        "vm"
+                      ]
+                    },
+                    "vm_configurationProfileAssignment": {
+                      "condition": "[not(empty(parameters('configurationProfile')))]",
+                      "type": "Microsoft.Automanage/configurationProfileAssignments",
+                      "apiVersion": "2022-05-04",
+                      "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                      "name": "default",
+                      "properties": {
+                        "configurationProfile": "[parameters('configurationProfile')]"
+                      },
+                      "dependsOn": [
+                        "vm"
+                      ]
+                    },
+                    "vm_autoShutdownConfiguration": {
+                      "condition": "[not(empty(parameters('autoShutdownConfig')))]",
+                      "type": "Microsoft.DevTestLab/schedules",
+                      "apiVersion": "2018-09-15",
+                      "name": "[format('shutdown-computevm-{0}', parameters('name'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'tags'), parameters('tags'))]",
+                      "properties": {
+                        "status": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'status'), 'Disabled')]",
+                        "targetResourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                        "taskType": "ComputeVmShutdownTask",
+                        "dailyRecurrence": {
+                          "time": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'dailyRecurrenceTime'), '19:00')]"
+                        },
+                        "timeZoneId": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'timeZone'), 'UTC')]",
+                        "notificationSettings": "[if(contains(parameters('autoShutdownConfig'), 'notificationSettings'), createObject('status', coalesce(tryGet(parameters('autoShutdownConfig'), 'status'), 'Disabled'), 'emailRecipient', coalesce(tryGet(tryGet(parameters('autoShutdownConfig'), 'notificationSettings'), 'emailRecipient'), ''), 'notificationLocale', coalesce(tryGet(tryGet(parameters('autoShutdownConfig'), 'notificationSettings'), 'notificationLocale'), 'en'), 'webhookUrl', coalesce(tryGet(tryGet(parameters('autoShutdownConfig'), 'notificationSettings'), 'webhookUrl'), ''), 'timeInMinutes', coalesce(tryGet(tryGet(parameters('autoShutdownConfig'), 'notificationSettings'), 'timeInMinutes'), 30)), null())]"
+                      },
+                      "dependsOn": [
+                        "vm"
+                      ]
+                    },
+                    "vm_dataCollectionRuleAssociations": {
+                      "copy": {
+                        "name": "vm_dataCollectionRuleAssociations",
+                        "count": "[length(parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations)]"
+                      },
+                      "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+                      "type": "Microsoft.Insights/dataCollectionRuleAssociations",
+                      "apiVersion": "2024-03-11",
+                      "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                      "name": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].name]",
+                      "properties": {
+                        "dataCollectionRuleId": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].dataCollectionRuleResourceId]"
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_azureMonitorAgentExtension"
+                      ]
+                    },
+                    "cseIdentity": {
+                      "condition": "[not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'managedIdentityResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                      "apiVersion": "2024-11-30",
+                      "subscriptionId": "[split(parameters('extensionCustomScriptConfig').protectedSettings.managedIdentityResourceId, '/')[2]]",
+                      "resourceGroup": "[split(parameters('extensionCustomScriptConfig').protectedSettings.managedIdentityResourceId, '/')[4]]",
+                      "name": "[last(split(parameters('extensionCustomScriptConfig').protectedSettings.managedIdentityResourceId, '/'))]"
+                    },
+                    "AzureWindowsBaseline": {
+                      "condition": "[not(empty(parameters('guestConfiguration')))]",
+                      "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
+                      "apiVersion": "2024-04-05",
+                      "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('guestConfiguration'), 'name'), 'AzureWindowsBaseline')]",
+                      "location": "[parameters('location')]",
+                      "properties": {
+                        "guestConfiguration": "[parameters('guestConfiguration')]"
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_azureGuestConfigurationExtension"
+                      ]
+                    },
+                    "vm_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "vm"
+                      ]
+                    },
+                    "vm_roleAssignments": {
+                      "copy": {
+                        "name": "vm_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Compute/virtualMachines', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "vm"
+                      ]
+                    },
+                    "vm_nic": {
+                      "copy": {
+                        "name": "vm_nic",
+                        "count": "[length(parameters('nicConfigurations'))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-Nic-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "networkInterfaceName": {
+                            "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'name'), format('{0}{1}', parameters('name'), tryGet(parameters('nicConfigurations')[copyIndex()], 'nicSuffix')))]"
+                          },
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "enableIPForwarding": {
+                            "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableIPForwarding'), false())]"
+                          },
+                          "enableAcceleratedNetworking": {
+                            "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableAcceleratedNetworking'), true())]"
+                          },
+                          "dnsServers": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'dnsServers'), if(not(empty(tryGet(parameters('nicConfigurations')[copyIndex()], 'dnsServers'))), createObject('value', tryGet(parameters('nicConfigurations')[copyIndex()], 'dnsServers')), createObject('value', createArray())), createObject('value', createArray()))]",
+                          "networkSecurityGroupResourceId": {
+                            "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'networkSecurityGroupResourceId'), '')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[parameters('nicConfigurations')[copyIndex()].ipConfigurations]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'roleAssignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "5982155361487304817"
+                            }
+                          },
+                          "definitions": {
+                            "publicIPConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Public IP Address."
+                                  }
+                                },
+                                "publicIPAddressResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the public IP address."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Diagnostic settings for the public IP address."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The idle timeout in minutes."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The lock settings of the public IP address."
+                                  }
+                                },
+                                "idleTimeoutInMinutes": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The idle timeout of the public IP address."
+                                  }
+                                },
+                                "ddosSettings": {
+                                  "$ref": "#/definitions/ddosSettingsType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                                  }
+                                },
+                                "dnsSettings": {
+                                  "$ref": "#/definitions/dnsSettingsType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DNS settings of the public IP address."
+                                  }
+                                },
+                                "publicIPAddressVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "IPv4",
+                                    "IPv6"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The public IP address version."
+                                  }
+                                },
+                                "publicIPAllocationMethod": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Dynamic",
+                                    "Static"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The public IP address allocation method."
+                                  }
+                                },
+                                "publicIpPrefixResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                                  }
+                                },
+                                "publicIpNameSuffix": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name suffix of the public IP address resource."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "skuName": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Basic",
+                                    "Standard"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The SKU name of the public IP address."
+                                  }
+                                },
+                                "skuTier": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Global",
+                                    "Regional"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The SKU tier of the public IP address."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/publicIPAddresses@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. The tags of the public IP address."
+                                  },
+                                  "nullable": true
+                                },
+                                "availabilityZones": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    1,
+                                    2,
+                                    3
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The zones of the public IP address."
+                                  }
+                                },
+                                "ipTags": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/ipTagType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The list of tags associated with the public IP address."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for the module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the public IP address configuration."
+                              }
+                            },
+                            "ipConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the IP configuration."
+                                  }
+                                },
+                                "privateIPAllocationMethod": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Dynamic",
+                                    "Static"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private IP address allocation method."
+                                  }
+                                },
+                                "privateIPAddress": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private IP address."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the subnet."
+                                  }
+                                },
+                                "loadBalancerBackendAddressPools": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/backendAddressPoolType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The load balancer backend address pools."
+                                  }
+                                },
+                                "applicationSecurityGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/applicationSecurityGroupType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The application security groups."
+                                  }
+                                },
+                                "applicationGatewayBackendAddressPools": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/applicationGatewayBackendAddressPoolsType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The application gateway backend address pools."
+                                  }
+                                },
+                                "gatewayLoadBalancer": {
+                                  "$ref": "#/definitions/subResourceType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The gateway load balancer settings."
+                                  }
+                                },
+                                "loadBalancerInboundNatRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/inboundNatRuleType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The load balancer inbound NAT rules."
+                                  }
+                                },
+                                "privateIPAddressVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "IPv4",
+                                    "IPv6"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private IP address version."
+                                  }
+                                },
+                                "virtualNetworkTaps": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/virtualNetworkTapType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The virtual network taps."
+                                  }
+                                },
+                                "pipConfiguration": {
+                                  "$ref": "#/definitions/publicIPConfigurationType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The public IP address configuration."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the IP configuration."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/networkInterfaces@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. The tags of the public IP address."
+                                  },
+                                  "nullable": true
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for the module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the IP configuration."
+                              }
+                            },
+                            "applicationGatewayBackendAddressPoolsType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the backend address pool."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the backend address pool that is unique within an Application Gateway."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "backendAddresses": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "ipAddress": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. IP address of the backend address."
+                                            }
+                                          },
+                                          "fqdn": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. FQDN of the backend address."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Backend addresses."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Properties of the application gateway backend address pool."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the application gateway backend address pool.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "applicationSecurityGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the application security group."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location of the application security group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Properties of the application security group."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Tags of the application security group."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the application security group.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "backendAddressPoolType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the backend address pool."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the backend address pool."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The properties of the backend address pool."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a backend address pool.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "ddosSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "ddosProtectionPlan": {
+                                  "type": "object",
+                                  "properties": {
+                                    "id": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                  }
+                                },
+                                "protectionMode": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Enabled"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The DDoS protection policy customizations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "dnsSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "domainNameLabel": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                  }
+                                },
+                                "domainNameLabelScope": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "NoReuse",
+                                    "ResourceGroupReuse",
+                                    "SubscriptionReuse",
+                                    "TenantReuse"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                  }
+                                },
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                  }
+                                },
+                                "reverseFqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                                }
+                              }
+                            },
+                            "inboundNatRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the inbound NAT rule."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the resource that is unique within the set of inbound NAT rules used by the load balancer. This name can be used to access the resource."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "backendAddressPool": {
+                                      "$ref": "#/definitions/subResourceType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A reference to backendAddressPool resource."
+                                      }
+                                    },
+                                    "backendPort": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The port used for the internal endpoint. Acceptable values range from 1 to 65535."
+                                      }
+                                    },
+                                    "enableFloatingIP": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configures a virtual machine's endpoint for the floating IP capability required to configure a SQL AlwaysOn Availability Group. This setting is required when using the SQL AlwaysOn Availability Groups in SQL server. This setting can't be changed after you create the endpoint."
+                                      }
+                                    },
+                                    "enableTcpReset": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Receive bidirectional TCP Reset on TCP flow idle timeout or unexpected connection termination. This element is only used when the protocol is set to TCP."
+                                      }
+                                    },
+                                    "frontendIPConfiguration": {
+                                      "$ref": "#/definitions/subResourceType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A reference to frontend IP addresses."
+                                      }
+                                    },
+                                    "frontendPort": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The port for the external endpoint. Port numbers for each rule must be unique within the Load Balancer. Acceptable values range from 1 to 65534."
+                                      }
+                                    },
+                                    "frontendPortRangeStart": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The port range start for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeEnd. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                      }
+                                    },
+                                    "frontendPortRangeEnd": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The port range end for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeStart. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                      }
+                                    },
+                                    "protocol": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "All",
+                                        "Tcp",
+                                        "Udp"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The reference to the transport protocol used by the load balancing rule."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Properties of the inbound NAT rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the inbound NAT rule.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "ipTagType": {
+                              "type": "object",
+                              "properties": {
+                                "ipTagType": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IP tag type."
+                                  }
+                                },
+                                "tag": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IP tag."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "networkInterfaceIPConfigurationOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the IP configuration."
+                                  }
+                                },
+                                "privateIP": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The private IP address."
+                                  }
+                                },
+                                "publicIP": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The public IP address."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "subResourceType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the sub resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the sub resource.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "virtualNetworkTapType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the virtual network tap."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location of the virtual network tap."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Properties of the virtual network tap."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Tags of the virtual network tap."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the virtual network tap.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "networkInterfaceName": {
+                              "type": "string"
+                            },
+                            "virtualMachineName": {
+                              "type": "string"
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/ipConfigurationType"
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "enableIPForwarding": {
+                              "type": "bool",
+                              "defaultValue": false
+                            },
+                            "enableAcceleratedNetworking": {
+                              "type": "bool",
+                              "defaultValue": false
+                            },
+                            "dnsServers": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": []
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Enable telemetry via a Globally Unique Identifier (GUID)."
+                              }
+                            },
+                            "networkSecurityGroupResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The network security group (NSG) to attach to the network interface."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "networkInterface_publicIPAddresses": {
+                              "copy": {
+                                "name": "networkInterface_publicIPAddresses",
+                                "count": "[length(parameters('ipConfigurations'))]"
+                              },
+                              "condition": "[and(not(empty(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'))), empty(tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIPAddressResourceId')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-publicIP-{1}', deployment().name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'name'), format('{0}{1}', parameters('virtualMachineName'), tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIpNameSuffix')))]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[coalesce(tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'diagnosticSettings'), tryGet(parameters('ipConfigurations')[copyIndex()], 'diagnosticSettings'))]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "lock": {
+                                    "value": "[parameters('lock')]"
+                                  },
+                                  "idleTimeoutInMinutes": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'idleTimeoutInMinutes')]"
+                                  },
+                                  "ddosSettings": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'ddosSettings')]"
+                                  },
+                                  "dnsSettings": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'dnsSettings')]"
+                                  },
+                                  "publicIPAddressVersion": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIPAddressVersion')]"
+                                  },
+                                  "publicIPAllocationMethod": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIPAllocationMethod')]"
+                                  },
+                                  "publicIpPrefixResourceId": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIpPrefixResourceId')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'roleAssignments')]"
+                                  },
+                                  "skuName": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'skuName')]"
+                                  },
+                                  "skuTier": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'skuTier')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "availabilityZones": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'availabilityZones')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[coalesce(coalesce(tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'enableTelemetry'), tryGet(parameters('ipConfigurations')[copyIndex()], 'enableTelemetry')), parameters('enableTelemetry'))]"
+                                  },
+                                  "ipTags": {
+                                    "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'ipTags')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "5349747633189946992"
+                                    },
+                                    "name": "Public IP Addresses",
+                                    "description": "This module deploys a Public IP Address."
+                                  },
+                                  "definitions": {
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Public IP Address."
+                                      }
+                                    },
+                                    "publicIpPrefixResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                                      }
+                                    },
+                                    "publicIPAllocationMethod": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/publicIPAllocationMethod"
+                                        },
+                                        "description": "Optional. The public IP address allocation method."
+                                      },
+                                      "defaultValue": "Static"
+                                    },
+                                    "availabilityZones": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "int"
+                                      },
+                                      "defaultValue": [
+                                        1,
+                                        2,
+                                        3
+                                      ],
+                                      "allowedValues": [
+                                        1,
+                                        2,
+                                        3
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                                      }
+                                    },
+                                    "publicIPAddressVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/publicIPAddressVersion"
+                                        },
+                                        "description": "Optional. IP address version."
+                                      },
+                                      "defaultValue": "IPv4"
+                                    },
+                                    "dnsSettings": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/dnsSettings"
+                                        },
+                                        "description": "Optional. The DNS settings of the public IP address."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipTags": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/ipTags"
+                                        },
+                                        "description": "Optional. The list of tags associated with the public IP address."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "skuName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/sku/properties/name"
+                                        },
+                                        "description": "Optional. Name of a public IP address SKU."
+                                      },
+                                      "defaultValue": "Standard"
+                                    },
+                                    "skuTier": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/sku/properties/tier"
+                                        },
+                                        "description": "Optional. Tier of a public IP address SKU."
+                                      },
+                                      "defaultValue": "Regional"
+                                    },
+                                    "ddosSettings": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/ddosSettings"
+                                        },
+                                        "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "deleteOption": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/deleteOption"
+                                        },
+                                        "description": "Optional. The delete option for the public IP address."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "idleTimeoutInMinutes": {
+                                      "type": "int",
+                                      "defaultValue": 4,
+                                      "metadata": {
+                                        "description": "Optional. The idle timeout of the public IP address."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "publicIpAddress": {
+                                      "type": "Microsoft.Network/publicIPAddresses",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "sku": {
+                                        "name": "[parameters('skuName')]",
+                                        "tier": "[parameters('skuTier')]"
+                                      },
+                                      "zones": "[map(parameters('availabilityZones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                                      "properties": {
+                                        "ddosSettings": "[parameters('ddosSettings')]",
+                                        "dnsSettings": "[parameters('dnsSettings')]",
+                                        "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                                        "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                                        "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                                        "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                                        "ipTags": "[parameters('ipTags')]",
+                                        "deleteOption": "[parameters('deleteOption')]"
+                                      }
+                                    },
+                                    "publicIpAddress_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "publicIpAddress"
+                                      ]
+                                    },
+                                    "publicIpAddress_roleAssignments": {
+                                      "copy": {
+                                        "name": "publicIpAddress_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "publicIpAddress"
+                                      ]
+                                    },
+                                    "publicIpAddress_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "publicIpAddress_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "publicIpAddress"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the public IP address was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the public IP address."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the public IP address."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                                    },
+                                    "ipAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The public IP address of the public IP address resource."
+                                      },
+                                      "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('publicIpAddress', '2025-01-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "networkInterface": {
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-NetworkInterface', deployment().name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('networkInterfaceName')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "copy": [
+                                      {
+                                        "name": "value",
+                                        "count": "[length(parameters('ipConfigurations'))]",
+                                        "input": "[createObject('name', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'name'), 'privateIPAllocationMethod', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAllocationMethod'), 'privateIPAddress', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddress'), 'publicIPAddressResourceId', if(not(empty(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'))), if(not(contains(coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), createObject()), 'publicIPAddressResourceId')), resourceId('Microsoft.Network/publicIPAddresses', coalesce(tryGet(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), 'name'), format('{0}{1}', parameters('virtualMachineName'), tryGet(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), 'publicIpNameSuffix')))), tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration', 'publicIPAddressResourceId')), null()), 'subnetResourceId', parameters('ipConfigurations')[copyIndex('value')].subnetResourceId, 'loadBalancerBackendAddressPools', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerBackendAddressPools'), 'applicationSecurityGroups', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'applicationSecurityGroups'), 'applicationGatewayBackendAddressPools', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'applicationGatewayBackendAddressPools'), 'gatewayLoadBalancer', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'gatewayLoadBalancer'), 'loadBalancerInboundNatRules', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerInboundNatRules'), 'privateIPAddressVersion', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddressVersion'), 'virtualNetworkTaps', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'virtualNetworkTaps'))]"
+                                      }
+                                    ]
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "tags": {
+                                    "value": "[parameters('tags')]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[parameters('diagnosticSettings')]"
+                                  },
+                                  "dnsServers": {
+                                    "value": "[parameters('dnsServers')]"
+                                  },
+                                  "enableAcceleratedNetworking": {
+                                    "value": "[parameters('enableAcceleratedNetworking')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[parameters('enableTelemetry')]"
+                                  },
+                                  "enableIPForwarding": {
+                                    "value": "[parameters('enableIPForwarding')]"
+                                  },
+                                  "lock": {
+                                    "value": "[parameters('lock')]"
+                                  },
+                                  "networkSecurityGroupResourceId": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('value', parameters('networkSecurityGroupResourceId')), createObject('value', ''))]",
+                                  "roleAssignments": {
+                                    "value": "[parameters('roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "272838238520810437"
+                                    },
+                                    "name": "Network Interface",
+                                    "description": "This module deploys a Network Interface."
+                                  },
+                                  "definitions": {
+                                    "networkInterfaceIPConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the IP configuration."
+                                          }
+                                        },
+                                        "privateIPAllocationMethod": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Dynamic",
+                                            "Static"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private IP address allocation method."
+                                          }
+                                        },
+                                        "privateIPAddress": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private IP address."
+                                          }
+                                        },
+                                        "publicIPAddressResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the public IP address."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource ID of the subnet."
+                                          }
+                                        },
+                                        "loadBalancerBackendAddressPools": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/backendAddressPoolType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of load balancer backend address pools."
+                                          }
+                                        },
+                                        "loadBalancerInboundNatRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/inboundNatRuleType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of references of LoadBalancerInboundNatRules."
+                                          }
+                                        },
+                                        "applicationSecurityGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/applicationSecurityGroupType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application security groups in which the IP configuration is included."
+                                          }
+                                        },
+                                        "applicationGatewayBackendAddressPools": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/applicationGatewayBackendAddressPoolsType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The reference to Application Gateway Backend Address Pools."
+                                          }
+                                        },
+                                        "gatewayLoadBalancer": {
+                                          "$ref": "#/definitions/subResourceType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The reference to gateway load balancer frontend IP."
+                                          }
+                                        },
+                                        "privateIPAddressVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "IPv4",
+                                            "IPv6"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Whether the specific IP configuration is IPv4 or IPv6."
+                                          }
+                                        },
+                                        "virtualNetworkTaps": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/virtualNetworkTapType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The reference to Virtual Network Taps."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The resource ID of the deployed resource."
+                                      }
+                                    },
+                                    "backendAddressPoolType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the backend address pool."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the backend address pool."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The properties of the backend address pool."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a backend address pool."
+                                      }
+                                    },
+                                    "applicationSecurityGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the application security group."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Location of the application security group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Properties of the application security group."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Tags of the application security group."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the application security group."
+                                      }
+                                    },
+                                    "applicationGatewayBackendAddressPoolsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the backend address pool."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the backend address pool that is unique within an Application Gateway."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "backendAddresses": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "ipAddress": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. IP address of the backend address."
+                                                    }
+                                                  },
+                                                  "fqdn": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. FQDN of the backend address."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Backend addresses."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Properties of the application gateway backend address pool."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the application gateway backend address pool."
+                                      }
+                                    },
+                                    "subResourceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the sub resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the sub resource."
+                                      }
+                                    },
+                                    "inboundNatRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the inbound NAT rule."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the resource that is unique within the set of inbound NAT rules used by the load balancer. This name can be used to access the resource."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "backendAddressPool": {
+                                              "$ref": "#/definitions/subResourceType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A reference to backendAddressPool resource."
+                                              }
+                                            },
+                                            "backendPort": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The port used for the internal endpoint. Acceptable values range from 1 to 65535."
+                                              }
+                                            },
+                                            "enableFloatingIP": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Configures a virtual machine's endpoint for the floating IP capability required to configure a SQL AlwaysOn Availability Group. This setting is required when using the SQL AlwaysOn Availability Groups in SQL server. This setting can't be changed after you create the endpoint."
+                                              }
+                                            },
+                                            "enableTcpReset": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Receive bidirectional TCP Reset on TCP flow idle timeout or unexpected connection termination. This element is only used when the protocol is set to TCP."
+                                              }
+                                            },
+                                            "frontendIPConfiguration": {
+                                              "$ref": "#/definitions/subResourceType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A reference to frontend IP addresses."
+                                              }
+                                            },
+                                            "frontendPort": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The port for the external endpoint. Port numbers for each rule must be unique within the Load Balancer. Acceptable values range from 1 to 65534."
+                                              }
+                                            },
+                                            "frontendPortRangeStart": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The port range start for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeEnd. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                              }
+                                            },
+                                            "frontendPortRangeEnd": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The port range end for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeStart. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                              }
+                                            },
+                                            "protocol": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "All",
+                                                "Tcp",
+                                                "Udp"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The reference to the transport protocol used by the load balancing rule."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Properties of the inbound NAT rule."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the inbound NAT rule."
+                                      }
+                                    },
+                                    "virtualNetworkTapType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the virtual network tap."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Location of the virtual network tap."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Properties of the virtual network tap."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Tags of the virtual network tap."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the virtual network tap."
+                                      }
+                                    },
+                                    "networkInterfaceIPConfigurationOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the IP configuration."
+                                          }
+                                        },
+                                        "privateIP": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The private IP address."
+                                          }
+                                        },
+                                        "publicIP": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The public IP address."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the network interface IP configuration output."
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the network interface."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/networkInterfaces@2024-07-01#properties/tags"
+                                        },
+                                        "description": "Optional. Resource tags."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "enableIPForwarding": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether IP forwarding is enabled on this network interface."
+                                      }
+                                    },
+                                    "enableAcceleratedNetworking": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If the network interface is accelerated networking enabled."
+                                      }
+                                    },
+                                    "dnsServers": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. List of DNS servers IP addresses. Use 'AzureProvidedDNS' to switch to azure provided DNS resolution. 'AzureProvidedDNS' value cannot be combined with other IPs, it must be the only value in dnsServers collection."
+                                      }
+                                    },
+                                    "networkSecurityGroupResourceId": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The network security group (NSG) to attach to the network interface."
+                                      }
+                                    },
+                                    "auxiliaryMode": {
+                                      "type": "string",
+                                      "defaultValue": "None",
+                                      "allowedValues": [
+                                        "Floating",
+                                        "MaxConnections",
+                                        "None"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Auxiliary mode of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                                      }
+                                    },
+                                    "auxiliarySku": {
+                                      "type": "string",
+                                      "defaultValue": "None",
+                                      "allowedValues": [
+                                        "A1",
+                                        "A2",
+                                        "A4",
+                                        "A8",
+                                        "None"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Auxiliary sku of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                                      }
+                                    },
+                                    "disableTcpStateTracking": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether to disable tcp state tracking. Subscription must be registered for the Microsoft.Network/AllowDisableTcpStateTracking feature before this property can be set to true."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/networkInterfaceIPConfigurationType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. A list of IPConfigurations of the network interface."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "publicIp": {
+                                      "copy": {
+                                        "name": "publicIp",
+                                        "count": "[length(parameters('ipConfigurations'))]"
+                                      },
+                                      "condition": "[and(contains(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), not(equals(tryGet(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), null())))]",
+                                      "existing": true,
+                                      "type": "Microsoft.Network/publicIPAddresses",
+                                      "apiVersion": "2024-05-01",
+                                      "resourceGroup": "[split(coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), ''), '/')[4]]",
+                                      "name": "[last(split(coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), ''), '/'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.network-networkinterface.{0}.{1}', replace('0.5.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "networkInterface": {
+                                      "type": "Microsoft.Network/networkInterfaces",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "ipConfigurations",
+                                            "count": "[length(parameters('ipConfigurations'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'name'), format('ipconfig{0}', padLeft(add(copyIndex('ipConfigurations'), 1), 2, '0')))]",
+                                              "properties": {
+                                                "primary": "[if(equals(copyIndex('ipConfigurations'), 0), true(), false())]",
+                                                "privateIPAllocationMethod": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAllocationMethod')]",
+                                                "privateIPAddress": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddress')]",
+                                                "publicIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId'), if(not(equals(tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId'), null())), createObject('id', tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId')), null()), null())]",
+                                                "subnet": {
+                                                  "id": "[parameters('ipConfigurations')[copyIndex('ipConfigurations')].subnetResourceId]"
+                                                },
+                                                "loadBalancerBackendAddressPools": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerBackendAddressPools')]",
+                                                "applicationSecurityGroups": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationSecurityGroups')]",
+                                                "applicationGatewayBackendAddressPools": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationGatewayBackendAddressPools')]",
+                                                "gatewayLoadBalancer": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'gatewayLoadBalancer')]",
+                                                "loadBalancerInboundNatRules": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerInboundNatRules')]",
+                                                "privateIPAddressVersion": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddressVersion')]",
+                                                "virtualNetworkTaps": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'virtualNetworkTaps')]"
+                                              }
+                                            }
+                                          }
+                                        ],
+                                        "auxiliaryMode": "[parameters('auxiliaryMode')]",
+                                        "auxiliarySku": "[parameters('auxiliarySku')]",
+                                        "disableTcpStateTracking": "[parameters('disableTcpStateTracking')]",
+                                        "dnsSettings": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', parameters('dnsServers')), null())]",
+                                        "enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
+                                        "enableIPForwarding": "[parameters('enableIPForwarding')]",
+                                        "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]"
+                                      }
+                                    },
+                                    "networkInterface_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "networkInterface"
+                                      ]
+                                    },
+                                    "networkInterface_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "networkInterface_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "networkInterface"
+                                      ]
+                                    },
+                                    "networkInterface_roleAssignments": {
+                                      "copy": {
+                                        "name": "networkInterface_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkInterfaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "networkInterface"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed resource."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed resource."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/networkInterfaces', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed resource."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('networkInterface', '2024-05-01', 'full').location]"
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/networkInterfaceIPConfigurationOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The list of IP configurations of the network interface."
+                                      },
+                                      "copy": {
+                                        "count": "[length(parameters('ipConfigurations'))]",
+                                        "input": {
+                                          "name": "[reference('networkInterface').ipConfigurations[copyIndex()].name]",
+                                          "privateIP": "[coalesce(tryGet(reference('networkInterface').ipConfigurations[copyIndex()].properties, 'privateIPAddress'), '')]",
+                                          "publicIP": "[if(and(contains(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), not(equals(tryGet(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), null()))), coalesce(reference(format('publicIp[{0}]', copyIndex())).ipAddress, ''), '')]"
+                                        }
+                                      }
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "networkInterface_publicIPAddresses"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the network interface."
+                              },
+                              "value": "[reference('networkInterface').outputs.name.value]"
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/networkInterfaceIPConfigurationOutputType"
+                              },
+                              "metadata": {
+                                "description": "The list of IP configurations of the network interface."
+                              },
+                              "value": "[reference('networkInterface').outputs.ipConfigurations.value]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "vm_domainJoinExtension": {
+                      "condition": "[and(contains(parameters('extensionDomainJoinConfig'), 'enabled'), parameters('extensionDomainJoinConfig').enabled)]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-DomainJoin', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'name'), 'DomainJoin')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.Compute"
+                          },
+                          "type": {
+                            "value": "JsonADDomainExtension"
+                          },
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'typeHandlerVersion'), '1.3')]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "settings": {
+                            "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'settings'), createObject('Name', tryGet(parameters('extensionDomainJoinConfig'), 'domainName'), 'OUPath', tryGet(parameters('extensionDomainJoinConfig'), 'ouPath'), 'User', tryGet(parameters('extensionDomainJoinConfig'), 'user'), 'Restart', tryGet(parameters('extensionDomainJoinConfig'), 'restart'), 'Options', tryGet(parameters('extensionDomainJoinConfig'), 'options')))]"
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'tags'), parameters('tags'))]"
+                          },
+                          "protectedSettings": {
+                            "value": {
+                              "Password": "[parameters('extensionDomainJoinPassword')]"
+                            }
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm"
+                      ]
+                    },
+                    "vm_aadJoinExtension": {
+                      "condition": "[parameters('extensionAadJoinConfig').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-AADLogin', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'name'), 'AADLogin')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.Azure.ActiveDirectory"
+                          },
+                          "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AADLoginForWindows'), createObject('value', 'AADSSHLoginforLinux'))]",
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '2.0', '1.0'))]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "settings": "[if(not(empty(variables('filteredAadJoinSettings'))), createObject('value', variables('filteredAadJoinSettings')), createObject('value', null()))]",
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_domainJoinExtension"
+                      ]
+                    },
+                    "vm_microsoftAntiMalwareExtension": {
+                      "condition": "[parameters('extensionAntiMalwareConfig').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-MicrosoftAntiMalware', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'name'), 'MicrosoftAntiMalware')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.Azure.Security"
+                          },
+                          "type": {
+                            "value": "IaaSAntimalware"
+                          },
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'typeHandlerVersion'), '1.3')]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "settings": {
+                            "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'settings'), createObject('AntimalwareEnabled', 'true', 'Exclusions', createObject(), 'RealtimeProtectionEnabled', 'true', 'ScheduledScanSettings', createObject('day', '7', 'isEnabled', 'true', 'scanType', 'Quick', 'time', '120')))]"
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_aadJoinExtension"
+                      ]
+                    },
+                    "vm_azureMonitorAgentExtension": {
+                      "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-AzureMonitorAgent', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'name'), 'AzureMonitorAgent')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.Azure.Monitor"
+                          },
+                          "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureMonitorWindowsAgent'), createObject('value', 'AzureMonitorLinuxAgent'))]",
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.22', '1.29'))]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "settings": {
+                            "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'settings'), createObject())]"
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_microsoftAntiMalwareExtension"
+                      ]
+                    },
+                    "vm_dependencyAgentExtension": {
+                      "condition": "[parameters('extensionDependencyAgentConfig').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-DependencyAgent', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'name'), 'DependencyAgent')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.Azure.Monitoring.DependencyAgent"
+                          },
+                          "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'DependencyAgentWindows'), createObject('value', 'DependencyAgentLinux'))]",
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'typeHandlerVersion'), '9.10')]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'enableAutomaticUpgrade'), true())]"
+                          },
+                          "settings": {
+                            "value": {
+                              "enableAMA": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'enableAMA'), true())]"
+                            }
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_azureMonitorAgentExtension"
+                      ]
+                    },
+                    "vm_networkWatcherAgentExtension": {
+                      "condition": "[parameters('extensionNetworkWatcherAgentConfig').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-NetworkWatcherAgent', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'name'), 'NetworkWatcherAgent')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.Azure.NetworkWatcher"
+                          },
+                          "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'NetworkWatcherAgentWindows'), createObject('value', 'NetworkWatcherAgentLinux'))]",
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'typeHandlerVersion'), '1.4')]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_dependencyAgentExtension"
+                      ]
+                    },
+                    "vm_desiredStateConfigurationExtension": {
+                      "condition": "[parameters('extensionDSCConfig').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-DesiredStateConfiguration', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'name'), 'DesiredStateConfiguration')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.Powershell"
+                          },
+                          "type": {
+                            "value": "DSC"
+                          },
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'typeHandlerVersion'), '2.77')]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "settings": {
+                            "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'settings'), createObject())]"
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'tags'), parameters('tags'))]"
+                          },
+                          "protectedSettings": {
+                            "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'protectedSettings'), createObject())]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_networkWatcherAgentExtension"
+                      ]
+                    },
+                    "vm_customScriptExtension": {
+                      "condition": "[not(empty(parameters('extensionCustomScriptConfig')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-CustomScriptExtension', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'name'), 'CustomScriptExtension')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'Microsoft.Compute'), createObject('value', 'Microsoft.Azure.Extensions'))]",
+                          "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'CustomScriptExtension'), createObject('value', 'CustomScript'))]",
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.10', '2.1'))]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "forceUpdateTag": {
+                            "value": "[tryGet(parameters('extensionCustomScriptConfig'), 'forceUpdateTag')]"
+                          },
+                          "provisionAfterExtensions": {
+                            "value": "[tryGet(parameters('extensionCustomScriptConfig'), 'provisionAfterExtensions')]"
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'tags'), parameters('tags'))]"
+                          },
+                          "protectedSettingsFromKeyVault": {
+                            "value": "[tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettingsFromKeyVault')]"
+                          },
+                          "settings": {
+                            "value": "[shallowMerge(createArray(if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'settings'), 'commandToExecute'))), createObject('commandToExecute', tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'settings'), 'commandToExecute')), createObject()), if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'settings'), 'fileUris'))), createObject('fileUris', tryGet(parameters('extensionCustomScriptConfig'), 'settings', 'fileUris')), createObject())))]"
+                          },
+                          "protectedSettings": {
+                            "value": "[shallowMerge(createArray(if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'commandToExecute'))), createObject('commandToExecute', tryGet(parameters('extensionCustomScriptConfig').protectedSettings, 'commandToExecute')), createObject()), if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'storageAccountName'))), createObject('storageAccountName', parameters('extensionCustomScriptConfig').protectedSettings.storageAccountName), createObject()), if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'storageAccountKey'))), createObject('storageAccountKey', parameters('extensionCustomScriptConfig').protectedSettings.storageAccountKey), createObject()), if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'fileUris'))), createObject('fileUris', parameters('extensionCustomScriptConfig').protectedSettings.fileUris), createObject()), if(not(equals(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'managedIdentityResourceId'), null())), createObject('managedIdentity', if(not(empty(tryGet(parameters('extensionCustomScriptConfig').protectedSettings, 'managedIdentityResourceId'))), createObject('clientId', reference('cseIdentity').clientId), createObject())), createObject())))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "cseIdentity",
+                        "vm"
+                      ]
+                    },
+                    "vm_azureDiskEncryptionExtension": {
+                      "condition": "[parameters('extensionAzureDiskEncryptionConfig').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-AzureDiskEncryption', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'name'), 'AzureDiskEncryption')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.Azure.Security"
+                          },
+                          "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureDiskEncryption'), createObject('value', 'AzureDiskEncryptionForLinux'))]",
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '2.2', '1.1'))]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "forceUpdateTag": {
+                            "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'forceUpdateTag'), '1.0')]"
+                          },
+                          "settings": {
+                            "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'settings'), createObject())]"
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_customScriptExtension"
+                      ]
+                    },
+                    "vm_nvidiaGpuDriverWindowsExtension": {
+                      "condition": "[parameters('extensionNvidiaGpuDriverWindows').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-NvidiaGpuDriverWindows', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'name'), 'NvidiaGpuDriverWindows')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.HpcCompute"
+                          },
+                          "type": {
+                            "value": "NvidiaGpuDriverWindows"
+                          },
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'typeHandlerVersion'), '1.4')]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_azureDiskEncryptionExtension"
+                      ]
+                    },
+                    "vm_hostPoolRegistrationExtension": {
+                      "condition": "[parameters('extensionHostPoolRegistration').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-HostPoolRegistration', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'name'), 'HostPoolRegistration')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.PowerShell"
+                          },
+                          "type": {
+                            "value": "DSC"
+                          },
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'typeHandlerVersion'), '2.77')]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'enableAutomaticUpgrade'), false())]"
+                          },
+                          "settings": {
+                            "value": {
+                              "modulesUrl": "[parameters('extensionHostPoolRegistration').modulesUrl]",
+                              "configurationFunction": "[parameters('extensionHostPoolRegistration').configurationFunction]",
+                              "properties": {
+                                "hostPoolName": "[parameters('extensionHostPoolRegistration').hostPoolName]",
+                                "aadJoin": true
+                              }
+                            }
+                          },
+                          "protectedSettings": {
+                            "value": {
+                              "properties": {
+                                "registrationInfoToken": "[parameters('extensionHostPoolRegistration').registrationInfoToken]"
+                              }
+                            }
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'supressFailures'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_nvidiaGpuDriverWindowsExtension"
+                      ]
+                    },
+                    "vm_azureGuestConfigurationExtension": {
+                      "condition": "[parameters('extensionGuestConfigurationExtension').enabled]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-GuestConfiguration', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "virtualMachineName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": "[if(coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'name'), equals(parameters('osType'), 'Windows')), createObject('value', 'AzurePolicyforWindows'), createObject('value', 'AzurePolicyforLinux'))]",
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "publisher": {
+                            "value": "Microsoft.GuestConfiguration"
+                          },
+                          "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'ConfigurationforWindows'), createObject('value', 'ConfigurationForLinux'))]",
+                          "typeHandlerVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.0', '1.0'))]"
+                          },
+                          "autoUpgradeMinorVersion": {
+                            "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'autoUpgradeMinorVersion'), true())]"
+                          },
+                          "enableAutomaticUpgrade": {
+                            "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'enableAutomaticUpgrade'), true())]"
+                          },
+                          "forceUpdateTag": {
+                            "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'forceUpdateTag'), '1.0')]"
+                          },
+                          "settings": {
+                            "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'settings'), createObject())]"
+                          },
+                          "supressFailures": {
+                            "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'supressFailures'), false())]"
+                          },
+                          "protectedSettings": {
+                            "value": "[parameters('extensionGuestConfigurationExtensionProtectedSettings')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "3581830278162851734"
+                            },
+                            "name": "Virtual Machine Extensions",
+                            "description": "This module deploys a Virtual Machine Extension."
+                          },
+                          "parameters": {
+                            "virtualMachineName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine extension."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. The location the extension is deployed to."
+                              }
+                            },
+                            "publisher": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the extension handler publisher."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                              }
+                            },
+                            "typeHandlerVersion": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the version of the script handler."
+                              }
+                            },
+                            "autoUpgradeMinorVersion": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                              }
+                            },
+                            "forceUpdateTag": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                              }
+                            },
+                            "settings": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific settings."
+                              }
+                            },
+                            "protectedSettings": {
+                              "type": "secureObject",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Any object that contains the extension specific protected settings."
+                              }
+                            },
+                            "supressFailures": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                              }
+                            },
+                            "enableAutomaticUpgrade": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "protectedSettingsFromKeyVault": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                },
+                                "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                              },
+                              "nullable": true
+                            },
+                            "provisionAfterExtensions": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                },
+                                "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "virtualMachine": {
+                              "existing": true,
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('virtualMachineName')]"
+                            },
+                            "extension": {
+                              "type": "Microsoft.Compute/virtualMachines/extensions",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "publisher": "[parameters('publisher')]",
+                                "type": "[parameters('type')]",
+                                "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                "settings": "[parameters('settings')]",
+                                "protectedSettings": "[parameters('protectedSettings')]",
+                                "suppressFailures": "[parameters('supressFailures')]",
+                                "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the extension was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('extension', '2024-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_hostPoolRegistrationExtension"
+                      ]
+                    },
+                    "vm_backup": {
+                      "condition": "[not(empty(parameters('backupVaultName')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-VM-Backup', uniqueString(deployment().name, parameters('location')))]",
+                      "resourceGroup": "[parameters('backupVaultResourceGroup')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[format('vm;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "policyId": {
+                            "value": "[resourceId(parameters('backupVaultResourceGroup'), 'Microsoft.RecoveryServices/vaults/backupPolicies', parameters('backupVaultName'), parameters('backupPolicyName'))]"
+                          },
+                          "protectedItemType": {
+                            "value": "Microsoft.Compute/virtualMachines"
+                          },
+                          "protectionContainerName": {
+                            "value": "[format('iaasvmcontainer;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                          },
+                          "recoveryVaultName": {
+                            "value": "[parameters('backupVaultName')]"
+                          },
+                          "sourceResourceId": {
+                            "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "17448691641471706096"
+                            },
+                            "name": "Recovery Service Vaults Protection Container Protected Item",
+                            "description": "This module deploys a Recovery Services Vault Protection Container Protected Item."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the resource."
+                              }
+                            },
+                            "protectionContainerName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. Name of the Azure Recovery Service Vault Protection Container. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "recoveryVaultName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Azure Recovery Service Vault. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "protectedItemType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "AzureFileShareProtectedItem",
+                                "AzureVmWorkloadSAPAseDatabase",
+                                "AzureVmWorkloadSAPHanaDatabase",
+                                "AzureVmWorkloadSQLDatabase",
+                                "DPMProtectedItem",
+                                "GenericProtectedItem",
+                                "MabFileFolderProtectedItem",
+                                "Microsoft.ClassicCompute/virtualMachines",
+                                "Microsoft.Compute/virtualMachines",
+                                "Microsoft.Sql/servers/databases"
+                              ],
+                              "metadata": {
+                                "description": "Required. The backup item type."
+                              }
+                            },
+                            "policyId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. ID of the backup policy with which this item is backed up."
+                              }
+                            },
+                            "sourceResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the resource to back up."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
+                              "apiVersion": "2025-02-01",
+                              "name": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "protectedItemType": "[parameters('protectedItemType')]",
+                                "policyId": "[parameters('policyId')]",
+                                "sourceResourceId": "[parameters('sourceResourceId')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Resource Group the protected item was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the protected item."
+                              },
+                              "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems', split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[0], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[1], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[2], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[3])]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The Name of the protected item."
+                              },
+                              "value": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "vm",
+                        "vm_azureGuestConfigurationExtension"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the VM."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the VM."
+                      },
+                      "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the VM was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('vm', '2024-07-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('vm', '2024-07-01', 'full').location]"
+                    },
+                    "nicConfigurations": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/nicConfigurationOutputType"
+                      },
+                      "metadata": {
+                        "description": "The list of NIC configurations of the virtual machine."
+                      },
+                      "copy": {
+                        "count": "[length(parameters('nicConfigurations'))]",
+                        "input": {
+                          "name": "[reference(format('vm_nic[{0}]', copyIndex())).outputs.name.value]",
+                          "ipConfigurations": "[reference(format('vm_nic[{0}]', copyIndex())).outputs.ipConfigurations.value]"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the virtual machine."
+              },
+              "value": "[reference('virtualMachine').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the virtual machine."
+              },
+              "value": "[reference('virtualMachine').outputs.name.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "log_analytics",
+        "maintenanceConfiguration",
+        "proximityPlacementGroup",
+        "virtualNetwork",
+        "windowsVmDataCollectionRules"
+      ]
+    },
+    "privateDnsZoneDeployments": {
+      "copy": {
+        "name": "privateDnsZoneDeployments",
+        "count": "[length(variables('privateDnsZones'))]",
+        "mode": "serial",
+        "batchSize": 5
+      },
+      "condition": "[parameters('enablePrivateNetworking')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.private-dns-zone.{0}.{1}', split(variables('privateDnsZones')[copyIndex()], '.')[1], parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('privateDnsZones')[copyIndex()]]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "virtualNetworkLinks": {
+            "value": [
+              {
+                "name": "[take(format('vnetlink-{0}-{1}', reference('virtualNetwork').outputs.name.value, split(variables('privateDnsZones')[copyIndex()], '.')[1]), 80)]",
+                "virtualNetworkResourceId": "[reference('virtualNetwork').outputs.resourceId.value]"
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "11076758087490966511"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the private DNS zone (e.g., privatelink.cognitiveservices.azure.com)."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "virtualNetworkLinks": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Virtual network links to associate with the DNS zone."
+              }
+            },
+            "a": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Array of A records."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.network.private-dns-zone.{0}', split(parameters('name'), '.')[1]), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "virtualNetworkLinks": {
+                    "value": "[parameters('virtualNetworkLinks')]"
+                  },
+                  "a": {
+                    "value": "[parameters('a')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.41.2.15936",
+                      "templateHash": "18337341331267624582"
+                    },
+                    "name": "Private DNS Zones",
+                    "description": "This module deploys a Private DNS zone."
+                  },
+                  "definitions": {
+                    "aType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the record."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/A@2024-06-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. The metadata of the record."
+                          },
+                          "nullable": true
+                        },
+                        "ttl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TTL of the record."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "aRecords": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/A@2024-06-01#properties/properties/properties/aRecords"
+                            },
+                            "description": "Optional. The list of A records in the record set."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the A record."
+                      }
+                    },
+                    "aaaaType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the record."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/AAAA@2024-06-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. The metadata of the record."
+                          },
+                          "nullable": true
+                        },
+                        "ttl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TTL of the record."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "aaaaRecords": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/AAAA@2024-06-01#properties/properties/properties/aaaaRecords"
+                            },
+                            "description": "Optional. The list of AAAA records in the record set."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the AAAA record."
+                      }
+                    },
+                    "cnameType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the record."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/CNAME@2024-06-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. The metadata of the record."
+                          },
+                          "nullable": true
+                        },
+                        "ttl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TTL of the record."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "cnameRecord": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/CNAME@2024-06-01#properties/properties/properties/cnameRecord"
+                            },
+                            "description": "Optional. The CNAME record in the record set."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the CNAME record."
+                      }
+                    },
+                    "mxType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the record."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/MX@2024-06-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. The metadata of the record."
+                          },
+                          "nullable": true
+                        },
+                        "ttl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TTL of the record."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "mxRecords": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/MX@2024-06-01#properties/properties/properties/mxRecords"
+                            },
+                            "description": "Optional. The list of MX records in the record set."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the MX record."
+                      }
+                    },
+                    "ptrType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the record."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/PTR@2024-06-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. The metadata of the record."
+                          },
+                          "nullable": true
+                        },
+                        "ttl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TTL of the record."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "ptrRecords": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/PTR@2024-06-01#properties/properties/properties/ptrRecords"
+                            },
+                            "description": "Optional. The list of PTR records in the record set."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the PTR record."
+                      }
+                    },
+                    "soaType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the record."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/SOA@2024-06-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. The metadata of the record."
+                          },
+                          "nullable": true
+                        },
+                        "ttl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TTL of the record."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "soaRecord": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/SOA@2024-06-01#properties/properties/properties/soaRecord"
+                            },
+                            "description": "Optional. The SOA record in the record set."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the SOA record."
+                      }
+                    },
+                    "srvType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the record."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/SRV@2024-06-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. The metadata of the record."
+                          },
+                          "nullable": true
+                        },
+                        "ttl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TTL of the record."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "srvRecords": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/SRV@2024-06-01#properties/properties/properties/srvRecords"
+                            },
+                            "description": "Optional. The list of SRV records in the record set."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the SRV record."
+                      }
+                    },
+                    "txtType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the record."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/TXT@2024-06-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. The metadata of the record."
+                          },
+                          "nullable": true
+                        },
+                        "ttl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TTL of the record."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "txtRecords": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/TXT@2024-06-01#properties/properties/properties/txtRecords"
+                            },
+                            "description": "Optional. The list of TXT records in the record set."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the TXT record."
+                      }
+                    },
+                    "virtualNetworkLinkType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "minLength": 1,
+                          "maxLength": 80,
+                          "metadata": {
+                            "description": "Optional. The resource name."
+                          }
+                        },
+                        "virtualNetworkResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the virtual network to link."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Azure Region where the resource lives."
+                          }
+                        },
+                        "registrationEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01#properties/tags"
+                            },
+                            "description": "Optional. Resource tags."
+                          },
+                          "nullable": true
+                        },
+                        "resolutionPolicy": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Default",
+                            "NxDomainRedirect"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resolution type of the private-dns-zone fallback machanism."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the virtual network link."
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Private DNS zone name."
+                      }
+                    },
+                    "a": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/aType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of A records."
+                      }
+                    },
+                    "aaaa": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/aaaaType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of AAAA records."
+                      }
+                    },
+                    "cname": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/cnameType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of CNAME records."
+                      }
+                    },
+                    "mx": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/mxType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of MX records."
+                      }
+                    },
+                    "ptr": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/ptrType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of PTR records."
+                      }
+                    },
+                    "soa": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/soaType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of SOA records."
+                      }
+                    },
+                    "srv": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/srvType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of SRV records."
+                      }
+                    },
+                    "txt": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/txtType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of TXT records."
+                      }
+                    },
+                    "virtualNetworkLinks": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/virtualNetworkLinkType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "global",
+                      "metadata": {
+                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    },
+                    "enableReferencedModulesTelemetry": false
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.8.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateDnsZone": {
+                      "type": "Microsoft.Network/privateDnsZones",
+                      "apiVersion": "2020-06-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]"
+                    },
+                    "privateDnsZone_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_roleAssignments": {
+                      "copy": {
+                        "name": "privateDnsZone_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_A": {
+                      "copy": {
+                        "name": "privateDnsZone_A",
+                        "count": "[length(coalesce(parameters('a'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
+                          },
+                          "aRecords": {
+                            "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "7372385900111002873"
+                            },
+                            "name": "Private DNS Zone A record",
+                            "description": "This module deploys a Private DNS Zone A record."
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the A record."
+                              }
+                            },
+                            "aRecords": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/A@2024-06-01#properties/properties/properties/aRecords"
+                                },
+                                "description": "Optional. The list of A records in the record set."
+                              },
+                              "nullable": true
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/A@2024-06-01#properties/properties/properties/metadata"
+                                },
+                                "description": "Optional. The metadata attached to the record set."
+                              },
+                              "nullable": true
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.nw-privdnszonea.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "A": {
+                              "type": "Microsoft.Network/privateDnsZones/A",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "aRecords": "[parameters('aRecords')]",
+                                "metadata": "[parameters('metadata')]",
+                                "ttl": "[parameters('ttl')]"
+                              }
+                            },
+                            "A_roleAssignments": {
+                              "copy": {
+                                "name": "A_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "A"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed A record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed A record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed A record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_AAAA": {
+                      "copy": {
+                        "name": "privateDnsZone_AAAA",
+                        "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
+                          },
+                          "aaaaRecords": {
+                            "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "14405855828972373002"
+                            },
+                            "name": "Private DNS Zone AAAA record",
+                            "description": "This module deploys a Private DNS Zone AAAA record."
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the AAAA record."
+                              }
+                            },
+                            "aaaaRecords": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/AAAA@2024-06-01#properties/properties/properties/aaaaRecords"
+                                },
+                                "description": "Optional. The list of AAAA records in the record set."
+                              },
+                              "nullable": true
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/AAAA@2024-06-01#properties/properties/properties/metadata"
+                                },
+                                "description": "Optional. The metadata attached to the record set."
+                              },
+                              "nullable": true
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.nw-privdnszoneaaaa.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "AAAA": {
+                              "type": "Microsoft.Network/privateDnsZones/AAAA",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "aaaaRecords": "[parameters('aaaaRecords')]",
+                                "metadata": "[parameters('metadata')]",
+                                "ttl": "[parameters('ttl')]"
+                              }
+                            },
+                            "AAAA_roleAssignments": {
+                              "copy": {
+                                "name": "AAAA_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "AAAA"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed AAAA record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed AAAA record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed AAAA record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_CNAME": {
+                      "copy": {
+                        "name": "privateDnsZone_CNAME",
+                        "count": "[length(coalesce(parameters('cname'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
+                          },
+                          "cnameRecord": {
+                            "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "13818627461335065928"
+                            },
+                            "name": "Private DNS Zone CNAME record",
+                            "description": "This module deploys a Private DNS Zone CNAME record."
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the CNAME record."
+                              }
+                            },
+                            "cnameRecord": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/CNAME@2024-06-01#properties/properties/properties/cnameRecord"
+                                },
+                                "description": "Optional. A CNAME record."
+                              },
+                              "nullable": true
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/CNAME@2024-06-01#properties/properties/properties/metadata"
+                                },
+                                "description": "Optional. The metadata attached to the record set."
+                              },
+                              "nullable": true
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.nw-privdnszonecname.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "CNAME": {
+                              "type": "Microsoft.Network/privateDnsZones/CNAME",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "cnameRecord": "[parameters('cnameRecord')]",
+                                "metadata": "[parameters('metadata')]",
+                                "ttl": "[parameters('ttl')]"
+                              }
+                            },
+                            "CNAME_roleAssignments": {
+                              "copy": {
+                                "name": "CNAME_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "CNAME"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed CNAME record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed CNAME record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed CNAME record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_MX": {
+                      "copy": {
+                        "name": "privateDnsZone_MX",
+                        "count": "[length(coalesce(parameters('mx'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "mxRecords": {
+                            "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "2977624679479439942"
+                            },
+                            "name": "Private DNS Zone MX record",
+                            "description": "This module deploys a Private DNS Zone MX record."
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the MX record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/MX@2024-06-01#properties/properties/properties/metadata"
+                                },
+                                "description": "Optional. The metadata attached to the record set."
+                              },
+                              "nullable": true
+                            },
+                            "mxRecords": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/MX@2024-06-01#properties/properties/properties/mxRecords"
+                                },
+                                "description": "Optional. The list of MX records in the record set."
+                              },
+                              "nullable": true
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.nw-privdnszonemx.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "MX": {
+                              "type": "Microsoft.Network/privateDnsZones/MX",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "mxRecords": "[parameters('mxRecords')]",
+                                "ttl": "[parameters('ttl')]"
+                              }
+                            },
+                            "MX_roleAssignments": {
+                              "copy": {
+                                "name": "MX_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "MX"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed MX record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed MX record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed MX record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_PTR": {
+                      "copy": {
+                        "name": "privateDnsZone_PTR",
+                        "count": "[length(coalesce(parameters('ptr'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "ptrRecords": {
+                            "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "15286275176817336979"
+                            },
+                            "name": "Private DNS Zone PTR record",
+                            "description": "This module deploys a Private DNS Zone PTR record."
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the PTR record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/PTR@2024-06-01#properties/properties/properties/metadata"
+                                },
+                                "description": "Optional. The metadata attached to the record set."
+                              },
+                              "nullable": true
+                            },
+                            "ptrRecords": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/PTR@2024-06-01#properties/properties/properties/ptrRecords"
+                                },
+                                "description": "Optional. The list of PTR records in the record set."
+                              },
+                              "nullable": true
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.nw-privdnszoneptr.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "PTR": {
+                              "type": "Microsoft.Network/privateDnsZones/PTR",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "ptrRecords": "[parameters('ptrRecords')]",
+                                "ttl": "[parameters('ttl')]"
+                              }
+                            },
+                            "PTR_roleAssignments": {
+                              "copy": {
+                                "name": "PTR_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "PTR"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed PTR record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed PTR record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed PTR record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_SOA": {
+                      "copy": {
+                        "name": "privateDnsZone_SOA",
+                        "count": "[length(coalesce(parameters('soa'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "soaRecord": {
+                            "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "4837447718856535826"
+                            },
+                            "name": "Private DNS Zone SOA record",
+                            "description": "This module deploys a Private DNS Zone SOA record."
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the SOA record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/SOA@2024-06-01#properties/properties/properties/metadata"
+                                },
+                                "description": "Optional. The metadata attached to the record set."
+                              },
+                              "nullable": true
+                            },
+                            "soaRecord": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/SOA@2024-06-01#properties/properties/properties/soaRecord"
+                                },
+                                "description": "Optional. A SOA record."
+                              },
+                              "nullable": true
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.nw-privdnszonesoa.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "SOA": {
+                              "type": "Microsoft.Network/privateDnsZones/SOA",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "soaRecord": "[parameters('soaRecord')]",
+                                "ttl": "[parameters('ttl')]"
+                              }
+                            },
+                            "SOA_roleAssignments": {
+                              "copy": {
+                                "name": "SOA_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "SOA"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed SOA record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed SOA record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed SOA record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_SRV": {
+                      "copy": {
+                        "name": "privateDnsZone_SRV",
+                        "count": "[length(coalesce(parameters('srv'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "srvRecords": {
+                            "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "15028912535488490265"
+                            },
+                            "name": "Private DNS Zone SRV record",
+                            "description": "This module deploys a Private DNS Zone SRV record."
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the SRV record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/SRV@2024-06-01#properties/properties/properties/metadata"
+                                },
+                                "description": "Optional. The metadata attached to the record set."
+                              },
+                              "nullable": true
+                            },
+                            "srvRecords": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/SRV@2024-06-01#properties/properties/properties/srvRecords"
+                                },
+                                "description": "Optional. The list of SRV records in the record set."
+                              },
+                              "nullable": true
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.nw-privdnszonesrv.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "SRV": {
+                              "type": "Microsoft.Network/privateDnsZones/SRV",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "srvRecords": "[parameters('srvRecords')]",
+                                "ttl": "[parameters('ttl')]"
+                              }
+                            },
+                            "SRV_roleAssignments": {
+                              "copy": {
+                                "name": "SRV_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "SRV"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed SRV record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed SRV record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed SRV record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_TXT": {
+                      "copy": {
+                        "name": "privateDnsZone_TXT",
+                        "count": "[length(coalesce(parameters('txt'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
+                          },
+                          "metadata": {
+                            "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
+                          },
+                          "txtRecords": {
+                            "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
+                          },
+                          "ttl": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "7641583415110009849"
+                            },
+                            "name": "Private DNS Zone TXT record",
+                            "description": "This module deploys a Private DNS Zone TXT record."
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the TXT record."
+                              }
+                            },
+                            "metadata": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/TXT@2024-06-01#properties/properties/properties/metadata"
+                                },
+                                "description": "Optional. The metadata attached to the record set."
+                              },
+                              "nullable": true
+                            },
+                            "ttl": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "metadata": {
+                                "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                              }
+                            },
+                            "txtRecords": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/TXT@2024-06-01#properties/properties/properties/txtRecords"
+                                },
+                                "description": "Optional. The list of TXT records in the record set."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.nw-privdnszonetxt.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "TXT": {
+                              "type": "Microsoft.Network/privateDnsZones/TXT",
+                              "apiVersion": "2020-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "properties": {
+                                "metadata": "[parameters('metadata')]",
+                                "ttl": "[parameters('ttl')]",
+                                "txtRecords": "[parameters('txtRecords')]"
+                              }
+                            },
+                            "TXT_roleAssignments": {
+                              "copy": {
+                                "name": "TXT_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "TXT"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed TXT record."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed TXT record."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed TXT record."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    },
+                    "privateDnsZone_virtualNetworkLinks": {
+                      "copy": {
+                        "name": "privateDnsZone_virtualNetworkLinks",
+                        "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateDnsZone-VNetLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "privateDnsZoneName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
+                          },
+                          "virtualNetworkResourceId": {
+                            "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
+                          },
+                          "registrationEnabled": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "resolutionPolicy": {
+                            "value": "[tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'resolutionPolicy')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "7392770862892927923"
+                            },
+                            "name": "Private DNS Zone Virtual Network Link",
+                            "description": "This module deploys a Private DNS Zone Virtual Network Link."
+                          },
+                          "parameters": {
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "privateDnsZoneName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
+                              "metadata": {
+                                "description": "Optional. The name of the virtual network link."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "global",
+                              "metadata": {
+                                "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "registrationEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                              }
+                            },
+                            "virtualNetworkResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Link to another virtual network resource ID."
+                              }
+                            },
+                            "resolutionPolicy": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resolution policy on the virtual network link. Only applicable for virtual network links to privatelink zones, and for A,AAAA,CNAME queries. When set to `NxDomainRedirect`, Azure DNS resolver falls back to public resolution if private dns query resolution results in non-existent domain response. `Default` is configured as the default option."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.nw-privdnszonevnetlink.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('privateDnsZoneName')]"
+                            },
+                            "virtualNetworkLink": {
+                              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+                              "apiVersion": "2024-06-01",
+                              "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "registrationEnabled": "[parameters('registrationEnabled')]",
+                                "virtualNetwork": {
+                                  "id": "[parameters('virtualNetworkResourceId')]"
+                                },
+                                "resolutionPolicy": "[parameters('resolutionPolicy')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed virtual network link."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed virtual network link."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed virtual network link."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('virtualNetworkLink', '2024-06-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateDnsZone"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private DNS zone was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private DNS zone."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private DNS zone."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the private DNS zone."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.network.private-dns-zone.{0}', split(parameters('name'), '.')[1]), 64)), '2025-04-01').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the private DNS zone."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.network.private-dns-zone.{0}', split(parameters('name'), '.')[1]), 64)), '2025-04-01').outputs.name.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "virtualNetwork"
+      ]
+    },
+    "existing_project_setup": {
+      "condition": "[variables('useExistingAIProject')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)]",
+      "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+      "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference('ai_foundry_project').outputs.name.value))]",
+          "projectName": "[if(variables('useExistingAIProject'), if(greater(length(split(parameters('existingFoundryProjectResourceId'), '/')), 10), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[10]), createObject('value', '')), createObject('value', reference('ai_foundry_project').outputs.projectName.value))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "8266777043110372909"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the existing Cognitive Services account."
+              }
+            },
+            "projectName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the existing AI project."
+              }
+            }
+          },
+          "resources": [],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Services account."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Services account."
+              },
+              "value": "[parameters('name')]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the AI Services account (OpenAI Language Model Instance API)."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['OpenAI Language Model Instance API']]"
+            },
+            "cognitiveServicesEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the AI Services account (Cognitive Services)."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoint]"
+            },
+            "azureOpenAiCuEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure OpenAI Content Understanding endpoint URL."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]"
+            },
+            "principalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID of the AI Services account (empty if none)."
+              },
+              "value": "[coalesce(tryGet(reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full').identity, 'principalId'), '')]"
+            },
+            "projectResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Foundry project."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]"
+            },
+            "projectName": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Foundry project."
+              },
+              "value": "[parameters('projectName')]"
+            },
+            "projectEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "AI Foundry project endpoint."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]"
+            },
+            "projectIdentityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID of the project (empty if none)."
+              },
+              "value": "[coalesce(tryGet(reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full').identity, 'principalId'), '')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "ai_foundry_project"
+      ]
+    },
+    "ai_foundry_project": {
+      "condition": "[not(variables('useExistingAIProject'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('azureAiServiceLocation')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "publicNetworkAccess": {
+            "value": "Enabled"
+          },
+          "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', null()))]",
+          "roleAssignments": {
+            "value": [
+              {
+                "roleDefinitionIdOrName": "a97b65f3-24c7-4388-baec-2e87135dc908",
+                "principalId": "[variables('deployingUserPrincipalId')]",
+                "principalType": "[parameters('deployingUserPrincipalType')]"
+              },
+              {
+                "roleDefinitionIdOrName": "53ca6127-db72-4b80-b1b0-d745d6d5456d",
+                "principalId": "[variables('deployingUserPrincipalId')]",
+                "principalType": "[parameters('deployingUserPrincipalType')]"
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "7014942539753624443"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Solution name suffix used to generate resource names."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('aif-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the AI Services account. Defaults to aif-{solutionName}."
+              }
+            },
+            "projectName": {
+              "type": "string",
+              "defaultValue": "[format('proj-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Azure region for the resources."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Tags to apply to resources."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "S0",
+              "metadata": {
+                "description": "Optional. SKU name for the AI Services account."
+              }
+            },
+            "disableLocalAuth": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Whether to disable local (key-based) authentication."
+              }
+            },
+            "allowProjectManagement": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Whether to allow project management (AI Foundry hub)."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Optional. Public network access setting."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity type for the resources."
+              }
+            },
+            "networkAclsDefaultAction": {
+              "type": "string",
+              "defaultValue": "Allow",
+              "allowedValues": [
+                "Allow",
+                "Deny"
+              ],
+              "metadata": {
+                "description": "Optional. Network ACLs default action."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Diagnostic settings for the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Array of role assignments to create on the AI Services account."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "resources": {
+            "aiServices": {
+              "existing": true,
+              "type": "Microsoft.CognitiveServices/accounts",
+              "apiVersion": "2025-12-01",
+              "name": "[parameters('name')]",
+              "dependsOn": [
+                "aiServicesAccount"
+              ]
+            },
+            "aiProject": {
+              "type": "Microsoft.CognitiveServices/accounts/projects",
+              "apiVersion": "2025-12-01",
+              "name": "[format('{0}/{1}', parameters('name'), parameters('projectName'))]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "AIServices",
+              "identity": "[parameters('identity')]",
+              "properties": {},
+              "dependsOn": [
+                "aiServicesAccount"
+              ]
+            },
+            "aiServicesAccount": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.cognitive-services.account.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "sku": {
+                    "value": "[parameters('skuName')]"
+                  },
+                  "kind": {
+                    "value": "AIServices"
+                  },
+                  "disableLocalAuth": {
+                    "value": "[parameters('disableLocalAuth')]"
+                  },
+                  "allowProjectManagement": {
+                    "value": "[parameters('allowProjectManagement')]"
+                  },
+                  "customSubDomainName": {
+                    "value": "[parameters('name')]"
+                  },
+                  "networkAcls": {
+                    "value": {
+                      "defaultAction": "[parameters('networkAclsDefaultAction')]",
+                      "virtualNetworkRules": [],
+                      "ipRules": []
+                    }
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "diagnosticSettings": {
+                    "value": "[parameters('diagnosticSettings')]"
+                  },
+                  "deployments": {
+                    "value": []
+                  },
+                  "roleAssignments": {
+                    "value": "[parameters('roleAssignments')]"
+                  },
+                  "privateEndpoints": {
+                    "value": []
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.41.2.15936",
+                      "templateHash": "8642151282041103672"
+                    },
+                    "name": "Cognitive Services",
+                    "description": "This module deploys a Cognitive Service."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the private endpoint output."
+                      }
+                    },
+                    "deploymentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of cognitive service account deployment."
+                          }
+                        },
+                        "model": {
+                          "type": "object",
+                          "properties": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of Cognitive Services account deployment model."
+                              }
+                            },
+                            "format": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The format of Cognitive Services account deployment model."
+                              }
+                            },
+                            "version": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. The version of Cognitive Services account deployment model. Required if the model does not have a default version."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of Cognitive Services account deployment model."
+                          }
+                        },
+                        "sku": {
+                          "type": "object",
+                          "properties": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the resource model definition representing SKU."
+                              }
+                            },
+                            "capacity": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The capacity of the resource model definition representing SKU."
+                              }
+                            },
+                            "tier": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The tier of the resource model definition representing SKU."
+                              }
+                            },
+                            "size": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The size of the resource model definition representing SKU."
+                              }
+                            },
+                            "family": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The family of the resource model definition representing SKU."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource model definition representing SKU."
+                          }
+                        },
+                        "raiPolicyName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of RAI policy."
+                          }
+                        },
+                        "versionUpgradeOption": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version upgrade option."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a cognitive services account deployment."
+                      }
+                    },
+                    "endpointType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Type of the endpoint."
+                          }
+                        },
+                        "endpoint": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The endpoint URI."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a cognitive services account endpoint."
+                      }
+                    },
+                    "secretsExportConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
+                          }
+                        },
+                        "accessKey1Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name for the accessKey1 secret to create."
+                          }
+                        },
+                        "accessKey2Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name for the accessKey2 secret to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of the secrets exported to the provided Key Vault."
+                      }
+                    },
+                    "commitmentPlanType": {
+                      "type": "object",
+                      "properties": {
+                        "autoRenew": {
+                          "type": "bool",
+                          "metadata": {
+                            "description": "Required. Whether the plan should auto-renew at the end of the current commitment period."
+                          }
+                        },
+                        "current": {
+                          "type": "object",
+                          "properties": {
+                            "count": {
+                              "type": "int",
+                              "metadata": {
+                                "description": "Required. The number of committed instances (e.g., number of containers or cores)."
+                              }
+                            },
+                            "tier": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The tier of the commitment plan (e.g., T1, T2)."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The current commitment configuration."
+                          }
+                        },
+                        "hostingModel": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The hosting model for the commitment plan. (e.g., DisconnectedContainer, ConnectedContainer, ProvisionedWeb, Web)."
+                          }
+                        },
+                        "planType": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The plan type indicating which capability the plan applies to (e.g., NTTS, STT, CUSTOMSTT, ADDON)."
+                          }
+                        },
+                        "commitmentPlanGuid": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The unique identifier of an existing commitment plan to update. Set to null to create a new plan."
+                          }
+                        },
+                        "next": {
+                          "type": "object",
+                          "properties": {
+                            "count": {
+                              "type": "int",
+                              "metadata": {
+                                "description": "Required. The number of committed instances for the next period."
+                              }
+                            },
+                            "tier": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The tier for the next commitment period."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The configuration of the next commitment period, if scheduled."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a disconnected container commitment plan."
+                      }
+                    },
+                    "networkInjectionType": {
+                      "type": "object",
+                      "properties": {
+                        "scenario": {
+                          "type": "string",
+                          "allowedValues": [
+                            "agent",
+                            "none"
+                          ],
+                          "metadata": {
+                            "description": "Required. The scenario for the network injection."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The Resource ID of the subnet on the Virtual Network on which to inject."
+                          }
+                        },
+                        "useMicrosoftManagedNetwork": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether to use Microsoft Managed Network. Defaults to false."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Type for network configuration in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network."
+                      }
+                    },
+                    "_1.secretSetOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "secretResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resourceId of the exported secret."
+                          }
+                        },
+                        "secretUri": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI of the exported secret."
+                          }
+                        },
+                        "secretUriWithVersion": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI with version of the exported secret."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "_2.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_2.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_2.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_2.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_2.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "customerManagedKeyType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                          }
+                        },
+                        "keyName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the customer managed key to use for encryption."
+                          }
+                        },
+                        "keyVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, the deployment will use the latest version available at deployment time."
+                          }
+                        },
+                        "userAssignedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type does not support auto-rotation of the customer-managed key.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_2.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_2.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_2.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_2.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_2.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "secretsOutputType": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": {
+                        "$ref": "#/definitions/_1.secretSetOutputType",
+                        "metadata": {
+                          "description": "An exported secret's references."
+                        }
+                      },
+                      "metadata": {
+                        "description": "A map of the exported secrets",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of Cognitive Services account."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "allowedValues": [
+                        "AIServices",
+                        "AnomalyDetector",
+                        "CognitiveServices",
+                        "ComputerVision",
+                        "ContentModerator",
+                        "ContentSafety",
+                        "ConversationalLanguageUnderstanding",
+                        "CustomVision.Prediction",
+                        "CustomVision.Training",
+                        "Face",
+                        "FormRecognizer",
+                        "HealthInsights",
+                        "ImmersiveReader",
+                        "Internal.AllInOne",
+                        "LUIS",
+                        "LUIS.Authoring",
+                        "LanguageAuthoring",
+                        "MetricsAdvisor",
+                        "OpenAI",
+                        "Personalizer",
+                        "QnAMaker.v2",
+                        "SpeechServices",
+                        "TextAnalytics",
+                        "TextTranslation"
+                      ],
+                      "metadata": {
+                        "description": "Required. Kind of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+                      }
+                    },
+                    "sku": {
+                      "type": "string",
+                      "defaultValue": "S0",
+                      "allowedValues": [
+                        "C2",
+                        "C3",
+                        "C4",
+                        "F0",
+                        "F1",
+                        "S",
+                        "S0",
+                        "S1",
+                        "S10",
+                        "S2",
+                        "S3",
+                        "S4",
+                        "S5",
+                        "S6",
+                        "S7",
+                        "S8",
+                        "S9",
+                        "DC0"
+                      ],
+                      "metadata": {
+                        "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+                      }
+                    },
+                    "customSubDomainName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. Subdomain name used for token-based authentication. Required if 'networkAcls' or 'privateEndpoints' are set."
+                      }
+                    },
+                    "networkAcls": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A collection of rules governing the accessibility from specific network locations."
+                      }
+                    },
+                    "networkInjections": {
+                      "$ref": "#/definitions/networkInjectionType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Specifies in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "allowedFqdnList": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of allowed FQDN."
+                      }
+                    },
+                    "apiProperties": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The API properties for special APIs."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons."
+                      }
+                    },
+                    "customerManagedKey": {
+                      "$ref": "#/definitions/customerManagedKeyType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The customer managed key definition."
+                      }
+                    },
+                    "dynamicThrottlingEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. The flag to enable dynamic throttling."
+                      }
+                    },
+                    "migrationToken": {
+                      "type": "securestring",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Resource migration token."
+                      }
+                    },
+                    "restore": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Restore a soft-deleted cognitive service at deployment time. Will fail if no such soft-deleted resource exists."
+                      }
+                    },
+                    "restrictOutboundNetworkAccess": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Restrict outbound network access."
+                      }
+                    },
+                    "userOwnedStorage": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.CognitiveServices/accounts@2025-04-01-preview#properties/properties/properties/userOwnedStorage"
+                        },
+                        "description": "Optional. The storage accounts for this resource."
+                      },
+                      "nullable": true
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "deployments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/deploymentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of deployments about cognitive service accounts to create."
+                      }
+                    },
+                    "secretsExportConfiguration": {
+                      "$ref": "#/definitions/secretsExportConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                      }
+                    },
+                    "allowProjectManagement": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable project management feature for AI Foundry."
+                      }
+                    },
+                    "commitmentPlans": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/commitmentPlanType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Commitment plans to deploy for the cognitive services account."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]",
+                      "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]",
+                      "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]",
+                      "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]",
+                      "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]",
+                      "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]",
+                      "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]",
+                      "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]",
+                      "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]",
+                      "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]",
+                      "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]",
+                      "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]",
+                      "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]",
+                      "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]",
+                      "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]",
+                      "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]",
+                      "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]",
+                      "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]",
+                      "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
+                      "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]",
+                      "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]",
+                      "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]",
+                      "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]",
+                      "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
+                      "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    },
+                    "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                  },
+                  "resources": {
+                    "cMKKeyVault::cMKKey": {
+                      "condition": "[and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults/keys",
+                      "apiVersion": "2025-05-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.cognitiveservices-account.{0}.{1}', replace('0.14.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "cMKKeyVault": {
+                      "condition": "[and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2025-05-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                    },
+                    "cMKUserAssignedIdentity": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                      "apiVersion": "2025-01-31-preview",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                    },
+                    "cognitiveService": {
+                      "type": "Microsoft.CognitiveServices/accounts",
+                      "apiVersion": "2025-06-01",
+                      "name": "[parameters('name')]",
+                      "kind": "[parameters('kind')]",
+                      "identity": "[variables('identity')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('sku')]"
+                      },
+                      "properties": {
+                        "allowProjectManagement": "[parameters('allowProjectManagement')]",
+                        "customSubDomainName": "[parameters('customSubDomainName')]",
+                        "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
+                        "networkInjections": "[if(not(empty(parameters('networkInjections'))), createArray(createObject('scenario', tryGet(parameters('networkInjections'), 'scenario'), 'subnetArmId', tryGet(parameters('networkInjections'), 'subnetResourceId'), 'useMicrosoftManagedNetwork', coalesce(tryGet(parameters('networkInjections'), 'useMicrosoftManagedNetwork'), false()))), null())]",
+                        "publicNetworkAccess": "[if(not(equals(parameters('publicNetworkAccess'), null())), parameters('publicNetworkAccess'), if(not(empty(parameters('networkAcls'))), 'Enabled', 'Disabled'))]",
+                        "allowedFqdnList": "[parameters('allowedFqdnList')]",
+                        "apiProperties": "[parameters('apiProperties')]",
+                        "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                        "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keySource', 'Microsoft.KeyVault', 'keyVaultProperties', createObject('identityClientId', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyVaultUri', if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault').vaultUri, format('https://{0}.managedhsm.azure.net/', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')))), 'keyName', parameters('customerManagedKey').keyName, 'keyVersion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(not(variables('isHSMManagedCMK')), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/')), fail('Managed HSM CMK encryption requires specifying the ''keyVersion''.'))))), null())]",
+                        "migrationToken": "[parameters('migrationToken')]",
+                        "restore": "[parameters('restore')]",
+                        "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]",
+                        "userOwnedStorage": "[if(not(empty(parameters('userOwnedStorage'))), parameters('userOwnedStorage'), null())]",
+                        "dynamicThrottlingEnabled": "[parameters('dynamicThrottlingEnabled')]"
+                      },
+                      "dependsOn": [
+                        "cMKKeyVault",
+                        "cMKKeyVault::cMKKey",
+                        "cMKUserAssignedIdentity"
+                      ]
+                    },
+                    "cognitiveService_deployments": {
+                      "copy": {
+                        "name": "cognitiveService_deployments",
+                        "count": "[length(coalesce(parameters('deployments'), createArray()))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.CognitiveServices/accounts/deployments",
+                      "apiVersion": "2025-06-01",
+                      "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]",
+                      "properties": {
+                        "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]",
+                        "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]",
+                        "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]"
+                      },
+                      "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', tryGet(parameters('sku'), 'capacity'), 'tier', tryGet(parameters('sku'), 'tier'), 'size', tryGet(parameters('sku'), 'size'), 'family', tryGet(parameters('sku'), 'family')))]",
+                      "dependsOn": [
+                        "cognitiveService"
+                      ]
+                    },
+                    "cognitiveService_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "cognitiveService"
+                      ]
+                    },
+                    "cognitiveService_commitmentPlans": {
+                      "copy": {
+                        "name": "cognitiveService_commitmentPlans",
+                        "count": "[length(coalesce(parameters('commitmentPlans'), createArray()))]"
+                      },
+                      "type": "Microsoft.CognitiveServices/accounts/commitmentPlans",
+                      "apiVersion": "2025-06-01",
+                      "name": "[format('{0}/{1}', parameters('name'), format('{0}-{1}', coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].hostingModel, coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].planType))]",
+                      "properties": "[coalesce(parameters('commitmentPlans'), createArray())[copyIndex()]]",
+                      "dependsOn": [
+                        "cognitiveService"
+                      ]
+                    },
+                    "cognitiveService_diagnosticSettings": {
+                      "copy": {
+                        "name": "cognitiveService_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "cognitiveService"
+                      ]
+                    },
+                    "cognitiveService_roleAssignments": {
+                      "copy": {
+                        "name": "cognitiveService_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "cognitiveService"
+                      ]
+                    },
+                    "cognitiveService_privateEndpoints": {
+                      "copy": {
+                        "name": "cognitiveService_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.5.1644",
+                              "templateHash": "16604612898799598358"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private dns zone group."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a private DNS zone group configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                },
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              },
+                              "nullable": true
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                },
+                                "description": "Optional. Custom DNS configurations."
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-10-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "24141742673128945"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private DNS zone group configuration."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "privateDnsZoneConfigs",
+                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "properties": {
+                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                              }
+                                            }
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                  "output": true
+                                },
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "cognitiveService"
+                      ]
+                    },
+                    "secretsExport": {
+                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "keyVaultName": {
+                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                          },
+                          "secretsToSet": {
+                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('cognitiveService', '2025-06-01').key1)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('cognitiveService', '2025-06-01').key2)), createArray()))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "13968722110082077308"
+                            }
+                          },
+                          "definitions": {
+                            "secretSetOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "secretResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resourceId of the exported secret."
+                                  }
+                                },
+                                "secretUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI of the exported secret."
+                                  }
+                                },
+                                "secretUriWithVersion": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI with version of the exported secret."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "secretToSetType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the secret to set."
+                                  }
+                                },
+                                "value": {
+                                  "type": "securestring",
+                                  "metadata": {
+                                    "description": "Required. The value of the secret to set."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "keyVaultName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Key Vault to set the ecrets in."
+                              }
+                            },
+                            "secretsToSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretToSetType"
+                              },
+                              "metadata": {
+                                "description": "Required. The secrets to set in the Key Vault."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "keyVault": {
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('keyVaultName')]"
+                            },
+                            "secrets": {
+                              "copy": {
+                                "name": "secrets",
+                                "count": "[length(parameters('secretsToSet'))]"
+                              },
+                              "type": "Microsoft.KeyVault/vaults/secrets",
+                              "apiVersion": "2025-05-01",
+                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                              "properties": {
+                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "secretsSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretSetOutputType"
+                              },
+                              "metadata": {
+                                "description": "The references to the secrets exported to the provided Key Vault."
+                              },
+                              "copy": {
+                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                "input": {
+                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                                  "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "cognitiveService"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the cognitive services account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the cognitive services account."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the cognitive services account was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The service endpoint of the cognitive services account."
+                      },
+                      "value": "[reference('cognitiveService').endpoint]"
+                    },
+                    "endpoints": {
+                      "$ref": "#/definitions/endpointType",
+                      "metadata": {
+                        "description": "All endpoints available for the cognitive services account, types depends on the cognitive service kind."
+                      },
+                      "value": "[reference('cognitiveService').endpoints]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('cognitiveService', '2025-06-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('cognitiveService', '2025-06-01', 'full').location]"
+                    },
+                    "exportedSecrets": {
+                      "$ref": "#/definitions/secretsOutputType",
+                      "metadata": {
+                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                      },
+                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the congitive services account."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    },
+                    "primaryKey": {
+                      "type": "securestring",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The primary access key."
+                      },
+                      "value": "[if(not(parameters('disableLocalAuth')), listKeys('cognitiveService', '2025-06-01').key1, null())]"
+                    },
+                    "secondaryKey": {
+                      "type": "securestring",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The secondary access key."
+                      },
+                      "value": "[if(not(parameters('disableLocalAuth')), listKeys('cognitiveService', '2025-06-01').key2, null())]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Services account."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Services account."
+              },
+              "value": "[parameters('name')]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the AI Services account (OpenAI Language Model Instance API)."
+              },
+              "value": "[reference('aiServices').endpoints['OpenAI Language Model Instance API']]"
+            },
+            "cognitiveServicesEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the AI Services account (Cognitive Services)."
+              },
+              "value": "[reference('aiServices').endpoint]"
+            },
+            "azureOpenAiCuEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure OpenAI Content Understanding endpoint URL."
+              },
+              "value": "[reference('aiServices').endpoints['Content Understanding']]"
+            },
+            "principalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID of the AI Services account."
+              },
+              "value": "[reference('aiServices', '2025-12-01', 'full').identity.principalId]"
+            },
+            "projectResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Foundry project."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]"
+            },
+            "projectName": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Foundry project."
+              },
+              "value": "[parameters('projectName')]"
+            },
+            "projectEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "AI Foundry project endpoint."
+              },
+              "value": "[reference('aiProject').endpoints['AI Foundry API']]"
+            },
+            "projectIdentityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID of the project."
+              },
+              "value": "[reference('aiProject', '2025-12-01', 'full').identity.principalId]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "log_analytics"
+      ]
+    },
+    "foundry_search_connection": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64)]",
+      "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+      "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "aiServicesAccountName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference('ai_foundry_project').outputs.name.value))]",
+          "projectName": "[if(variables('useExistingAIProject'), if(greater(length(split(parameters('existingFoundryProjectResourceId'), '/')), 10), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[10]), createObject('value', '')), createObject('value', reference('ai_foundry_project').outputs.projectName.value))]",
+          "category": {
+            "value": "CognitiveSearch"
+          },
+          "target": {
+            "value": "[reference('ai_search').outputs.endpoint.value]"
+          },
+          "authType": {
+            "value": "AAD"
+          },
+          "metadata": {
+            "value": {
+              "ApiType": "Azure",
+              "ResourceId": "[reference('ai_search').outputs.resourceId.value]"
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "14116608463414189185"
+            }
+          },
+          "parameters": {
+            "aiServicesAccountName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the parent AI Services account."
+              }
+            },
+            "projectName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the AI Foundry project."
+              }
+            },
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Solution name suffix used to generate the connection name."
+              }
+            },
+            "connectionName": {
+              "type": "string",
+              "defaultValue": "[toLower(format('{0}-connection-{1}', parameters('category'), parameters('solutionName')))]",
+              "metadata": {
+                "description": "Optional. Connection name. Defaults to lowercase category with solution suffix."
+              }
+            },
+            "category": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Connection category (e.g., CognitiveSearch, AzureBlob, AppInsights, RemoteTool)."
+              }
+            },
+            "target": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Connection target (URL or resource ID)."
+              }
+            },
+            "authType": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Authentication type (e.g., AAD, ApiKey, ProjectManagedIdentity)."
+              }
+            },
+            "isSharedToAll": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Whether the connection is shared to all project users."
+              }
+            },
+            "isDefault": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether this is the default connection for its category."
+              }
+            },
+            "metadata": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Connection metadata object."
+              }
+            },
+            "useWorkspaceManagedIdentity": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to use workspace-managed identity for authentication."
+              }
+            },
+            "credentialsKey": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Credentials key (for ApiKey auth type)."
+              }
+            }
+          },
+          "variables": {
+            "baseProperties": {
+              "category": "[parameters('category')]",
+              "target": "[parameters('target')]",
+              "authType": "[parameters('authType')]",
+              "isSharedToAll": "[parameters('isSharedToAll')]",
+              "metadata": "[parameters('metadata')]",
+              "useWorkspaceManagedIdentity": "[parameters('useWorkspaceManagedIdentity')]"
+            },
+            "optionalDefault": "[if(parameters('isDefault'), createObject('isDefault', true()), createObject())]",
+            "optionalCredentials": "[if(not(empty(parameters('credentialsKey'))), createObject('credentials', createObject('key', parameters('credentialsKey'))), createObject())]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.CognitiveServices/accounts/projects/connections",
+              "apiVersion": "2025-12-01",
+              "name": "[format('{0}/{1}/{2}', parameters('aiServicesAccountName'), parameters('projectName'), parameters('connectionName'))]",
+              "properties": "[union(variables('baseProperties'), variables('optionalDefault'), variables('optionalCredentials'))]"
+            }
+          ],
+          "outputs": {
+            "connectionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Connection name."
+              },
+              "value": "[parameters('connectionName')]"
+            },
+            "connectionId": {
+              "type": "string",
+              "metadata": {
+                "description": "Connection resource ID."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects/connections', parameters('aiServicesAccountName'), parameters('projectName'), parameters('connectionName'))]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "ai_foundry_project",
+        "ai_search"
+      ]
+    },
+    "model_deployments": {
+      "copy": {
+        "name": "model_deployments",
+        "count": "[length(variables('aiModelDeployments'))]",
+        "mode": "serial",
+        "batchSize": 1
+      },
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.model-deployment-{0}.{1}', copyIndex(), parameters('solutionName')), 64)]",
+      "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+      "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "aiServicesAccountName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference('ai_foundry_project').outputs.name.value))]",
+          "deploymentName": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].name]"
+          },
+          "modelName": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].model]"
+          },
+          "modelVersion": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].version]"
+          },
+          "raiPolicyName": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].raiPolicyName]"
+          },
+          "skuName": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].sku.name]"
+          },
+          "skuCapacity": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].sku.capacity]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "5315493943580072668"
+            }
+          },
+          "parameters": {
+            "aiServicesAccountName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the parent AI Services account."
+              }
+            },
+            "deploymentName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name for this model deployment."
+              }
+            },
+            "modelFormat": {
+              "type": "string",
+              "defaultValue": "OpenAI",
+              "metadata": {
+                "description": "Optional. Model format (e.g., OpenAI)."
+              }
+            },
+            "modelName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Model name (e.g., gpt-4o, text-embedding-ada-002)."
+              }
+            },
+            "modelVersion": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Model version. Empty string means latest."
+              }
+            },
+            "raiPolicyName": {
+              "type": "string",
+              "defaultValue": "Microsoft.Default",
+              "metadata": {
+                "description": "Optional. RAI policy name."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. SKU name (e.g., Standard, GlobalStandard)."
+              }
+            },
+            "skuCapacity": {
+              "type": "int",
+              "metadata": {
+                "description": "Required. SKU capacity (tokens per minute in thousands)."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.CognitiveServices/accounts/deployments",
+              "apiVersion": "2025-12-01",
+              "name": "[format('{0}/{1}', parameters('aiServicesAccountName'), parameters('deploymentName'))]",
+              "properties": {
+                "model": {
+                  "format": "[parameters('modelFormat')]",
+                  "name": "[parameters('modelName')]",
+                  "version": "[if(not(empty(parameters('modelVersion'))), parameters('modelVersion'), null())]"
+                },
+                "raiPolicyName": "[parameters('raiPolicyName')]"
+              },
+              "sku": {
+                "name": "[parameters('skuName')]",
+                "capacity": "[parameters('skuCapacity')]"
+              }
+            }
+          ],
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the deployed model."
+              },
+              "value": "[parameters('deploymentName')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the model deployment."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts/deployments', parameters('aiServicesAccountName'), parameters('deploymentName'))]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "ai_foundry_project"
+      ]
+    },
+    "aifoundry_private_endpoint": {
+      "condition": "[and(not(variables('useExistingAIProject')), parameters('enablePrivateNetworking'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.pe-ai-foundry.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[format('pep-aif-{0}', variables('solutionSuffix'))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "subnetResourceId": {
+            "value": "[reference('virtualNetwork').outputs.backendSubnetResourceId.value]"
+          },
+          "customNetworkInterfaceName": {
+            "value": "[format('nic-aif-{0}', variables('solutionSuffix'))]"
+          },
+          "privateLinkServiceConnections": {
+            "value": [
+              {
+                "name": "[format('pep-aif-{0}-connection', variables('solutionSuffix'))]",
+                "properties": {
+                  "privateLinkServiceId": "[reference('ai_foundry_project').outputs.resourceId.value]",
+                  "groupIds": [
+                    "account"
+                  ]
+                }
+              }
+            ]
+          },
+          "privateDnsZoneGroup": {
+            "value": {
+              "privateDnsZoneGroupConfigs": [
+                {
+                  "name": "ai-services-dns-zone-cognitiveservices",
+                  "privateDnsZoneResourceId": "[reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').cognitiveServices)).outputs.resourceId.value]"
+                },
+                {
+                  "name": "ai-services-dns-zone-openai",
+                  "privateDnsZoneResourceId": "[reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').openAI)).outputs.resourceId.value]"
+                },
+                {
+                  "name": "ai-services-dns-zone-aiservices",
+                  "privateDnsZoneResourceId": "[reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').aiServices)).outputs.resourceId.value]"
+                }
+              ]
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "14933983914799613850"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the private endpoint."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "customNetworkInterfaceName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Custom NIC name for the private endpoint."
+              }
+            },
+            "subnetResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the subnet for the private endpoint."
+              }
+            },
+            "privateLinkServiceConnections": {
+              "type": "array",
+              "metadata": {
+                "description": "Private link service connections configuration."
+              }
+            },
+            "privateDnsZoneGroup": {
+              "type": "object",
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Private DNS zone group configuration."
+              }
+            }
+          },
+          "resources": {
+            "privateEndpoint": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.network.private-endpoint.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "customNetworkInterfaceName": "[if(not(empty(parameters('customNetworkInterfaceName'))), createObject('value', parameters('customNetworkInterfaceName')), createObject('value', format('nic-{0}', parameters('name'))))]",
+                  "subnetResourceId": {
+                    "value": "[parameters('subnetResourceId')]"
+                  },
+                  "privateLinkServiceConnections": {
+                    "value": "[parameters('privateLinkServiceConnections')]"
+                  },
+                  "privateDnsZoneGroup": {
+                    "value": "[parameters('privateDnsZoneGroup')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.41.2.15936",
+                      "templateHash": "18436885663402767850"
+                    },
+                    "name": "Private Endpoints",
+                    "description": "This module deploys a Private Endpoint."
+                  },
+                  "definitions": {
+                    "privateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a private dns zone group."
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "privateDnsZoneGroupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private DNS zone group config."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource id of the private DNS zone."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a private DNS zone group configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the private endpoint resource to create."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                      }
+                    },
+                    "applicationSecurityGroupResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                      }
+                    },
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                      }
+                    },
+                    "ipConfigurations": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                        },
+                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                      },
+                      "nullable": true
+                    },
+                    "ipVersionType": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                        },
+                        "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                      },
+                      "defaultValue": "IPv4"
+                    },
+                    "privateDnsZoneGroup": {
+                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                        },
+                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                      },
+                      "nullable": true
+                    },
+                    "customDnsConfigs": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                        },
+                        "description": "Optional. Custom DNS configurations."
+                      },
+                      "nullable": true
+                    },
+                    "manualPrivateLinkServiceConnections": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                        },
+                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                      },
+                      "nullable": true
+                    },
+                    "privateLinkServiceConnections": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                        },
+                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "privateEndpoint": {
+                      "type": "Microsoft.Network/privateEndpoints",
+                      "apiVersion": "2025-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "applicationSecurityGroups",
+                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                            "input": {
+                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                            }
+                          }
+                        ],
+                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                        "subnet": {
+                          "id": "[parameters('subnetResourceId')]"
+                        },
+                        "ipVersionType": "[parameters('ipVersionType')]"
+                      }
+                    },
+                    "privateEndpoint_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_roleAssignments": {
+                      "copy": {
+                        "name": "privateEndpoint_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    },
+                    "privateEndpoint_privateDnsZoneGroup": {
+                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                          },
+                          "privateEndpointName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "privateDnsZoneConfigs": {
+                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "9935179114830442414"
+                            },
+                            "name": "Private Endpoint Private DNS Zone Groups",
+                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private DNS zone group configuration."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "privateEndpointName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "privateDnsZoneConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                              },
+                              "minLength": 1,
+                              "maxLength": 5,
+                              "metadata": {
+                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the private DNS zone group."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "privateEndpoint": {
+                              "existing": true,
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('privateEndpointName')]"
+                            },
+                            "privateDnsZoneGroup": {
+                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                              "apiVersion": "2025-05-01",
+                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "privateDnsZoneConfigs",
+                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                    "input": {
+                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                      "properties": {
+                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                      }
+                                    }
+                                  }
+                                ]
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint DNS zone group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint DNS zone group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "privateEndpoint"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the private endpoint was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the private endpoint."
+                      },
+                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the private endpoint."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                    },
+                    "customDnsConfigs": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                          "output": true
+                        },
+                        "description": "The custom DNS configurations of the private endpoint."
+                      },
+                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                    },
+                    "networkInterfaceResourceIds": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "metadata": {
+                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                      },
+                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                    },
+                    "groupId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The group Id for the private endpoint Group."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the private endpoint."
+              },
+              "value": "[reference('privateEndpoint').outputs.name.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "ai_foundry_project",
+        "foundry_search_connection",
+        "model_deployments",
+        "privateDnsZoneDeployments",
+        "virtualNetwork"
+      ]
+    },
+    "ai_search": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.ai-search.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "skuName": {
+            "value": "standard"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "publicNetworkAccess": {
+            "value": "Enabled"
+          },
+          "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+          "roleAssignments": {
+            "value": [
+              {
+                "roleDefinitionIdOrName": "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
+                "principalId": "[variables('deployingUserPrincipalId')]",
+                "principalType": "[parameters('deployingUserPrincipalType')]"
+              },
+              {
+                "roleDefinitionIdOrName": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
+                "principalId": "[variables('deployingUserPrincipalId')]",
+                "principalType": "[parameters('deployingUserPrincipalType')]"
+              }
+            ]
+          },
+          "privateEndpoints": {
+            "value": []
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "8867387679090698118"
+            }
+          },
+          "definitions": {
+            "_1.lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointSingleServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private Endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the Private Endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/_1.lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "minLength": 3,
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('srch-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the search service. Defaults to srch-{solutionName}."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "basic",
+              "allowedValues": [
+                "free",
+                "basic",
+                "standard",
+                "standard2",
+                "standard3",
+                "storage_optimized_l1",
+                "storage_optimized_l2"
+              ],
+              "metadata": {
+                "description": "SKU name for the search service."
+              }
+            },
+            "replicaCount": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Number of replicas."
+              }
+            },
+            "partitionCount": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Number of partitions."
+              }
+            },
+            "hostingMode": {
+              "type": "string",
+              "defaultValue": "Default",
+              "allowedValues": [
+                "Default",
+                "HighDensity"
+              ],
+              "metadata": {
+                "description": "Hosting mode."
+              }
+            },
+            "semanticSearch": {
+              "type": "string",
+              "defaultValue": "free",
+              "allowedValues": [
+                "disabled",
+                "free",
+                "standard"
+              ],
+              "metadata": {
+                "description": "Semantic search tier."
+              }
+            },
+            "disableLocalAuth": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Whether to disable local authentication."
+              }
+            },
+            "authOptions": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Authentication options for the search service (e.g., aadOrApiKey)."
+              }
+            },
+            "networkRuleSet": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Network rule set for the search service (e.g., bypass: AzureServices)."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Diagnostic settings for monitoring."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointSingleServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Array of role assignments to create on the AI Search service."
+              }
+            }
+          },
+          "resources": {
+            "searchService": {
+              "type": "Microsoft.Search/searchServices",
+              "apiVersion": "2025-05-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "sku": {
+                "name": "[parameters('skuName')]"
+              }
+            },
+            "searchServiceUpdate": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.search.update.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "sku": {
+                    "value": "[parameters('skuName')]"
+                  },
+                  "replicaCount": {
+                    "value": "[parameters('replicaCount')]"
+                  },
+                  "partitionCount": {
+                    "value": "[parameters('partitionCount')]"
+                  },
+                  "hostingMode": {
+                    "value": "[parameters('hostingMode')]"
+                  },
+                  "semanticSearch": {
+                    "value": "[parameters('semanticSearch')]"
+                  },
+                  "authOptions": "[if(not(empty(parameters('authOptions'))), createObject('value', parameters('authOptions')), createObject('value', null()))]",
+                  "disableLocalAuth": {
+                    "value": "[parameters('disableLocalAuth')]"
+                  },
+                  "networkRuleSet": "[if(not(empty(parameters('networkRuleSet'))), createObject('value', parameters('networkRuleSet')), createObject('value', null()))]",
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]",
+                  "privateEndpoints": {
+                    "value": "[parameters('privateEndpoints')]"
+                  },
+                  "roleAssignments": "[if(not(empty(parameters('roleAssignments'))), createObject('value', parameters('roleAssignments')), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.39.26.7824",
+                      "templateHash": "6207719545398489494"
+                    },
+                    "name": "Search Services",
+                    "description": "This module deploys a Search Service."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "secretsExportConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The key vault name where to store the API Admin keys generated by the modules."
+                          }
+                        },
+                        "primaryAdminKeyName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The primaryAdminKey secret name to create."
+                          }
+                        },
+                        "secondaryAdminKeyName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The secondaryAdminKey secret name to create."
+                          }
+                        }
+                      }
+                    },
+                    "secretsOutputType": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": {
+                        "$ref": "#/definitions/secretSetType",
+                        "metadata": {
+                          "description": "An exported secret's references."
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "secretSetType": {
+                      "type": "object",
+                      "properties": {
+                        "secretResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resourceId of the exported secret."
+                          }
+                        },
+                        "secretUri": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI of the exported secret."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "modules/keyVaultExport.bicep"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the Azure Cognitive Search service to create or update. Search service names must only contain lowercase letters, digits or dashes, cannot use dash as the first two or last one characters, cannot contain consecutive dashes, and must be between 2 and 60 characters in length. Search service names must be globally unique since they are part of the service URI (https://<name>.search.windows.net). You cannot change the service name after the service is created."
+                      }
+                    },
+                    "authOptions": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Search/searchServices@2025-05-01#properties/properties/properties/authOptions"
+                        },
+                        "description": "Optional. Defines the options for how the data plane API of a Search service authenticates requests. Must remain an empty object {} if 'disableLocalAuth' is set to true."
+                      },
+                      "nullable": true
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. When set to true, calls to the search service will not be permitted to utilize API keys for authentication. This cannot be set to true if 'authOptions' are defined."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "computeType": {
+                      "type": "string",
+                      "defaultValue": "Default",
+                      "allowedValues": [
+                        "Confidential",
+                        "Default"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The compute type of the search service."
+                      }
+                    },
+                    "cmkEnforcement": {
+                      "type": "string",
+                      "defaultValue": "Unspecified",
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled",
+                        "Unspecified"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Describes a policy that determines how resources within the search service are to be encrypted with Customer Managed Keys."
+                      }
+                    },
+                    "dataExfiltrationProtections": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "allowedValues": [
+                        "All"
+                      ],
+                      "metadata": {
+                        "description": "Optional. A list of data exfiltration scenarios that are explicitly disallowed for the search service. Currently, the only supported value is 'All' to disable all possible data export scenarios with more fine grained controls planned for the future."
+                      }
+                    },
+                    "hostingMode": {
+                      "type": "string",
+                      "defaultValue": "Default",
+                      "allowedValues": [
+                        "Default",
+                        "HighDensity"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Applicable only for the standard3 SKU. You can set this property to enable up to 3 high density partitions that allow up to 1000 indexes, which is much higher than the maximum indexes allowed for any other SKU. For the standard3 SKU, the value is either 'default' or 'highDensity'. For all other SKUs, this value must be 'default'."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings for all Resources in the solution."
+                      }
+                    },
+                    "networkRuleSet": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Search/searchServices@2025-05-01#properties/properties/properties/networkRuleSet"
+                        },
+                        "description": "Optional. Network specific rules that determine how the Azure Cognitive Search service may be reached."
+                      },
+                      "nullable": true
+                    },
+                    "partitionCount": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "minValue": 1,
+                      "maxValue": 12,
+                      "metadata": {
+                        "description": "Optional. The number of partitions in the search service; if specified, it can be 1, 2, 3, 4, 6, or 12. Values greater than 1 are only valid for standard SKUs. For 'standard3' services with hostingMode set to 'highDensity', the allowed values are between 1 and 3."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "sharedPrivateLinkResources": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. The sharedPrivateLinkResources to create as part of the search Service."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. This value can be set to 'Enabled' to avoid breaking changes on existing customer resources and templates. If set to 'Disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method."
+                      }
+                    },
+                    "secretsExportConfiguration": {
+                      "$ref": "#/definitions/secretsExportConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                      }
+                    },
+                    "replicaCount": {
+                      "type": "int",
+                      "defaultValue": 3,
+                      "minValue": 1,
+                      "maxValue": 12,
+                      "metadata": {
+                        "description": "Optional. The number of replicas in the search service. If specified, it must be a value between 1 and 12 inclusive for standard SKUs or between 1 and 3 inclusive for basic SKU."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "semanticSearch": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "disabled",
+                        "free",
+                        "standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Sets options that control the availability of semantic search. This configuration is only possible for certain search SKUs in certain locations."
+                      }
+                    },
+                    "sku": {
+                      "type": "string",
+                      "defaultValue": "standard",
+                      "allowedValues": [
+                        "basic",
+                        "free",
+                        "standard",
+                        "standard2",
+                        "standard3",
+                        "storage_optimized_l1",
+                        "storage_optimized_l2"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Defines the SKU of an Azure Cognitive Search Service, which determines price tier and capacity limits."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Search/searchServices@2025-05-01#properties/tags"
+                        },
+                        "description": "Optional. Tags to help categorize the resource in the Azure portal."
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', '')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "Search Index Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]",
+                      "Search Index Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1407120a-92aa-4202-b7e9-c0e197c71c8f')]",
+                      "Search Service Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.search-searchservice.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "searchService": {
+                      "type": "Microsoft.Search/searchServices",
+                      "apiVersion": "2025-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "sku": {
+                        "name": "[parameters('sku')]"
+                      },
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "authOptions": "[parameters('authOptions')]",
+                        "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                        "encryptionWithCmk": {
+                          "enforcement": "[parameters('cmkEnforcement')]"
+                        },
+                        "hostingMode": "[parameters('hostingMode')]",
+                        "networkRuleSet": "[parameters('networkRuleSet')]",
+                        "partitionCount": "[parameters('partitionCount')]",
+                        "replicaCount": "[parameters('replicaCount')]",
+                        "publicNetworkAccess": "[toLower(parameters('publicNetworkAccess'))]",
+                        "semanticSearch": "[parameters('semanticSearch')]",
+                        "computeType": "[parameters('computeType')]",
+                        "dataExfiltrationProtections": "[parameters('dataExfiltrationProtections')]"
+                      }
+                    },
+                    "searchService_diagnosticSettings": {
+                      "copy": {
+                        "name": "searchService_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "searchService"
+                      ]
+                    },
+                    "searchService_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "searchService"
+                      ]
+                    },
+                    "searchService_roleAssignments": {
+                      "copy": {
+                        "name": "searchService_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Search/searchServices', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "searchService"
+                      ]
+                    },
+                    "searchService_privateEndpoints": {
+                      "copy": {
+                        "name": "searchService_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-searchService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.5.1644",
+                              "templateHash": "16604612898799598358"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private dns zone group."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a private DNS zone group configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                },
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              },
+                              "nullable": true
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                },
+                                "description": "Optional. Custom DNS configurations."
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-10-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "24141742673128945"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private DNS zone group configuration."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "privateDnsZoneConfigs",
+                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "properties": {
+                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                              }
+                                            }
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                  "output": true
+                                },
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "searchService"
+                      ]
+                    },
+                    "searchService_sharedPrivateLinkResources": {
+                      "copy": {
+                        "name": "searchService_sharedPrivateLinkResources",
+                        "count": "[length(parameters('sharedPrivateLinkResources'))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-searchService-SharedPrvLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'name'), format('spl-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), parameters('sharedPrivateLinkResources')[copyIndex()].groupId, copyIndex()))]"
+                          },
+                          "searchServiceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "privateLinkResourceId": {
+                            "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].privateLinkResourceId]"
+                          },
+                          "groupId": {
+                            "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].groupId]"
+                          },
+                          "requestMessage": {
+                            "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].requestMessage]"
+                          },
+                          "resourceRegion": {
+                            "value": "[tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'resourceRegion')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "2115224445601868607"
+                            },
+                            "name": "Search Services Private Link Resources",
+                            "description": "This module deploys a Search Service Private Link Resource."
+                          },
+                          "parameters": {
+                            "searchServiceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent searchServices. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the shared private link resource managed by the Azure Cognitive Search service within the specified resource group."
+                              }
+                            },
+                            "privateLinkResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the resource the shared private link resource is for."
+                              }
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The group ID from the provider of resource the shared private link resource is for."
+                              }
+                            },
+                            "requestMessage": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The request message for requesting approval of the shared private link resource."
+                              }
+                            },
+                            "resourceRegion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Can be used to specify the Azure Resource Manager location of the resource to which a shared private link is to be created. This is only required for those resources whose DNS configuration are regional (such as Azure Kubernetes Service)."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "searchService": {
+                              "existing": true,
+                              "type": "Microsoft.Search/searchServices",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('searchServiceName')]"
+                            },
+                            "sharedPrivateLinkResource": {
+                              "type": "Microsoft.Search/searchServices/sharedPrivateLinkResources",
+                              "apiVersion": "2025-05-01",
+                              "name": "[format('{0}/{1}', parameters('searchServiceName'), parameters('name'))]",
+                              "properties": {
+                                "privateLinkResourceId": "[parameters('privateLinkResourceId')]",
+                                "groupId": "[parameters('groupId')]",
+                                "requestMessage": "[parameters('requestMessage')]",
+                                "resourceRegion": "[parameters('resourceRegion')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the shared private link resource."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the shared private link resource."
+                              },
+                              "value": "[resourceId('Microsoft.Search/searchServices/sharedPrivateLinkResources', parameters('searchServiceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the shared private link resource was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "searchService"
+                      ]
+                    },
+                    "secretsExport": {
+                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "keyVaultName": {
+                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                          },
+                          "secretsToSet": {
+                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-05-01').primaryKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-05-01').secondaryKey)), createArray()))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "696453183181258843"
+                            }
+                          },
+                          "definitions": {
+                            "secretSetType": {
+                              "type": "object",
+                              "properties": {
+                                "secretResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resourceId of the exported secret."
+                                  }
+                                },
+                                "secretUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI of the exported secret."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "secretToSetType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the secret to set."
+                                  }
+                                },
+                                "value": {
+                                  "type": "securestring",
+                                  "metadata": {
+                                    "description": "Required. The value of the secret to set."
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "keyVaultName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Key Vault to set the ecrets in."
+                              }
+                            },
+                            "secretsToSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretToSetType"
+                              },
+                              "metadata": {
+                                "description": "Required. The secrets to set in the Key Vault."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "keyVault": {
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('keyVaultName')]"
+                            },
+                            "secrets": {
+                              "copy": {
+                                "name": "secrets",
+                                "count": "[length(parameters('secretsToSet'))]"
+                              },
+                              "type": "Microsoft.KeyVault/vaults/secrets",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                              "properties": {
+                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "secretsSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretSetType"
+                              },
+                              "metadata": {
+                                "description": "The references to the secrets exported to the provided Key Vault."
+                              },
+                              "copy": {
+                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                "input": {
+                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "searchService"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the search service."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the search service."
+                      },
+                      "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the search service was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('searchService', '2025-05-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('searchService', '2025-05-01', 'full').location]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The endpoint of the search service."
+                      },
+                      "value": "[reference('searchService').endpoint]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the search service."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    },
+                    "exportedSecrets": {
+                      "$ref": "#/definitions/secretsOutputType",
+                      "metadata": {
+                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                      },
+                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                    },
+                    "primaryKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary admin API key of the search service."
+                      },
+                      "value": "[listAdminKeys('searchService', '2025-05-01').primaryKey]"
+                    },
+                    "secondaryKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondaryKey admin API key of the search service."
+                      },
+                      "value": "[listAdminKeys('searchService', '2025-05-01').secondaryKey]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "searchService"
+              ]
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Search service."
+              },
+              "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Search service."
+              },
+              "value": "[parameters('name')]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint URL of the AI Search service."
+              },
+              "value": "[format('https://{0}.search.windows.net', parameters('name'))]"
+            },
+            "identityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID."
+              },
+              "value": "[coalesce(tryGet(tryGet(reference('searchServiceUpdate').outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "log_analytics"
+      ]
+    },
+    "storage_account": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.storage-account.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableHierarchicalNamespace": {
+            "value": true
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+          "containers": {
+            "value": [
+              {
+                "name": "data",
+                "publicAccess": "None"
+              }
+            ]
+          },
+          "roleAssignments": {
+            "value": [
+              {
+                "roleDefinitionIdOrName": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
+                "principalId": "[variables('deployingUserPrincipalId')]",
+                "principalType": "[parameters('deployingUserPrincipalType')]"
+              }
+            ]
+          },
+          "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-blob-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-blob-{0}', variables('solutionSuffix')), 'service', 'blob', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageBlob)).outputs.resourceId.value)))), createObject('name', format('pep-queue-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-queue-{0}', variables('solutionSuffix')), 'service', 'queue', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageQueue)).outputs.resourceId.value)))), createObject('name', format('pep-file-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-file-{0}', variables('solutionSuffix')), 'service', 'file', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageFile)).outputs.resourceId.value)))), createObject('name', format('pep-dfs-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-dfs-{0}', variables('solutionSuffix')), 'service', 'dfs', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageDfs)).outputs.resourceId.value)))))), createObject('value', createArray()))]",
+          "networkAcls": {
+            "value": {
+              "bypass": "AzureServices, Logging, Metrics",
+              "defaultAction": "[if(parameters('enablePrivateNetworking'), 'Deny', 'Allow')]",
+              "virtualNetworkRules": []
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "13916396394410274337"
+            }
+          },
+          "definitions": {
+            "_1.lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointSingleServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private Endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the Private Endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/_1.lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[take(format('st{0}', toLower(replace(parameters('solutionName'), '-', ''))), 24)]",
+              "metadata": {
+                "description": "Name of the storage account."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "Standard_LRS",
+              "metadata": {
+                "description": "Storage account SKU."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "StorageV2",
+              "metadata": {
+                "description": "Storage account kind."
+              }
+            },
+            "accessTier": {
+              "type": "string",
+              "defaultValue": "Hot",
+              "allowedValues": [
+                "Hot",
+                "Cool"
+              ],
+              "metadata": {
+                "description": "Access tier."
+              }
+            },
+            "allowBlobPublicAccess": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Allow blob public access."
+              }
+            },
+            "allowSharedKeyAccess": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Allow shared key access."
+              }
+            },
+            "enableHierarchicalNamespace": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable hierarchical namespace (Data Lake Storage Gen2)."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "containers": {
+              "type": "array",
+              "defaultValue": [
+                {
+                  "name": "default",
+                  "publicAccess": "None"
+                }
+              ],
+              "metadata": {
+                "description": "Blob containers to create."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Diagnostic settings for monitoring."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "networkAcls": {
+              "type": "object",
+              "defaultValue": {
+                "defaultAction": "Allow",
+                "bypass": "AzureServices"
+              },
+              "metadata": {
+                "description": "Network ACLs for the storage account."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointSingleServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "roleAssignments": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Optional. Array of role assignments to create on the Storage Account."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "resources": {
+            "storage": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.storage.storage-account.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "skuName": {
+                    "value": "[parameters('skuName')]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "accessTier": {
+                    "value": "[parameters('accessTier')]"
+                  },
+                  "allowBlobPublicAccess": {
+                    "value": "[parameters('allowBlobPublicAccess')]"
+                  },
+                  "allowSharedKeyAccess": {
+                    "value": "[parameters('allowSharedKeyAccess')]"
+                  },
+                  "enableHierarchicalNamespace": {
+                    "value": "[parameters('enableHierarchicalNamespace')]"
+                  },
+                  "minimumTlsVersion": {
+                    "value": "TLS1_2"
+                  },
+                  "supportsHttpsTrafficOnly": {
+                    "value": true
+                  },
+                  "requireInfrastructureEncryption": {
+                    "value": true
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "networkAcls": {
+                    "value": "[parameters('networkAcls')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "blobServices": {
+                    "value": {
+                      "copy": [
+                        {
+                          "name": "containers",
+                          "count": "[length(parameters('containers'))]",
+                          "input": {
+                            "name": "[parameters('containers')[copyIndex('containers')].name]",
+                            "publicAccess": "[parameters('containers')[copyIndex('containers')].publicAccess]"
+                          }
+                        }
+                      ],
+                      "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), parameters('diagnosticSettings'), createArray())]"
+                    }
+                  },
+                  "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]",
+                  "privateEndpoints": {
+                    "value": "[parameters('privateEndpoints')]"
+                  },
+                  "roleAssignments": "[if(not(empty(parameters('roleAssignments'))), createObject('value', parameters('roleAssignments')), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.41.2.15936",
+                      "templateHash": "1254456195180100771"
+                    },
+                    "name": "Storage Accounts",
+                    "description": "This module deploys a Storage Account."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the private endpoints output."
+                      }
+                    },
+                    "networkAclsType": {
+                      "type": "object",
+                      "properties": {
+                        "resourceAccessRules": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "tenantId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The ID of the tenant in which the resource resides in."
+                                }
+                              },
+                              "resourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only."
+                          }
+                        },
+                        "bypass": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureServices",
+                            "AzureServices, Logging",
+                            "AzureServices, Logging, Metrics",
+                            "AzureServices, Metrics",
+                            "Logging",
+                            "Logging, Metrics",
+                            "Metrics",
+                            "None"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics."
+                          }
+                        },
+                        "virtualNetworkRules": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Sets the virtual network rules."
+                          }
+                        },
+                        "ipRules": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Sets the IP ACL rules."
+                          }
+                        },
+                        "defaultAction": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Allow",
+                            "Deny"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the default action of allow or deny when no other rules match."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the network configuration."
+                      }
+                    },
+                    "secretsExportConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
+                          }
+                        },
+                        "accessKey1Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The accessKey1 secret name to create."
+                          }
+                        },
+                        "connectionString1Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The connectionString1 secret name to create."
+                          }
+                        },
+                        "accessKey2Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The accessKey2 secret name to create."
+                          }
+                        },
+                        "connectionString2Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The connectionString2 secret name to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of the exported secrets."
+                      }
+                    },
+                    "localUserType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the local user used for SFTP Authentication."
+                          }
+                        },
+                        "hasSharedKey": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
+                          }
+                        },
+                        "hasSshKey": {
+                          "type": "bool",
+                          "metadata": {
+                            "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                          }
+                        },
+                        "hasSshPassword": {
+                          "type": "bool",
+                          "metadata": {
+                            "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                          }
+                        },
+                        "homeDirectory": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The local user home directory."
+                          }
+                        },
+                        "permissionScopes": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/permissionScopeType"
+                          },
+                          "metadata": {
+                            "description": "Required. The permission scopes of the local user."
+                          }
+                        },
+                        "sshAuthorizedKeys": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/sshAuthorizedKeyType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The local user SSH authorized keys for SFTP."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a local user."
+                      }
+                    },
+                    "blobServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "automaticSnapshotPolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Automatic Snapshot is enabled if set to true."
+                          }
+                        },
+                        "changeFeedEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                          }
+                        },
+                        "changeFeedRetentionInDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 146000,
+                          "metadata": {
+                            "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
+                          }
+                        },
+                        "containerDeleteRetentionPolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                          }
+                        },
+                        "containerDeleteRetentionPolicyDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 365,
+                          "metadata": {
+                            "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                          }
+                        },
+                        "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                          }
+                        },
+                        "corsRules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/blobCorsRuleType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                          }
+                        },
+                        "defaultServiceVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
+                          }
+                        },
+                        "deleteRetentionPolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service properties for blob soft delete."
+                          }
+                        },
+                        "deleteRetentionPolicyDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 365,
+                          "metadata": {
+                            "description": "Optional. Indicates the number of days that the deleted blob should be retained."
+                          }
+                        },
+                        "deleteRetentionPolicyAllowPermanentDelete": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                          }
+                        },
+                        "isVersioningEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
+                          }
+                        },
+                        "versionDeletePolicyDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Number of days to keep a version before deleting. If set, a lifecycle management policy will be created to handle deleting previous versions."
+                          }
+                        },
+                        "lastAccessTimeTrackingPolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                          }
+                        },
+                        "restorePolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                          }
+                        },
+                        "restorePolicyDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "metadata": {
+                            "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                          }
+                        },
+                        "containers": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/containerType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Blob containers to create."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the service."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a blob service."
+                      }
+                    },
+                    "fileServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "protocolSettings": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings"
+                            },
+                            "description": "Optional. Protocol settings for file service."
+                          },
+                          "nullable": true
+                        },
+                        "shareDeleteRetentionPolicy": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy"
+                            },
+                            "description": "Optional. The service properties for soft delete."
+                          },
+                          "nullable": true
+                        },
+                        "shares": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/fileShareType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. File shares to create."
+                          }
+                        },
+                        "corsRules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/fileCorsRuleType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the service."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a file service."
+                      }
+                    },
+                    "queueServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "queues": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/queueType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Queues to create."
+                          }
+                        },
+                        "corsRules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/queueCorsRuleType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the service."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a queue service."
+                      }
+                    },
+                    "tableServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "tables": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/tableType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tables to create."
+                          }
+                        },
+                        "corsRules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/tableCorsRuleType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the service."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a table service."
+                      }
+                    },
+                    "objectReplicationPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the object replication policy. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "destinationStorageAccountResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the destination storage account."
+                          }
+                        },
+                        "enableMetrics": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Indicates whether metrics are enabled for the object replication policy."
+                          }
+                        },
+                        "rules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/objectReplicationPolicyRuleType"
+                          },
+                          "metadata": {
+                            "description": "Required. The storage account object replication rules."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of an object replication policy."
+                      }
+                    },
+                    "_1.immutabilityPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "immutabilityPeriodSinceCreationInDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                          }
+                        },
+                        "allowProtectedAppendWrites": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. Defaults to false."
+                          }
+                        },
+                        "allowProtectedAppendWritesAll": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for an immutability policy.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "blob-service/container/main.bicep"
+                        }
+                      }
+                    },
+                    "_2.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_2.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_2.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_2.secretSetOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "secretResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resourceId of the exported secret."
+                          }
+                        },
+                        "secretUri": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI of the exported secret."
+                          }
+                        },
+                        "secretUriWithVersion": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI with version of the exported secret."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "blobCorsRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "allowedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                          }
+                        },
+                        "allowedMethods": {
+                          "type": "array",
+                          "allowedValues": [
+                            "CONNECT",
+                            "DELETE",
+                            "GET",
+                            "HEAD",
+                            "MERGE",
+                            "OPTIONS",
+                            "PATCH",
+                            "POST",
+                            "PUT",
+                            "TRACE"
+                          ],
+                          "metadata": {
+                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                          }
+                        },
+                        "allowedOrigins": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                          }
+                        },
+                        "exposedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of response headers to expose to CORS clients."
+                          }
+                        },
+                        "maxAgeInSeconds": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a cors rule.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "blob-service/main.bicep",
+                          "originalIdentifier": "corsRuleType"
+                        }
+                      }
+                    },
+                    "containerType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the Storage Container to deploy."
+                          }
+                        },
+                        "defaultEncryptionScope": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Default the container to use specified encryption scope for all writes."
+                          }
+                        },
+                        "denyEncryptionScopeOverride": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Block override of encryption scope from the container default."
+                          }
+                        },
+                        "enableNfsV3AllSquash": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable NFSv3 all squash on blob container."
+                          }
+                        },
+                        "enableNfsV3RootSquash": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable NFSv3 root squash on blob container."
+                          }
+                        },
+                        "immutableStorageWithVersioningEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                          }
+                        },
+                        "immutabilityPolicy": {
+                          "$ref": "#/definitions/_1.immutabilityPolicyType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Configure immutability policy."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. A name-value pair to associate with the container as metadata."
+                          },
+                          "nullable": true
+                        },
+                        "publicAccess": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Blob",
+                            "Container",
+                            "None"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a storage container.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "blob-service/main.bicep"
+                        }
+                      }
+                    },
+                    "customerManagedKeyWithAutoRotateType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                          }
+                        },
+                        "keyName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the customer managed key to use for encryption."
+                          }
+                        },
+                        "keyVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                          }
+                        },
+                        "autoRotationEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                          }
+                        },
+                        "userAssignedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "diagnosticSettingMetricsOnlyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "fileCorsRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "allowedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                          }
+                        },
+                        "allowedMethods": {
+                          "type": "array",
+                          "allowedValues": [
+                            "CONNECT",
+                            "DELETE",
+                            "GET",
+                            "HEAD",
+                            "MERGE",
+                            "OPTIONS",
+                            "PATCH",
+                            "POST",
+                            "PUT",
+                            "TRACE"
+                          ],
+                          "metadata": {
+                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                          }
+                        },
+                        "allowedOrigins": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                          }
+                        },
+                        "exposedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of response headers to expose to CORS clients."
+                          }
+                        },
+                        "maxAgeInSeconds": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a cors rule.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "file-service/main.bicep",
+                          "originalIdentifier": "corsRuleType"
+                        }
+                      }
+                    },
+                    "fileShareType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the file share."
+                          }
+                        },
+                        "accessTier": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Cool",
+                            "Hot",
+                            "Premium",
+                            "TransactionOptimized"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
+                          }
+                        },
+                        "enabledProtocols": {
+                          "type": "string",
+                          "allowedValues": [
+                            "NFS",
+                            "SMB"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
+                          }
+                        },
+                        "rootSquash": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AllSquash",
+                            "NoRootSquash",
+                            "RootSquash"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
+                          }
+                        },
+                        "shareQuota": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
+                          }
+                        },
+                        "provisionedBandwidthMibps": {
+                          "type": "int",
+                          "nullable": true,
+                          "maxValue": 10340,
+                          "metadata": {
+                            "description": "Optional. The provisioned bandwidth of the share, in mebibytes per second. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 10340."
+                          }
+                        },
+                        "provisionedIops": {
+                          "type": "int",
+                          "nullable": true,
+                          "maxValue": 102400,
+                          "metadata": {
+                            "description": "Optional. The provisioned IOPS of the share. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 102400."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a file share.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "file-service/main.bicep"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "objectReplicationPolicyRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "ruleId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The ID of the rule. Auto-generated on destination account. Required for source account."
+                          }
+                        },
+                        "containerName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the source container."
+                          }
+                        },
+                        "destinationContainerName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the destination container. If not provided, the same name as the source container will be used."
+                          }
+                        },
+                        "filters": {
+                          "type": "object",
+                          "properties": {
+                            "prefixMatch": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The prefix to match for the replication policy rule."
+                              }
+                            },
+                            "minCreationTime": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The minimum creation time to match for the replication policy rule."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The filters for the object replication policy rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of an object replication policy rule.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "object-replication-policy/policy/main.bicep"
+                        }
+                      }
+                    },
+                    "permissionScopeType": {
+                      "type": "object",
+                      "properties": {
+                        "permissions": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
+                          }
+                        },
+                        "resourceName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The service used by the local user, e.g. blob, file."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "local-user/main.bicep"
+                        }
+                      }
+                    },
+                    "privateEndpointMultiServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the private endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_2.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_2.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_2.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "queueCorsRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "allowedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                          }
+                        },
+                        "allowedMethods": {
+                          "type": "array",
+                          "allowedValues": [
+                            "CONNECT",
+                            "DELETE",
+                            "GET",
+                            "HEAD",
+                            "MERGE",
+                            "OPTIONS",
+                            "PATCH",
+                            "POST",
+                            "PUT",
+                            "TRACE"
+                          ],
+                          "metadata": {
+                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                          }
+                        },
+                        "allowedOrigins": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                          }
+                        },
+                        "exposedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of response headers to expose to CORS clients."
+                          }
+                        },
+                        "maxAgeInSeconds": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a cors rule.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "queue-service/main.bicep",
+                          "originalIdentifier": "corsRuleType"
+                        }
+                      }
+                    },
+                    "queueType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the queue."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. Metadata to set on the queue."
+                          },
+                          "nullable": true
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a queue.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "queue-service/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "secretsOutputType": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": {
+                        "$ref": "#/definitions/_2.secretSetOutputType",
+                        "metadata": {
+                          "description": "An exported secret's references."
+                        }
+                      },
+                      "metadata": {
+                        "description": "A map of the exported secrets",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "sshAuthorizedKeyType": {
+                      "type": "object",
+                      "properties": {
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Description used to store the function/usage of the key."
+                          }
+                        },
+                        "key": {
+                          "type": "securestring",
+                          "metadata": {
+                            "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "local-user/main.bicep"
+                        }
+                      }
+                    },
+                    "tableCorsRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "allowedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                          }
+                        },
+                        "allowedMethods": {
+                          "type": "array",
+                          "allowedValues": [
+                            "CONNECT",
+                            "DELETE",
+                            "GET",
+                            "HEAD",
+                            "MERGE",
+                            "OPTIONS",
+                            "PATCH",
+                            "POST",
+                            "PUT",
+                            "TRACE"
+                          ],
+                          "metadata": {
+                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                          }
+                        },
+                        "allowedOrigins": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                          }
+                        },
+                        "exposedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of response headers to expose to CORS clients."
+                          }
+                        },
+                        "maxAgeInSeconds": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a cors rule.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table-service/main.bicep",
+                          "originalIdentifier": "corsRuleType"
+                        }
+                      }
+                    },
+                    "tableType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the table."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a table.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table-service/main.bicep"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "maxLength": 24,
+                      "metadata": {
+                        "description": "Required. Name of the Storage Account. Must be lower-case."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "extendedLocationZone": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Extended Zone location (ex 'losangeles'). When supplied, the storage account will be created in the specified zone under the parent location. The extended zone must be available in the supplied parent location."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "StorageV2",
+                      "allowedValues": [
+                        "Storage",
+                        "StorageV2",
+                        "BlobStorage",
+                        "FileStorage",
+                        "BlockBlobStorage"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Type of Storage Account to create."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "Standard_GRS",
+                      "allowedValues": [
+                        "Standard_LRS",
+                        "Standard_ZRS",
+                        "Standard_GRS",
+                        "Standard_GZRS",
+                        "Standard_RAGRS",
+                        "Standard_RAGZRS",
+                        "StandardV2_LRS",
+                        "StandardV2_ZRS",
+                        "StandardV2_GRS",
+                        "StandardV2_GZRS",
+                        "Premium_LRS",
+                        "Premium_ZRS",
+                        "PremiumV2_LRS",
+                        "PremiumV2_ZRS"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage."
+                      }
+                    },
+                    "accessTier": {
+                      "type": "string",
+                      "defaultValue": "Hot",
+                      "allowedValues": [
+                        "Premium",
+                        "Hot",
+                        "Cool",
+                        "Cold"
+                      ],
+                      "metadata": {
+                        "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type."
+                      }
+                    },
+                    "largeFileSharesState": {
+                      "type": "string",
+                      "defaultValue": "Disabled",
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)."
+                      }
+                    },
+                    "azureFilesIdentityBasedAuthentication": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication"
+                        },
+                        "description": "Optional. Provides the identity based authentication settings for Azure Files."
+                      },
+                      "nullable": true
+                    },
+                    "defaultToOAuthAuthentication": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not."
+                      }
+                    },
+                    "allowSharedKeyAccess": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointMultiServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "managementPolicyRules": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Storage/storageAccounts/managementPolicies@2025-01-01#properties/properties/properties/policy/properties/rules"
+                        },
+                        "description": "Optional. The Storage Account ManagementPolicies Rules."
+                      },
+                      "nullable": true
+                    },
+                    "networkAcls": {
+                      "$ref": "#/definitions/networkAclsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny."
+                      }
+                    },
+                    "requireInfrastructureEncryption": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true."
+                      }
+                    },
+                    "allowCrossTenantReplication": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Allow or disallow cross AAD tenant object replication."
+                      }
+                    },
+                    "customDomainName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source."
+                      }
+                    },
+                    "customDomainUseSubDomainName": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates."
+                      }
+                    },
+                    "dnsEndpointType": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "AzureDnsZone",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier."
+                      }
+                    },
+                    "blobServices": {
+                      "$ref": "#/definitions/blobServiceType",
+                      "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]",
+                      "metadata": {
+                        "description": "Optional. Blob service and containers to deploy."
+                      }
+                    },
+                    "fileServices": {
+                      "$ref": "#/definitions/fileServiceType",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. File service and shares to deploy."
+                      }
+                    },
+                    "queueServices": {
+                      "$ref": "#/definitions/queueServiceType",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Queue service and queues to create."
+                      }
+                    },
+                    "tableServices": {
+                      "$ref": "#/definitions/tableServiceType",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Table service and tables to create."
+                      }
+                    },
+                    "allowBlobPublicAccess": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false."
+                      }
+                    },
+                    "minimumTlsVersion": {
+                      "type": "string",
+                      "defaultValue": "TLS1_2",
+                      "allowedValues": [
+                        "TLS1_2",
+                        "TLS1_3"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore."
+                      }
+                    },
+                    "enableHierarchicalNamespace": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true."
+                      }
+                    },
+                    "enableSftp": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true."
+                      }
+                    },
+                    "localUsers": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/localUserType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Local users to deploy for SFTP authentication."
+                      }
+                    },
+                    "isLocalUserEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enables local users feature, if set to true."
+                      }
+                    },
+                    "enableNfsV3": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "allowedCopyScope": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "AAD",
+                        "PrivateLink"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled",
+                        "SecuredByPerimeter"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+                      }
+                    },
+                    "supportsHttpsTrafficOnly": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Allows HTTPS traffic only to storage service if sets to true."
+                      }
+                    },
+                    "customerManagedKey": {
+                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The customer managed key definition."
+                      }
+                    },
+                    "sasExpirationPeriod": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The SAS expiration period. DD.HH:MM:SS."
+                      }
+                    },
+                    "sasExpirationAction": {
+                      "type": "string",
+                      "defaultValue": "Log",
+                      "allowedValues": [
+                        "Block",
+                        "Log"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The SAS expiration action. Allowed values are Block and Log."
+                      }
+                    },
+                    "keyType": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Account",
+                        "Service"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The keyType to use with Queue & Table services."
+                      }
+                    },
+                    "secretsExportConfiguration": {
+                      "$ref": "#/definitions/secretsExportConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                      }
+                    },
+                    "immutableStorageWithVersioning": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning"
+                        },
+                        "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts."
+                      },
+                      "nullable": true
+                    },
+                    "objectReplicationPolicies": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/objectReplicationPolicyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Object replication policies for the storage account."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]",
+                    "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+                    "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+                      "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]",
+                      "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]",
+                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    },
+                    "formattedManagementPolicies": "[union(coalesce(parameters('managementPolicyRules'), createArray()), if(and(and(not(empty(parameters('blobServices'))), coalesce(tryGet(parameters('blobServices'), 'isVersioningEnabled'), false())), not(equals(tryGet(parameters('blobServices'), 'versionDeletePolicyDays'), null()))), createArray(createObject('name', 'DeletePreviousVersions (auto-created)', 'enabled', true(), 'type', 'Lifecycle', 'definition', createObject('actions', createObject('version', createObject('delete', createObject('daysAfterCreationGreaterThan', parameters('blobServices').versionDeletePolicyDays))), 'filters', createObject('blobTypes', createArray('blockBlob', 'appendBlob'))))), createArray()))]",
+                    "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                  },
+                  "resources": {
+                    "cMKKeyVault::cMKKey": {
+                      "condition": "[and(and(not(variables('isHSMManagedCMK')), not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults/keys",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.32.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "cMKKeyVault": {
+                      "condition": "[and(not(variables('isHSMManagedCMK')), not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2025-05-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                    },
+                    "cMKUserAssignedIdentity": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                      "apiVersion": "2024-11-30",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                    },
+                    "storageAccount": {
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2025-06-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "extendedLocation": "[if(not(empty(parameters('extendedLocationZone'))), createObject('name', parameters('extendedLocationZone'), 'type', 'EdgeZone'), null())]",
+                      "kind": "[parameters('kind')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]"
+                      },
+                      "identity": "[variables('identity')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault').vaultUri, format('https://{0}.managedhsm.azure.net/', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')))), 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), if(not(variables('isHSMManagedCMK')), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/')), fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]",
+                      "dependsOn": [
+                        "cMKKeyVault",
+                        "cMKKeyVault::cMKKey"
+                      ]
+                    },
+                    "storageAccount_diagnosticSettings": {
+                      "copy": {
+                        "name": "storageAccount_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_roleAssignments": {
+                      "copy": {
+                        "name": "storageAccount_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_privateEndpoints": {
+                      "copy": {
+                        "name": "storageAccount_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.5.1644",
+                              "templateHash": "16604612898799598358"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private dns zone group."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a private DNS zone group configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                },
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              },
+                              "nullable": true
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                },
+                                "description": "Optional. Custom DNS configurations."
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-10-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "24141742673128945"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private DNS zone group configuration."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "privateDnsZoneConfigs",
+                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "properties": {
+                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                              }
+                                            }
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                  "output": true
+                                },
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_managementPolicies": {
+                      "condition": "[not(empty(coalesce(variables('formattedManagementPolicies'), createArray())))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "rules": {
+                            "value": "[variables('formattedManagementPolicies')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "4000605059554016072"
+                            },
+                            "name": "Storage Account Management Policies",
+                            "description": "This module deploys a Storage Account Management Policy."
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "rules": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts/managementPolicies@2025-06-01#properties/properties/properties/policy/properties/rules"
+                                },
+                                "description": "Required. The Storage Account ManagementPolicies Rules."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.storage-mgmtpolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            {
+                              "type": "Microsoft.Storage/storageAccounts/managementPolicies",
+                              "apiVersion": "2025-06-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
+                              "properties": {
+                                "policy": {
+                                  "rules": "[parameters('rules')]"
+                                }
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed management policy."
+                              },
+                              "value": "default"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed management policy."
+                              },
+                              "value": "default"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed management policy."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount",
+                        "storageAccount_blobServices"
+                      ]
+                    },
+                    "storageAccount_localUsers": {
+                      "copy": {
+                        "name": "storageAccount_localUsers",
+                        "count": "[length(coalesce(parameters('localUsers'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]"
+                          },
+                          "hasSshKey": {
+                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]"
+                          },
+                          "hasSshPassword": {
+                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]"
+                          },
+                          "permissionScopes": {
+                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]"
+                          },
+                          "hasSharedKey": {
+                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]"
+                          },
+                          "homeDirectory": {
+                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]"
+                          },
+                          "sshAuthorizedKeys": {
+                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "1801226901235196767"
+                            },
+                            "name": "Storage Account Local Users",
+                            "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication."
+                          },
+                          "definitions": {
+                            "sshAuthorizedKeyType": {
+                              "type": "object",
+                              "properties": {
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description used to store the function/usage of the key."
+                                  }
+                                },
+                                "key": {
+                                  "type": "securestring",
+                                  "metadata": {
+                                    "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "permissionScopeType": {
+                              "type": "object",
+                              "properties": {
+                                "permissions": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
+                                  }
+                                },
+                                "resourceName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The service used by the local user, e.g. blob, file."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the local user used for SFTP Authentication."
+                              }
+                            },
+                            "hasSharedKey": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
+                              }
+                            },
+                            "hasSshKey": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                              }
+                            },
+                            "hasSshPassword": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                              }
+                            },
+                            "homeDirectory": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The local user home directory."
+                              }
+                            },
+                            "permissionScopes": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/permissionScopeType"
+                              },
+                              "metadata": {
+                                "description": "Required. The permission scopes of the local user."
+                              }
+                            },
+                            "sshAuthorizedKeys": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/sshAuthorizedKeyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The local user SSH authorized keys for SFTP."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.storage-localuser.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-06-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "localUsers": {
+                              "type": "Microsoft.Storage/storageAccounts/localUsers",
+                              "apiVersion": "2025-06-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                              "properties": {
+                                "hasSharedKey": "[parameters('hasSharedKey')]",
+                                "hasSshKey": "[parameters('hasSshKey')]",
+                                "hasSshPassword": "[parameters('hasSshPassword')]",
+                                "homeDirectory": "[parameters('homeDirectory')]",
+                                "permissionScopes": "[parameters('permissionScopes')]",
+                                "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed local user."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed local user."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed local user."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_blobServices": {
+                      "condition": "[not(empty(parameters('blobServices')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "containers": {
+                            "value": "[tryGet(parameters('blobServices'), 'containers')]"
+                          },
+                          "automaticSnapshotPolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]"
+                          },
+                          "changeFeedEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]"
+                          },
+                          "changeFeedRetentionInDays": {
+                            "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]"
+                          },
+                          "containerDeleteRetentionPolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]"
+                          },
+                          "containerDeleteRetentionPolicyDays": {
+                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]"
+                          },
+                          "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]"
+                          },
+                          "corsRules": {
+                            "value": "[tryGet(parameters('blobServices'), 'corsRules')]"
+                          },
+                          "defaultServiceVersion": {
+                            "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]"
+                          },
+                          "deleteRetentionPolicyAllowPermanentDelete": {
+                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]"
+                          },
+                          "deleteRetentionPolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]"
+                          },
+                          "deleteRetentionPolicyDays": {
+                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]"
+                          },
+                          "isVersioningEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]"
+                          },
+                          "lastAccessTimeTrackingPolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]"
+                          },
+                          "restorePolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]"
+                          },
+                          "restorePolicyDays": {
+                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "468225492069709453"
+                            },
+                            "name": "Storage Account blob Services",
+                            "description": "This module deploys a Storage Account Blob Service."
+                          },
+                          "definitions": {
+                            "corsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cors rule."
+                              }
+                            },
+                            "containerType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the Storage Container to deploy."
+                                  }
+                                },
+                                "defaultEncryptionScope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                  }
+                                },
+                                "denyEncryptionScopeOverride": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Block override of encryption scope from the container default."
+                                  }
+                                },
+                                "enableNfsV3AllSquash": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable NFSv3 all squash on blob container."
+                                  }
+                                },
+                                "enableNfsV3RootSquash": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable NFSv3 root squash on blob container."
+                                  }
+                                },
+                                "immutableStorageWithVersioningEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                  }
+                                },
+                                "immutabilityPolicy": {
+                                  "$ref": "#/definitions/immutabilityPolicyType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Configure immutability policy."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. A name-value pair to associate with the container as metadata."
+                                  },
+                                  "nullable": true
+                                },
+                                "publicAccess": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Blob",
+                                    "Container",
+                                    "None"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a storage container."
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "immutabilityPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "immutabilityPeriodSinceCreationInDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                  }
+                                },
+                                "allowProtectedAppendWrites": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. Defaults to false."
+                                  }
+                                },
+                                "allowProtectedAppendWritesAll": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for an immutability policy.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "container/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "automaticSnapshotPolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Automatic Snapshot is enabled if set to true."
+                              }
+                            },
+                            "changeFeedEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                              }
+                            },
+                            "changeFeedRetentionInDays": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 1,
+                              "maxValue": 146000,
+                              "metadata": {
+                                "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
+                              }
+                            },
+                            "containerDeleteRetentionPolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                              }
+                            },
+                            "containerDeleteRetentionPolicyDays": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 1,
+                              "maxValue": 365,
+                              "metadata": {
+                                "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                              }
+                            },
+                            "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                              }
+                            },
+                            "corsRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/corsRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                              }
+                            },
+                            "defaultServiceVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
+                              }
+                            },
+                            "deleteRetentionPolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. The blob service properties for blob soft delete."
+                              }
+                            },
+                            "deleteRetentionPolicyDays": {
+                              "type": "int",
+                              "defaultValue": 7,
+                              "minValue": 1,
+                              "maxValue": 365,
+                              "metadata": {
+                                "description": "Optional. Indicates the number of days that the deleted blob should be retained."
+                              }
+                            },
+                            "deleteRetentionPolicyAllowPermanentDelete": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                              }
+                            },
+                            "isVersioningEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
+                              }
+                            },
+                            "lastAccessTimeTrackingPolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                              }
+                            },
+                            "restorePolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                              }
+                            },
+                            "restorePolicyDays": {
+                              "type": "int",
+                              "defaultValue": 7,
+                              "minValue": 1,
+                              "metadata": {
+                                "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                              }
+                            },
+                            "containers": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/containerType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Blob containers to create."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "enableReferencedModulesTelemetry": false,
+                            "name": "default"
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-01-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "blobServices": {
+                              "type": "Microsoft.Storage/storageAccounts/blobServices",
+                              "apiVersion": "2025-01-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                              "properties": {
+                                "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]",
+                                "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]",
+                                "containerDeleteRetentionPolicy": {
+                                  "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]",
+                                  "days": "[parameters('containerDeleteRetentionPolicyDays')]",
+                                  "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]"
+                                },
+                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
+                                "defaultServiceVersion": "[parameters('defaultServiceVersion')]",
+                                "deleteRetentionPolicy": {
+                                  "enabled": "[parameters('deleteRetentionPolicyEnabled')]",
+                                  "days": "[parameters('deleteRetentionPolicyDays')]",
+                                  "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]"
+                                },
+                                "isVersioningEnabled": "[parameters('isVersioningEnabled')]",
+                                "lastAccessTimeTrackingPolicy": "[if(and(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), empty(tryGet(reference('storageAccount', '2025-01-01', 'full'), 'extendedLocation'))), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]",
+                                "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]"
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "blobServices_diagnosticSettings": {
+                              "copy": {
+                                "name": "blobServices_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "blobServices"
+                              ]
+                            },
+                            "blobServices_container": {
+                              "copy": {
+                                "name": "blobServices_container",
+                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "blobServiceName": {
+                                    "value": "[variables('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
+                                  },
+                                  "defaultEncryptionScope": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]"
+                                  },
+                                  "denyEncryptionScopeOverride": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]"
+                                  },
+                                  "enableNfsV3AllSquash": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]"
+                                  },
+                                  "enableNfsV3RootSquash": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]"
+                                  },
+                                  "immutableStorageWithVersioningEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "publicAccess": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "immutabilityPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "273904034769611992"
+                                    },
+                                    "name": "Storage Account Blob Containers",
+                                    "description": "This module deploys a Storage Account Blob Container."
+                                  },
+                                  "definitions": {
+                                    "immutabilityPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "immutabilityPeriodSinceCreationInDays": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                          }
+                                        },
+                                        "allowProtectedAppendWrites": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. Defaults to false."
+                                          }
+                                        },
+                                        "allowProtectedAppendWritesAll": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for an immutability policy."
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "blobServiceName": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Storage Container to deploy."
+                                      }
+                                    },
+                                    "defaultEncryptionScope": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                      }
+                                    },
+                                    "denyEncryptionScopeOverride": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Block override of encryption scope from the container default."
+                                      }
+                                    },
+                                    "enableNfsV3AllSquash": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Enable NFSv3 all squash on blob container."
+                                      }
+                                    },
+                                    "enableNfsV3RootSquash": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Enable NFSv3 root squash on blob container."
+                                      }
+                                    },
+                                    "immutableStorageWithVersioningEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                      }
+                                    },
+                                    "immutabilityPolicy": {
+                                      "$ref": "#/definitions/immutabilityPolicyType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configure immutability policy."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. A name-value pair to associate with the container as metadata."
+                                      },
+                                      "defaultValue": {}
+                                    },
+                                    "publicAccess": {
+                                      "type": "string",
+                                      "defaultValue": "None",
+                                      "allowedValues": [
+                                        "Container",
+                                        "Blob",
+                                        "None"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+                                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    },
+                                    "enableReferencedModulesTelemetry": false
+                                  },
+                                  "resources": {
+                                    "storageAccount::blobServices": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts/blobServices",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "container": {
+                                      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
+                                      "properties": {
+                                        "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]",
+                                        "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]",
+                                        "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]",
+                                        "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]",
+                                        "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "publicAccess": "[parameters('publicAccess')]"
+                                      }
+                                    },
+                                    "container_roleAssignments": {
+                                      "copy": {
+                                        "name": "container_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "container"
+                                      ]
+                                    },
+                                    "container_immutabilityPolicy": {
+                                      "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('storageAccountName')]"
+                                          },
+                                          "containerName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "immutabilityPeriodSinceCreationInDays": {
+                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]"
+                                          },
+                                          "allowProtectedAppendWrites": {
+                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]"
+                                          },
+                                          "allowProtectedAppendWritesAll": {
+                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "15304742179563677019"
+                                            },
+                                            "name": "Storage Account Blob Container Immutability Policies",
+                                            "description": "This module deploys a Storage Account Blob Container Immutability Policy."
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "containerName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "immutabilityPeriodSinceCreationInDays": {
+                                              "type": "int",
+                                              "defaultValue": 365,
+                                              "metadata": {
+                                                "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                              }
+                                            },
+                                            "allowProtectedAppendWrites": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                                              }
+                                            },
+                                            "allowProtectedAppendWritesAll": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.storage-containerimmutpolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            {
+                                              "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), 'default')]",
+                                              "properties": {
+                                                "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]",
+                                                "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]",
+                                                "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]"
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed immutability policy."
+                                              },
+                                              "value": "default"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed immutability policy."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), 'default')]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed immutability policy."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "container"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed container."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed container."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed container."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "blobServices"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed blob service."
+                              },
+                              "value": "[variables('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed blob service."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed blob service."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_fileServices": {
+                      "condition": "[not(empty(parameters('fileServices')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]"
+                          },
+                          "protocolSettings": {
+                            "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]"
+                          },
+                          "shareDeleteRetentionPolicy": {
+                            "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]"
+                          },
+                          "shares": {
+                            "value": "[tryGet(parameters('fileServices'), 'shares')]"
+                          },
+                          "corsRules": {
+                            "value": "[tryGet(parameters('fileServices'), 'corsRules')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "17583198711200998285"
+                            },
+                            "name": "Storage Account File Share Services",
+                            "description": "This module deploys a Storage Account File Share Service."
+                          },
+                          "definitions": {
+                            "corsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cors rule."
+                              }
+                            },
+                            "fileShareType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the file share."
+                                  }
+                                },
+                                "accessTier": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Cool",
+                                    "Hot",
+                                    "Premium",
+                                    "TransactionOptimized"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
+                                  }
+                                },
+                                "enabledProtocols": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "NFS",
+                                    "SMB"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
+                                  }
+                                },
+                                "rootSquash": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AllSquash",
+                                    "NoRootSquash",
+                                    "RootSquash"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
+                                  }
+                                },
+                                "shareQuota": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
+                                  }
+                                },
+                                "provisionedBandwidthMibps": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "maxValue": 10340,
+                                  "metadata": {
+                                    "description": "Optional. The provisioned bandwidth of the share, in mebibytes per second. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 10340."
+                                  }
+                                },
+                                "provisionedIops": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "maxValue": 102400,
+                                  "metadata": {
+                                    "description": "Optional. The provisioned IOPS of the share. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 102400."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a file share."
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the file service."
+                              }
+                            },
+                            "protocolSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings"
+                                },
+                                "description": "Optional. Protocol settings for file service."
+                              },
+                              "defaultValue": {}
+                            },
+                            "shareDeleteRetentionPolicy": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy"
+                                },
+                                "description": "Optional. The service properties for soft delete."
+                              },
+                              "defaultValue": {
+                                "enabled": true,
+                                "days": 7
+                              }
+                            },
+                            "corsRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/corsRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "shares": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/fileShareType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. File shares to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "enableReferencedModulesTelemetry": false
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-06-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "fileServices": {
+                              "type": "Microsoft.Storage/storageAccounts/fileServices",
+                              "apiVersion": "2025-06-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                              "properties": {
+                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
+                                "protocolSettings": "[parameters('protocolSettings')]",
+                                "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]"
+                              }
+                            },
+                            "fileServices_diagnosticSettings": {
+                              "copy": {
+                                "name": "fileServices_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "fileServices"
+                              ]
+                            },
+                            "fileServices_shares": {
+                              "copy": {
+                                "name": "fileServices_shares",
+                                "count": "[length(coalesce(parameters('shares'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-FileShare-{1}', deployment().name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "fileServicesName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]"
+                                  },
+                                  "accessTier": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2025-06-01', 'full').kind, 'FileStorage'), if(startsWith(reference('storageAccount', '2025-06-01', 'full').sku.name, 'PremiumV2_'), null(), 'Premium'), 'TransactionOptimized'))]"
+                                  },
+                                  "enabledProtocols": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]"
+                                  },
+                                  "rootSquash": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]"
+                                  },
+                                  "shareQuota": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]"
+                                  },
+                                  "provisionedBandwidthMibps": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'provisionedBandwidthMibps')]"
+                                  },
+                                  "provisionedIops": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'provisionedIops')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "10353179772982843397"
+                                    },
+                                    "name": "Storage Account File Shares",
+                                    "description": "This module deploys a Storage Account File Share."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "fileServicesName": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the file share to create."
+                                      }
+                                    },
+                                    "accessTier": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Premium",
+                                        "Hot",
+                                        "Cool",
+                                        "TransactionOptimized"
+                                      ],
+                                      "metadata": {
+                                        "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized, Hot, and Cool."
+                                      }
+                                    },
+                                    "shareQuota": {
+                                      "type": "int",
+                                      "defaultValue": 5120,
+                                      "metadata": {
+                                        "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
+                                      }
+                                    },
+                                    "enabledProtocols": {
+                                      "type": "string",
+                                      "defaultValue": "SMB",
+                                      "allowedValues": [
+                                        "NFS",
+                                        "SMB"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
+                                      }
+                                    },
+                                    "rootSquash": {
+                                      "type": "string",
+                                      "defaultValue": "NoRootSquash",
+                                      "allowedValues": [
+                                        "AllSquash",
+                                        "NoRootSquash",
+                                        "RootSquash"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
+                                      }
+                                    },
+                                    "provisionedBandwidthMibps": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 10340,
+                                      "metadata": {
+                                        "description": "Optional. The provisioned bandwidth of the share, in mebibytes per second. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 10340."
+                                      }
+                                    },
+                                    "provisionedIops": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 102400,
+                                      "metadata": {
+                                        "description": "Optional. The provisioned IOPS of the share. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 102400."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+                                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+                                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount::fileService": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts/fileServices",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "fileShare": {
+                                      "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]",
+                                      "properties": {
+                                        "accessTier": "[parameters('accessTier')]",
+                                        "shareQuota": "[parameters('shareQuota')]",
+                                        "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]",
+                                        "enabledProtocols": "[parameters('enabledProtocols')]",
+                                        "provisionedBandwidthMibps": "[if(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'FileStorage'), parameters('provisionedBandwidthMibps'), null())]",
+                                        "provisionedIops": "[if(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'FileStorage'), parameters('provisionedIops'), null())]"
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "fileShare_roleAssignments": {
+                                      "copy": {
+                                        "name": "fileShare_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "scope": {
+                                            "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]"
+                                          },
+                                          "roleDefinitionId": {
+                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                                          },
+                                          "principalId": {
+                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                          },
+                                          "principalType": {
+                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]"
+                                          },
+                                          "condition": {
+                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]"
+                                          },
+                                          "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]",
+                                          "delegatedManagedIdentityResourceId": {
+                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                          },
+                                          "description": {
+                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "parameters": {
+                                            "scope": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The scope to deploy the role assignment to."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the role assignment."
+                                              }
+                                            },
+                                            "roleDefinitionId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The role definition Id to assign."
+                                              }
+                                            },
+                                            "principalId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                              }
+                                            },
+                                            "principalType": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Device",
+                                                "ForeignGroup",
+                                                "Group",
+                                                "ServicePrincipal",
+                                                "User",
+                                                ""
+                                              ],
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The principal type of the assigned principal ID."
+                                              }
+                                            },
+                                            "description": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The description of the role assignment."
+                                              }
+                                            },
+                                            "condition": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\""
+                                              }
+                                            },
+                                            "conditionVersion": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "2.0"
+                                              ],
+                                              "defaultValue": "2.0",
+                                              "metadata": {
+                                                "description": "Optional. Version of the condition."
+                                              }
+                                            },
+                                            "delegatedManagedIdentityResourceId": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[parameters('scope')]",
+                                              "name": "[parameters('name')]",
+                                              "properties": {
+                                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                                "principalId": "[parameters('principalId')]",
+                                                "description": "[parameters('description')]",
+                                                "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]",
+                                                "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]",
+                                                "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]"
+                                              }
+                                            }
+                                          ]
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "fileShare"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed file share."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed file share."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed file share."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "fileServices",
+                                "storageAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed file share service."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed file share service."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed file share service."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_queueServices": {
+                      "condition": "[not(empty(parameters('queueServices')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]"
+                          },
+                          "queues": {
+                            "value": "[tryGet(parameters('queueServices'), 'queues')]"
+                          },
+                          "corsRules": {
+                            "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "9644461291744477521"
+                            },
+                            "name": "Storage Account Queue Services",
+                            "description": "This module deploys a Storage Account Queue Service."
+                          },
+                          "definitions": {
+                            "corsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cors rule."
+                              }
+                            },
+                            "queueType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the queue."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. Metadata to set on the queue."
+                                  },
+                                  "nullable": true
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a queue."
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "queues": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/queueType"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Queues to create."
+                              }
+                            },
+                            "corsRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/corsRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "name": "default",
+                            "enableReferencedModulesTelemetry": false
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-06-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "queueServices": {
+                              "type": "Microsoft.Storage/storageAccounts/queueServices",
+                              "apiVersion": "2025-06-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                              "properties": {
+                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
+                              }
+                            },
+                            "queueServices_diagnosticSettings": {
+                              "copy": {
+                                "name": "queueServices_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "queueServices"
+                              ]
+                            },
+                            "queueServices_queues": {
+                              "copy": {
+                                "name": "queueServices_queues",
+                                "count": "[length(coalesce(parameters('queues'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "12812824360066955039"
+                                    },
+                                    "name": "Storage Account Queues",
+                                    "description": "This module deploys a Storage Account Queue."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the storage queue to deploy."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. A name-value pair that represents queue metadata."
+                                      },
+                                      "defaultValue": {}
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+                                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+                                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+                                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount::queueServices": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts/queueServices",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.storage-queue.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "queue": {
+                                      "type": "Microsoft.Storage/storageAccounts/queueServices/queues",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]"
+                                      }
+                                    },
+                                    "queue_roleAssignments": {
+                                      "copy": {
+                                        "name": "queue_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "queue"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed queue."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed queue."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed queue."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed queue service."
+                              },
+                              "value": "[variables('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed queue service."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed queue service."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_tableServices": {
+                      "condition": "[not(empty(parameters('tableServices')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]"
+                          },
+                          "tables": {
+                            "value": "[tryGet(parameters('tableServices'), 'tables')]"
+                          },
+                          "corsRules": {
+                            "value": "[tryGet(parameters('tableServices'), 'corsRules')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "10320403358700650147"
+                            },
+                            "name": "Storage Account Table Services",
+                            "description": "This module deploys a Storage Account Table Service."
+                          },
+                          "definitions": {
+                            "corsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cors rule."
+                              }
+                            },
+                            "tableType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the table."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a table."
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "tables": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/tableType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tables to create."
+                              }
+                            },
+                            "corsRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/corsRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "name": "default",
+                            "enableReferencedModulesTelemetry": false
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-06-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "tableServices": {
+                              "type": "Microsoft.Storage/storageAccounts/tableServices",
+                              "apiVersion": "2025-06-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                              "properties": {
+                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
+                              }
+                            },
+                            "tableServices_diagnosticSettings": {
+                              "copy": {
+                                "name": "tableServices_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "tableServices"
+                              ]
+                            },
+                            "tableServices_tables": {
+                              "copy": {
+                                "name": "tableServices_tables",
+                                "count": "[length(coalesce(parameters('tables'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                                  },
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "11362260974696477885"
+                                    },
+                                    "name": "Storage Account Table",
+                                    "description": "This module deploys a Storage Account Table."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the table."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+                                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount::tableServices": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts/tableServices",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.storage-table.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "table": {
+                                      "type": "Microsoft.Storage/storageAccounts/tableServices/tables",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                    },
+                                    "table_roleAssignments": {
+                                      "copy": {
+                                        "name": "table_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "table"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed table."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed table."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed table."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed table service."
+                              },
+                              "value": "[variables('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed table service."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed table service."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "secretsExport": {
+                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "keyVaultName": {
+                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                          },
+                          "secretsToSet": {
+                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2025-06-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2025-06-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2025-06-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2025-06-01').keys[1].value, environment().suffixes.storage))), createArray()))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "13227497656004178962"
+                            }
+                          },
+                          "definitions": {
+                            "secretSetOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "secretResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resourceId of the exported secret."
+                                  }
+                                },
+                                "secretUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI of the exported secret."
+                                  }
+                                },
+                                "secretUriWithVersion": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI with version of the exported secret."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "secretToSetType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the secret to set."
+                                  }
+                                },
+                                "value": {
+                                  "type": "securestring",
+                                  "metadata": {
+                                    "description": "Required. The value of the secret to set."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "keyVaultName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Key Vault to set the ecrets in."
+                              }
+                            },
+                            "secretsToSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretToSetType"
+                              },
+                              "metadata": {
+                                "description": "Required. The secrets to set in the Key Vault."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "keyVault": {
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('keyVaultName')]"
+                            },
+                            "secrets": {
+                              "copy": {
+                                "name": "secrets",
+                                "count": "[length(parameters('secretsToSet'))]"
+                              },
+                              "type": "Microsoft.KeyVault/vaults/secrets",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                              "properties": {
+                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "secretsSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretSetOutputType"
+                              },
+                              "metadata": {
+                                "description": "The references to the secrets exported to the provided Key Vault."
+                              },
+                              "copy": {
+                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                "input": {
+                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                                  "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_objectReplicationPolicies": {
+                      "copy": {
+                        "name": "storageAccount_objectReplicationPolicies",
+                        "count": "[length(coalesce(parameters('objectReplicationPolicies'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Storage-ObjRepPolicy-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "destinationAccountResourceId": {
+                            "value": "[coalesce(parameters('objectReplicationPolicies'), createArray())[copyIndex()].destinationStorageAccountResourceId]"
+                          },
+                          "enableMetrics": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('objectReplicationPolicies'), createArray())[copyIndex()], 'enableMetrics'), false())]"
+                          },
+                          "rules": {
+                            "value": "[tryGet(coalesce(parameters('objectReplicationPolicies'), createArray())[copyIndex()], 'rules')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "1894366578172550759"
+                            },
+                            "name": "Storage Account Object Replication Policy",
+                            "description": "This module deploys a Storage Account Object Replication Policy for both the source account and destination account."
+                          },
+                          "definitions": {
+                            "objectReplicationPolicyRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "ruleId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The ID of the rule. Auto-generated on destination account. Required for source account."
+                                  }
+                                },
+                                "containerName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the source container."
+                                  }
+                                },
+                                "destinationContainerName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the destination container. If not provided, the same name as the source container will be used."
+                                  }
+                                },
+                                "filters": {
+                                  "type": "object",
+                                  "properties": {
+                                    "prefixMatch": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The prefix to match for the replication policy rule."
+                                      }
+                                    },
+                                    "minCreationTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The minimum creation time to match for the replication policy rule."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The filters for the object replication policy rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of an object replication policy rule.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "policy/main.bicep"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Name of the policy."
+                              }
+                            },
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Required. The name of the parent Storage Account."
+                              }
+                            },
+                            "destinationAccountResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the destination storage account for replication."
+                              }
+                            },
+                            "enableMetrics": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Whether metrics are enabled for the object replication policy."
+                              }
+                            },
+                            "rules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/objectReplicationPolicyRuleType"
+                              },
+                              "metadata": {
+                                "description": "Required. Rules for the object replication policy."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "destAccountResourceIdParts": "[split(parameters('destinationAccountResourceId'), '/')]",
+                            "destAccountName": "[if(not(empty(variables('destAccountResourceIdParts'))), last(variables('destAccountResourceIdParts')), parameters('destinationAccountResourceId'))]",
+                            "destAccountSubscription": "[if(greater(length(variables('destAccountResourceIdParts')), 2), variables('destAccountResourceIdParts')[2], subscription().subscriptionId)]",
+                            "destAccountResourceGroupName": "[if(greater(length(variables('destAccountResourceIdParts')), 4), variables('destAccountResourceIdParts')[4], resourceGroup().name)]"
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-01-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "destinationPolicy": {
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('{0}-ObjRep-Policy-dest-{1}', deployment().name, variables('destAccountName')), 64)]",
+                              "subscriptionId": "[variables('destAccountSubscription')]",
+                              "resourceGroup": "[variables('destAccountResourceGroupName')]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('name'), 'default')]"
+                                  },
+                                  "storageAccountName": {
+                                    "value": "[variables('destAccountName')]"
+                                  },
+                                  "sourceStorageAccountResourceId": {
+                                    "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
+                                  },
+                                  "destinationAccountResourceId": {
+                                    "value": "[parameters('destinationAccountResourceId')]"
+                                  },
+                                  "enableMetrics": {
+                                    "value": "[parameters('enableMetrics')]"
+                                  },
+                                  "rules": {
+                                    "value": "[parameters('rules')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "14995722372031126283"
+                                    },
+                                    "name": "Storage Account Object Replication Policy",
+                                    "description": "This module deploys a Storage Account Object Replication Policy for a provided storage account."
+                                  },
+                                  "definitions": {
+                                    "objectReplicationPolicyRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ruleId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The ID of the rule. Auto-generated on destination account. Required for source account."
+                                          }
+                                        },
+                                        "containerName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the source container."
+                                          }
+                                        },
+                                        "destinationContainerName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the destination container. If not provided, the same name as the source container will be used."
+                                          }
+                                        },
+                                        "filters": {
+                                          "type": "object",
+                                          "properties": {
+                                            "prefixMatch": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The prefix to match for the replication policy rule."
+                                              }
+                                            },
+                                            "minCreationTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The minimum creation time to match for the replication policy rule."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The filters for the object replication policy rule."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an object replication policy rule."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the policy."
+                                      }
+                                    },
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Required. The name of the Storage Account on which to create the policy."
+                                      }
+                                    },
+                                    "sourceStorageAccountResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the source storage account for replication."
+                                      }
+                                    },
+                                    "destinationAccountResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the destination storage account for replication."
+                                      }
+                                    },
+                                    "enableMetrics": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether metrics are enabled for the object replication policy."
+                                      }
+                                    },
+                                    "rules": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/objectReplicationPolicyRuleType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. Rules for the object replication policy."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "objectReplicationPolicy": {
+                                      "type": "Microsoft.Storage/storageAccounts/objectReplicationPolicies",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "rules",
+                                            "count": "[length(parameters('rules'))]",
+                                            "input": {
+                                              "ruleId": "[tryGet(parameters('rules')[copyIndex('rules')], 'ruleId')]",
+                                              "sourceContainer": "[parameters('rules')[copyIndex('rules')].containerName]",
+                                              "destinationContainer": "[coalesce(tryGet(parameters('rules')[copyIndex('rules')], 'destinationContainerName'), parameters('rules')[copyIndex('rules')].containerName)]",
+                                              "filters": "[if(not(equals(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), null())), createObject('prefixMatch', tryGet(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), 'prefixMatch'), 'minCreationTime', tryGet(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), 'minCreationTime')), null())]"
+                                            }
+                                          }
+                                        ],
+                                        "destinationAccount": "[parameters('destinationAccountResourceId')]",
+                                        "metrics": {
+                                          "enabled": "[coalesce(parameters('enableMetrics'), false())]"
+                                        },
+                                        "sourceAccount": "[parameters('sourceStorageAccountResourceId')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Resource group name of the provisioned resources."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "objectReplicationPolicyId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Resource ID of the created Object Replication Policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/objectReplicationPolicies', parameters('storageAccountName'), parameters('name'))]"
+                                    },
+                                    "policyId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Policy ID of the created Object Replication Policy."
+                                      },
+                                      "value": "[reference('objectReplicationPolicy').policyId]"
+                                    },
+                                    "rules": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts/objectReplicationPolicies@2025-01-01#properties/properties/properties/rules",
+                                          "output": true
+                                        },
+                                        "description": "Rules created Object Replication Policy."
+                                      },
+                                      "value": "[reference('objectReplicationPolicy').rules]"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "sourcePolicy": {
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('{0}-ObjRep-Policy-source-{1}', deployment().name, parameters('storageAccountName')), 64)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[reference('destinationPolicy').outputs.policyId.value]"
+                                  },
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "sourceStorageAccountResourceId": {
+                                    "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
+                                  },
+                                  "destinationAccountResourceId": {
+                                    "value": "[parameters('destinationAccountResourceId')]"
+                                  },
+                                  "enableMetrics": {
+                                    "value": "[parameters('enableMetrics')]"
+                                  },
+                                  "rules": {
+                                    "copy": [
+                                      {
+                                        "name": "value",
+                                        "count": "[length(parameters('rules'))]",
+                                        "input": "[union(parameters('rules')[copyIndex('value')], createObject('ruleId', reference('destinationPolicy').outputs.rules.value[copyIndex('value')].ruleId))]"
+                                      }
+                                    ]
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "14995722372031126283"
+                                    },
+                                    "name": "Storage Account Object Replication Policy",
+                                    "description": "This module deploys a Storage Account Object Replication Policy for a provided storage account."
+                                  },
+                                  "definitions": {
+                                    "objectReplicationPolicyRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ruleId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The ID of the rule. Auto-generated on destination account. Required for source account."
+                                          }
+                                        },
+                                        "containerName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the source container."
+                                          }
+                                        },
+                                        "destinationContainerName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the destination container. If not provided, the same name as the source container will be used."
+                                          }
+                                        },
+                                        "filters": {
+                                          "type": "object",
+                                          "properties": {
+                                            "prefixMatch": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The prefix to match for the replication policy rule."
+                                              }
+                                            },
+                                            "minCreationTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The minimum creation time to match for the replication policy rule."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The filters for the object replication policy rule."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an object replication policy rule."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the policy."
+                                      }
+                                    },
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Required. The name of the Storage Account on which to create the policy."
+                                      }
+                                    },
+                                    "sourceStorageAccountResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the source storage account for replication."
+                                      }
+                                    },
+                                    "destinationAccountResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the destination storage account for replication."
+                                      }
+                                    },
+                                    "enableMetrics": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether metrics are enabled for the object replication policy."
+                                      }
+                                    },
+                                    "rules": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/objectReplicationPolicyRuleType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. Rules for the object replication policy."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "objectReplicationPolicy": {
+                                      "type": "Microsoft.Storage/storageAccounts/objectReplicationPolicies",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "rules",
+                                            "count": "[length(parameters('rules'))]",
+                                            "input": {
+                                              "ruleId": "[tryGet(parameters('rules')[copyIndex('rules')], 'ruleId')]",
+                                              "sourceContainer": "[parameters('rules')[copyIndex('rules')].containerName]",
+                                              "destinationContainer": "[coalesce(tryGet(parameters('rules')[copyIndex('rules')], 'destinationContainerName'), parameters('rules')[copyIndex('rules')].containerName)]",
+                                              "filters": "[if(not(equals(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), null())), createObject('prefixMatch', tryGet(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), 'prefixMatch'), 'minCreationTime', tryGet(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), 'minCreationTime')), null())]"
+                                            }
+                                          }
+                                        ],
+                                        "destinationAccount": "[parameters('destinationAccountResourceId')]",
+                                        "metrics": {
+                                          "enabled": "[coalesce(parameters('enableMetrics'), false())]"
+                                        },
+                                        "sourceAccount": "[parameters('sourceStorageAccountResourceId')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Resource group name of the provisioned resources."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "objectReplicationPolicyId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Resource ID of the created Object Replication Policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/objectReplicationPolicies', parameters('storageAccountName'), parameters('name'))]"
+                                    },
+                                    "policyId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Policy ID of the created Object Replication Policy."
+                                      },
+                                      "value": "[reference('objectReplicationPolicy').policyId]"
+                                    },
+                                    "rules": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts/objectReplicationPolicies@2025-01-01#properties/properties/properties/rules",
+                                          "output": true
+                                        },
+                                        "description": "Rules created Object Replication Policy."
+                                      },
+                                      "value": "[reference('objectReplicationPolicy').rules]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "destinationPolicy"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource group name of the provisioned resources."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "objectReplicationPolicyId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource ID of the created Object Replication Policy in the source account."
+                              },
+                              "value": "[reference('sourcePolicy').outputs.objectReplicationPolicyId.value]"
+                            },
+                            "policyId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Policy ID of the created Object Replication Policy in the source account."
+                              },
+                              "value": "[reference('sourcePolicy').outputs.policyId.value]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount",
+                        "storageAccount_blobServices"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed storage account."
+                      },
+                      "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed storage account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed storage account."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "primaryBlobEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The primary blob endpoint reference if blob services are deployed."
+                      },
+                      "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('storageAccount', '2025-06-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('storageAccount', '2025-06-01', 'full').location]"
+                    },
+                    "serviceEndpoints": {
+                      "type": "object",
+                      "metadata": {
+                        "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint."
+                      },
+                      "value": "[reference('storageAccount').primaryEndpoints]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the Storage Account."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    },
+                    "exportedSecrets": {
+                      "$ref": "#/definitions/secretsOutputType",
+                      "metadata": {
+                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                      },
+                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                    },
+                    "primaryAccessKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary access key of the storage account."
+                      },
+                      "value": "[listKeys('storageAccount', '2025-06-01').keys[0].value]"
+                    },
+                    "secondaryAccessKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary access key of the storage account."
+                      },
+                      "value": "[listKeys('storageAccount', '2025-06-01').keys[1].value]"
+                    },
+                    "primaryConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary connection string of the storage account."
+                      },
+                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2025-06-01').keys[0].value, environment().suffixes.storage)]"
+                    },
+                    "secondaryConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary connection string of the storage account."
+                      },
+                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2025-06-01').keys[1].value, environment().suffixes.storage)]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Storage Account."
+              },
+              "value": "[reference('storage').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Storage Account."
+              },
+              "value": "[reference('storage').outputs.name.value]"
+            },
+            "blobEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Primary blob endpoint."
+              },
+              "value": "[reference('storage').outputs.primaryBlobEndpoint.value]"
+            },
+            "serviceEndpoints": {
+              "type": "object",
+              "metadata": {
+                "description": "Service endpoints."
+              },
+              "value": "[reference('storage').outputs.serviceEndpoints.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "log_analytics",
+        "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageDfs)]",
+        "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageQueue)]",
+        "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageFile)]",
+        "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageBlob)]",
+        "virtualNetwork"
+      ]
+    },
+    "cosmosDBModule": {
+      "condition": "[parameters('deployCosmos')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "databaseName": {
+            "value": "km-db"
+          },
+          "containers": {
+            "value": [
+              {
+                "name": "chat_sessions",
+                "partitionKeyPath": "/user_id"
+              },
+              {
+                "name": "chat_messages",
+                "partitionKeyPath": "/session_id"
+              },
+              {
+                "name": "document_insights",
+                "partitionKeyPath": "/dataset_id"
+              },
+              {
+                "name": "enrichment_cache",
+                "partitionKeyPath": "/doc_hash"
+              }
+            ]
+          },
+          "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+          "zoneRedundant": {
+            "value": "[parameters('enableRedundancy')]"
+          },
+          "enableAutomaticFailover": {
+            "value": "[parameters('enableRedundancy')]"
+          },
+          "haLocation": {
+            "value": "[variables('cosmosDbHaLocation')]"
+          },
+          "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-cosmos-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-cosmos-{0}', variables('solutionSuffix')), 'service', 'Sql', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').cosmosDB)).outputs.resourceId.value)))))), createObject('value', createArray()))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "3082174065440100153"
+            }
+          },
+          "definitions": {
+            "_1.lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointSingleServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private Endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the Private Endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/_1.lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('cosmos-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the Cosmos DB account."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "databaseName": {
+              "type": "string",
+              "defaultValue": "db_conversation_history",
+              "metadata": {
+                "description": "Database name."
+              }
+            },
+            "containers": {
+              "type": "array",
+              "defaultValue": [
+                {
+                  "name": "conversations",
+                  "partitionKeyPath": "/userId"
+                }
+              ],
+              "metadata": {
+                "description": "Container definitions."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Diagnostic settings for monitoring."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointSingleServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "zoneRedundant": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable zone redundancy."
+              }
+            },
+            "enableAutomaticFailover": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable automatic failover."
+              }
+            },
+            "haLocation": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. HA paired region for multi-region failover when redundancy is enabled."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "resources": {
+            "cosmosAccount": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.document-db.database-account.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "capabilitiesToAdd": "[if(parameters('zoneRedundant'), createObject('value', createArray()), createObject('value', createArray('EnableServerless')))]",
+                  "sqlDatabases": {
+                    "value": [
+                      {
+                        "copy": [
+                          {
+                            "name": "containers",
+                            "count": "[length(parameters('containers'))]",
+                            "input": {
+                              "name": "[parameters('containers')[copyIndex('containers')].name]",
+                              "paths": [
+                                "[parameters('containers')[copyIndex('containers')].partitionKeyPath]"
+                              ],
+                              "kind": "Hash",
+                              "version": 2
+                            }
+                          }
+                        ],
+                        "name": "[parameters('databaseName')]"
+                      }
+                    ]
+                  },
+                  "sqlRoleAssignments": {
+                    "value": []
+                  },
+                  "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]",
+                  "networkRestrictions": {
+                    "value": {
+                      "networkAclBypass": "None",
+                      "publicNetworkAccess": "[parameters('publicNetworkAccess')]"
+                    }
+                  },
+                  "privateEndpoints": {
+                    "value": "[parameters('privateEndpoints')]"
+                  },
+                  "zoneRedundant": {
+                    "value": "[parameters('zoneRedundant')]"
+                  },
+                  "enableAutomaticFailover": {
+                    "value": "[parameters('enableAutomaticFailover')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "failoverLocations": "[if(parameters('zoneRedundant'), createObject('value', createArray(createObject('failoverPriority', 0, 'isZoneRedundant', true(), 'locationName', parameters('location')), createObject('failoverPriority', 1, 'isZoneRedundant', true(), 'locationName', parameters('haLocation')))), createObject('value', createArray(createObject('locationName', parameters('location'), 'failoverPriority', 0, 'isZoneRedundant', false()))))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.40.2.10011",
+                      "templateHash": "1772014800591596213"
+                    },
+                    "name": "Azure Cosmos DB account",
+                    "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group ID for the private endpoint group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses for the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the private endpoint output."
+                      }
+                    },
+                    "failoverLocationType": {
+                      "type": "object",
+                      "properties": {
+                        "failoverPriority": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists."
+                          }
+                        },
+                        "isZoneRedundant": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true."
+                          }
+                        },
+                        "locationName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the region."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the failover location."
+                      }
+                    },
+                    "sqlRoleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The unique name of the role assignment."
+                          }
+                        },
+                        "roleDefinitionId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription."
+                          }
+                        },
+                        "scope": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment."
+                      }
+                    },
+                    "sqlRoleDefinitionType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The unique identifier of the role-based access control definition."
+                          }
+                        },
+                        "roleName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account."
+                          }
+                        },
+                        "dataActions": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "minLength": 1,
+                          "metadata": {
+                            "description": "Required. An array of data actions that are allowed."
+                          }
+                        },
+                        "assignableScopes": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope."
+                          }
+                        },
+                        "assignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/nestedSqlRoleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. An array of role-based access control assignments to be created for the definition."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition."
+                      }
+                    },
+                    "networkRestrictionType": {
+                      "type": "object",
+                      "properties": {
+                        "ipRules": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`."
+                          }
+                        },
+                        "networkAclBypass": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureServices",
+                            "None"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"."
+                          }
+                        },
+                        "publicNetworkAccess": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"."
+                          }
+                        },
+                        "virtualNetworkRules": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "subnetResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Resource ID of a subnet."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. List of virtual network access control list (ACL) rules configured for the account."
+                          }
+                        },
+                        "networkAclBypassResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. An array that contains the Resource Ids for Network Acl Bypass for the Cosmos DB account."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the network restriction."
+                      }
+                    },
+                    "gremlinDatabaseType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the Gremlin database."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases@2024-11-15#properties/tags"
+                            },
+                            "description": "Optional. Tags of the Gremlin database resource."
+                          },
+                          "nullable": true
+                        },
+                        "graphs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/graphType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of graphs to deploy in the Gremlin database."
+                          }
+                        },
+                        "maxThroughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                          }
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a gremlin databae."
+                      }
+                    },
+                    "mongoDbType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the mongodb database."
+                          }
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                          }
+                        },
+                        "collections": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/collectionType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Collections in the mongodb database."
+                          }
+                        },
+                        "autoscaleSettings": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases@2025-04-15#properties/properties/properties/options/properties/autoscaleSettings"
+                            },
+                            "description": "Optional. Specifies the Autoscale settings. Note: Either throughput or autoscaleSettings is required, but not both."
+                          },
+                          "nullable": true
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases@2025-04-15#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a mongo databae."
+                      }
+                    },
+                    "sqlDatabaseType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the SQL database ."
+                          }
+                        },
+                        "containers": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/containerType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of containers to deploy in the SQL database."
+                          }
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                          }
+                        },
+                        "autoscaleSettingsMaxThroughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2025-04-15#properties/tags"
+                            },
+                            "description": "Optional. Tags of the SQL database resource."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a sql database."
+                      }
+                    },
+                    "tableType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the table."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/tables@2025-04-15#properties/tags"
+                            },
+                            "description": "Optional. Tags for the table."
+                          },
+                          "nullable": true
+                        },
+                        "maxThroughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
+                          }
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a table."
+                      }
+                    },
+                    "cassandraStandaloneRoleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The unique name of the role assignment."
+                          }
+                        },
+                        "roleDefinitionId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The unique identifier of the Azure Cosmos DB for Apache Cassandra native role-based access control definition."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription."
+                          }
+                        },
+                        "scope": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The data plane resource path for which access is being granted through this role-based access control assignment. Defaults to the current account."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an Azure Cosmos DB for Apache Cassandra native role-based access control assignment."
+                      }
+                    },
+                    "cassandraRoleDefinitionType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The unique identifier of the role-based access control definition."
+                          }
+                        },
+                        "roleName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. A user-friendly name for the role-based access control definition. Must be unique for the database account."
+                          }
+                        },
+                        "dataActions": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. An array of data actions that are allowed. Note: Valid data action strings are currently undocumented (API version 2025-05-01-preview). Expected to follow format similar to SQL RBAC once documented by Microsoft."
+                          }
+                        },
+                        "notDataActions": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. An array of data actions that are denied. Note: Unlike SQL RBAC, Cassandra supports deny rules for granular access control. Valid data action strings are currently undocumented (API version 2025-05-01-preview)."
+                          }
+                        },
+                        "assignableScopes": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition."
+                          }
+                        },
+                        "assignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/cassandraRoleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. An array of role-based access control assignments to be created for the definition."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an Azure Cosmos DB for Apache Cassandra native role-based access control definition."
+                      }
+                    },
+                    "cassandraKeyspaceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the Cassandra keyspace."
+                          }
+                        },
+                        "tables": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/cassandraTableType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of Cassandra tables to deploy in the keyspace."
+                          }
+                        },
+                        "views": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/cassandraViewType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of Cassandra views (materialized views) to deploy in the keyspace."
+                          }
+                        },
+                        "autoscaleSettingsMaxThroughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the keyspace level is only recommended for development/test or when workload across all tables in the shared throughput keyspace is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the table level and not at the keyspace level."
+                          }
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `autoscaleSettingsMaxThroughput`. Setting throughput at the keyspace level is only recommended for development/test or when workload across all tables in the shared throughput keyspace is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the table level and not at the keyspace level."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces@2024-11-15#properties/tags"
+                            },
+                            "description": "Optional. Tags of the Cassandra keyspace resource."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an Azure Cosmos DB Cassandra keyspace."
+                      }
+                    },
+                    "defaultIdentityType": {
+                      "type": "object",
+                      "discriminator": {
+                        "propertyName": "name",
+                        "mapping": {
+                          "FirstPartyIdentity": {
+                            "$ref": "#/definitions/defaultIdentityFirstPartyType"
+                          },
+                          "SystemAssignedIdentity": {
+                            "$ref": "#/definitions/defaultIdentitySystemAssignedType"
+                          },
+                          "UserAssignedIdentity": {
+                            "$ref": "#/definitions/defaultIdentityUserAssignedType"
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the default identity."
+                      }
+                    },
+                    "defaultIdentityFirstPartyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "FirstPartyIdentity"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of default identity to use."
+                          }
+                        }
+                      }
+                    },
+                    "defaultIdentitySystemAssignedType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "SystemAssignedIdentity"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of default identity to use."
+                          }
+                        }
+                      }
+                    },
+                    "defaultIdentityUserAssignedType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "UserAssignedIdentity"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of default identity to use."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the user assigned identity to use as the default identity."
+                          }
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "cassandraRoleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The unique identifier of the role assignment."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The unique identifier for the associated AAD principal."
+                          }
+                        },
+                        "scope": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The data plane resource path for which access is being granted. Defaults to the current account."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "cassandra-role-definition/main.bicep"
+                        }
+                      }
+                    },
+                    "cassandraTableType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the table."
+                          }
+                        },
+                        "schema": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/properties/properties/resource/properties/schema"
+                            },
+                            "description": "Required. Schema definition for the table."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/tags"
+                            },
+                            "description": "Optional. Tags for the table."
+                          },
+                          "nullable": true
+                        },
+                        "defaultTtl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Default TTL (Time To Live) in seconds for data in the table."
+                          }
+                        },
+                        "analyticalStorageTtl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Analytical TTL for the table."
+                          }
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                          }
+                        },
+                        "autoscaleSettingsMaxThroughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Maximum autoscale throughput for the table. Cannot be used with throughput."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a Cassandra table.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "cassandra-keyspace/main.bicep",
+                          "originalIdentifier": "tableType"
+                        }
+                      }
+                    },
+                    "cassandraViewType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the view."
+                          }
+                        },
+                        "viewDefinition": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. View definition (CQL statement)."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views@2025-05-01-preview#properties/tags"
+                            },
+                            "description": "Optional. Tags for the view."
+                          },
+                          "nullable": true
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                          }
+                        },
+                        "autoscaleSettingsMaxThroughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Maximum autoscale throughput for the view. Cannot be used with throughput."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a Cassandra view (materialized view).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "cassandra-keyspace/main.bicep",
+                          "originalIdentifier": "viewType"
+                        }
+                      }
+                    },
+                    "collectionType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the collection."
+                          }
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                          }
+                        },
+                        "indexes": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/indexes"
+                            },
+                            "description": "Required. Indexes for the collection."
+                          }
+                        },
+                        "shardKey": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/shardKey"
+                            },
+                            "description": "Required. ShardKey for the collection."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a collection.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "mongodb-database/main.bicep"
+                        }
+                      }
+                    },
+                    "containerType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the container."
+                          }
+                        },
+                        "analyticalStorageTtl": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                          }
+                        },
+                        "conflictResolutionPolicy": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/conflictResolutionPolicy"
+                            },
+                            "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                          },
+                          "nullable": true
+                        },
+                        "defaultTtl": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": -1,
+                          "maxValue": 2147483647,
+                          "metadata": {
+                            "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                          }
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                          }
+                        },
+                        "autoscaleSettingsMaxThroughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "maxValue": 1000000,
+                          "metadata": {
+                            "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/tags"
+                            },
+                            "description": "Optional. Tags of the SQL Database resource."
+                          },
+                          "nullable": true
+                        },
+                        "paths": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "minLength": 1,
+                          "maxLength": 3,
+                          "metadata": {
+                            "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                          }
+                        },
+                        "indexingPolicy": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                            },
+                            "description": "Optional. Indexing policy of the container."
+                          },
+                          "nullable": true
+                        },
+                        "uniqueKeyPolicyKeys": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/uniqueKeyPolicy/properties/uniqueKeys"
+                            },
+                            "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                          },
+                          "nullable": true
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Hash",
+                            "MultiHash"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                          }
+                        },
+                        "version": {
+                          "type": "int",
+                          "allowedValues": [
+                            1,
+                            2
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a container.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "sql-database/main.bicep"
+                        }
+                      }
+                    },
+                    "customerManagedKeyAndVaultOnlyType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                          }
+                        },
+                        "keyName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the customer managed key to use for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a customer-managed key. To be used if only the key vault & key may be specified.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "graphType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the graph."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/tags"
+                            },
+                            "description": "Optional. Tags of the Gremlin graph resource."
+                          },
+                          "nullable": true
+                        },
+                        "indexingPolicy": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                            },
+                            "description": "Optional. Indexing policy of the graph."
+                          },
+                          "nullable": true
+                        },
+                        "partitionKeyPaths": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/partitionKey/properties/paths"
+                            },
+                            "description": "Optional. List of paths using which data within the container can be partitioned."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a graph.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "gremlin-database/main.bicep"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "nestedSqlRoleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                          }
+                        },
+                        "scope": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the SQL Role Assignments.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "sql-role-definition/main.bicep",
+                          "originalIdentifier": "sqlRoleAssignmentType"
+                        }
+                      }
+                    },
+                    "privateEndpointMultiServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the private endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the account."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Defaults to the current resource group scope location. Location for all resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags"
+                        },
+                        "description": "Optional. Tags for the resource."
+                      },
+                      "nullable": true
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "databaseAccountOfferType": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "allowedValues": [
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The offer type for the account. Defaults to \"Standard\"."
+                      }
+                    },
+                    "failoverLocations": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/failoverLocationType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed."
+                      }
+                    },
+                    "zoneRedundant": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts."
+                      }
+                    },
+                    "defaultConsistencyLevel": {
+                      "type": "string",
+                      "defaultValue": "Session",
+                      "allowedValues": [
+                        "Eventual",
+                        "ConsistentPrefix",
+                        "Session",
+                        "BoundedStaleness",
+                        "Strong"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The default consistency level of the account. Defaults to \"Session\"."
+                      }
+                    },
+                    "disableLocalAuthentication": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true."
+                      }
+                    },
+                    "enableAnalyticalStorage": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false."
+                      }
+                    },
+                    "enableAutomaticFailover": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable automatic failover for regions. Defaults to true."
+                      }
+                    },
+                    "enableFreeTier": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false."
+                      }
+                    },
+                    "enableMultipleWriteLocations": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false."
+                      }
+                    },
+                    "disableKeyBasedMetadataWriteAccess": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true."
+                      }
+                    },
+                    "maxStalenessPrefix": {
+                      "type": "int",
+                      "defaultValue": 100000,
+                      "minValue": 1,
+                      "maxValue": 2147483647,
+                      "metadata": {
+                        "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000."
+                      }
+                    },
+                    "maxIntervalInSeconds": {
+                      "type": "int",
+                      "defaultValue": 300,
+                      "minValue": 5,
+                      "maxValue": 86400,
+                      "metadata": {
+                        "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300."
+                      }
+                    },
+                    "serverVersion": {
+                      "type": "string",
+                      "defaultValue": "4.2",
+                      "allowedValues": [
+                        "3.2",
+                        "3.6",
+                        "4.0",
+                        "4.2",
+                        "5.0",
+                        "6.0",
+                        "7.0"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"."
+                      }
+                    },
+                    "sqlDatabases": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/sqlDatabaseType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL."
+                      }
+                    },
+                    "mongodbDatabases": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/mongoDbType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU."
+                      }
+                    },
+                    "gremlinDatabases": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/gremlinDatabaseType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin."
+                      }
+                    },
+                    "tables": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/tableType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table."
+                      }
+                    },
+                    "cassandraKeyspaces": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/cassandraKeyspaceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for keyspaces when using Azure Cosmos DB for Apache Cassandra."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "totalThroughputLimit": {
+                      "type": "int",
+                      "defaultValue": -1,
+                      "metadata": {
+                        "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. An array of control plane Azure role-based access control assignments."
+                      }
+                    },
+                    "sqlRoleDefinitions": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/sqlRoleDefinitionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions."
+                      }
+                    },
+                    "sqlRoleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/sqlRoleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments."
+                      }
+                    },
+                    "cassandraRoleDefinitions": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/cassandraRoleDefinitionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configurations for Azure Cosmos DB for Apache Cassandra native role-based access control definitions. Allows the creations of custom role definitions."
+                      }
+                    },
+                    "cassandraRoleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/cassandraStandaloneRoleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Azure Cosmos DB for Apache Cassandra native data plane role-based access control assignments. Each assignment references a role definition unique identifier and a principal identifier."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings for the service."
+                      }
+                    },
+                    "capabilitiesToAdd": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "allowedValues": [
+                        "EnableCassandra",
+                        "EnableTable",
+                        "EnableGremlin",
+                        "EnableMongo",
+                        "DisableRateLimitingResponses",
+                        "EnableServerless",
+                        "EnableNoSQLVectorSearch",
+                        "EnableNoSQLFullTextSearch",
+                        "EnableMaterializedViews",
+                        "DeleteAllItemsByPartitionKey"
+                      ],
+                      "metadata": {
+                        "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account."
+                      }
+                    },
+                    "backupPolicyType": {
+                      "type": "string",
+                      "defaultValue": "Continuous",
+                      "allowedValues": [
+                        "Periodic",
+                        "Continuous"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"."
+                      }
+                    },
+                    "backupPolicyContinuousTier": {
+                      "type": "string",
+                      "defaultValue": "Continuous30Days",
+                      "allowedValues": [
+                        "Continuous30Days",
+                        "Continuous7Days"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"."
+                      }
+                    },
+                    "backupIntervalInMinutes": {
+                      "type": "int",
+                      "defaultValue": 240,
+                      "minValue": 60,
+                      "maxValue": 1440,
+                      "metadata": {
+                        "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240."
+                      }
+                    },
+                    "backupRetentionIntervalInHours": {
+                      "type": "int",
+                      "defaultValue": 8,
+                      "minValue": 2,
+                      "maxValue": 720,
+                      "metadata": {
+                        "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8."
+                      }
+                    },
+                    "backupStorageRedundancy": {
+                      "type": "string",
+                      "defaultValue": "Local",
+                      "allowedValues": [
+                        "Geo",
+                        "Local",
+                        "Zone"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointMultiServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible."
+                      }
+                    },
+                    "networkRestrictions": {
+                      "$ref": "#/definitions/networkRestrictionType",
+                      "defaultValue": {
+                        "ipRules": [],
+                        "virtualNetworkRules": [],
+                        "publicNetworkAccess": "Disabled"
+                      },
+                      "metadata": {
+                        "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`."
+                      }
+                    },
+                    "minimumTlsVersion": {
+                      "type": "string",
+                      "defaultValue": "Tls12",
+                      "allowedValues": [
+                        "Tls12"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)."
+                      }
+                    },
+                    "enableBurstCapacity": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Flag to indicate enabling/disabling of Burst Capacity feature on the account. Cannot be enabled for serverless accounts."
+                      }
+                    },
+                    "enableCassandraConnector": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enables the cassandra connector on the Cosmos DB C* account."
+                      }
+                    },
+                    "enablePartitionMerge": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Flag to enable/disable the 'Partition Merge' feature on the account."
+                      }
+                    },
+                    "enablePerRegionPerPartitionAutoscale": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Flag to enable/disable the 'PerRegionPerPartitionAutoscale' feature on the account."
+                      }
+                    },
+                    "analyticalStorageConfiguration": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.DocumentDB/databaseAccounts@2025-04-15#properties/properties/properties/analyticalStorageConfiguration"
+                        },
+                        "description": "Optional. Analytical storage specific properties."
+                      },
+                      "nullable": true
+                    },
+                    "cors": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.DocumentDB/databaseAccounts@2025-04-15#properties/properties/properties/cors"
+                        },
+                        "description": "Optional. The CORS policy for the Cosmos DB database account."
+                      },
+                      "nullable": true
+                    },
+                    "defaultIdentity": {
+                      "$ref": "#/definitions/defaultIdentityType",
+                      "defaultValue": {
+                        "name": "FirstPartyIdentity"
+                      },
+                      "metadata": {
+                        "description": "Optional. The default identity for accessing key vault used in features like customer managed keys. Use `FirstPartyIdentity` to use the tenant-level CosmosDB enterprise application. The default identity needs to be explicitly set by the users."
+                      }
+                    },
+                    "customerManagedKey": {
+                      "$ref": "#/definitions/customerManagedKeyAndVaultOnlyType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The customer managed key definition. If specified, the parameter `defaultIdentity` must be configured as well."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(variables('formattedUserAssignedIdentities'))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(variables('formattedUserAssignedIdentities'))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInControlPlaneRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]",
+                      "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
+                      "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]",
+                      "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]",
+                      "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    },
+                    "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                  },
+                  "resources": {
+                    "cMKKeyVault::cMKKey": {
+                      "condition": "[and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults/keys",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(parameters('customerManagedKey').keyVaultResourceId, '/')[2]]",
+                      "resourceGroup": "[split(parameters('customerManagedKey').keyVaultResourceId, '/')[4]]",
+                      "name": "[format('{0}/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName)]"
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-07-01",
+                      "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.19.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "cMKKeyVault": {
+                      "condition": "[and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(parameters('customerManagedKey').keyVaultResourceId, '/')[2]]",
+                      "resourceGroup": "[split(parameters('customerManagedKey').keyVaultResourceId, '/')[4]]",
+                      "name": "[last(split(parameters('customerManagedKey').keyVaultResourceId, '/'))]"
+                    },
+                    "databaseAccount": {
+                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                      "apiVersion": "2025-04-15",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]",
+                      "properties": "[shallowMerge(createArray(createObject('enableBurstCapacity', if(not(contains(coalesce(parameters('capabilitiesToAdd'), createArray()), 'EnableServerless')), parameters('enableBurstCapacity'), false()), 'databaseAccountOfferType', parameters('databaseAccountOfferType'), 'analyticalStorageConfiguration', parameters('analyticalStorageConfiguration'), 'defaultIdentity', if(and(not(empty(parameters('defaultIdentity'))), not(equals(tryGet(parameters('defaultIdentity'), 'name'), 'UserAssignedIdentity'))), parameters('defaultIdentity').name, format('UserAssignedIdentity={0}', tryGet(parameters('defaultIdentity'), 'resourceId'))), 'keyVaultKeyUri', if(not(empty(parameters('customerManagedKey'))), if(not(variables('isHSMManagedCMK')), format('{0}', reference('cMKKeyVault::cMKKey').keyUri), format('https://{0}.managedhsm.azure.net/keys/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName)), null()), 'enablePartitionMerge', parameters('enablePartitionMerge'), 'enablePerRegionPerPartitionAutoscale', parameters('enablePerRegionPerPartitionAutoscale'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability'))))), if(not(empty(parameters('cors'))), createObject('cors', parameters('cors')), createObject()), if(contains(coalesce(parameters('capabilitiesToAdd'), createArray()), 'EnableCassandra'), createObject('connectorOffer', if(parameters('enableCassandraConnector'), 'Small', null()), 'enableCassandraConnector', parameters('enableCassandraConnector')), createObject()), createObject('minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant'))))), if(or(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), not(empty(parameters('cassandraKeyspaces')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'networkAclBypassResourceIds', tryGet(parameters('networkRestrictions'), 'networkAclBypassResourceIds'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('enableAutomaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('cassandraKeyspaces')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]",
+                      "dependsOn": [
+                        "cMKKeyVault::cMKKey"
+                      ]
+                    },
+                    "databaseAccount_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_diagnosticSettings": {
+                      "copy": {
+                        "name": "databaseAccount_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_roleAssignments": {
+                      "copy": {
+                        "name": "databaseAccount_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_sqlDatabases": {
+                      "copy": {
+                        "name": "databaseAccount_sqlDatabases",
+                        "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]"
+                          },
+                          "containers": {
+                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]"
+                          },
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "autoscaleSettingsMaxThroughput": {
+                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "3972888645334640168"
+                            },
+                            "name": "DocumentDB Database Account SQL Databases",
+                            "description": "This module deploys a SQL Database in a CosmosDB Account."
+                          },
+                          "definitions": {
+                            "containerType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the container."
+                                  }
+                                },
+                                "analyticalStorageTtl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                                  }
+                                },
+                                "conflictResolutionPolicy": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/conflictResolutionPolicy"
+                                    },
+                                    "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                                  },
+                                  "nullable": true
+                                },
+                                "defaultTtl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "minValue": -1,
+                                  "maxValue": 2147483647,
+                                  "metadata": {
+                                    "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                  }
+                                },
+                                "autoscaleSettingsMaxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "maxValue": 1000000,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the SQL Database resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "paths": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "minLength": 1,
+                                  "maxLength": 3,
+                                  "metadata": {
+                                    "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                                  }
+                                },
+                                "indexingPolicy": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                    },
+                                    "description": "Optional. Indexing policy of the container."
+                                  },
+                                  "nullable": true
+                                },
+                                "uniqueKeyPolicyKeys": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/uniqueKeyPolicy/properties/uniqueKeys"
+                                    },
+                                    "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                                  },
+                                  "nullable": true
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Hash",
+                                    "MultiHash"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                                  }
+                                },
+                                "version": {
+                                  "type": "int",
+                                  "allowedValues": [
+                                    1,
+                                    2
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a container."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the SQL database ."
+                              }
+                            },
+                            "containers": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/containerType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of containers to deploy in the SQL database."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                              }
+                            },
+                            "autoscaleSettingsMaxThroughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2025-04-15#properties/tags"
+                                },
+                                "description": "Optional. Tags of the SQL database resource."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2025-04-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "sqlDatabase": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                              "apiVersion": "2025-04-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "resource": {
+                                  "id": "[parameters('name')]"
+                                },
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "container": {
+                              "copy": {
+                                "name": "container",
+                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "sqlDatabaseName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
+                                  },
+                                  "analyticalStorageTtl": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]"
+                                  },
+                                  "autoscaleSettingsMaxThroughput": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                  },
+                                  "conflictResolutionPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]"
+                                  },
+                                  "defaultTtl": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]"
+                                  },
+                                  "indexingPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]"
+                                  },
+                                  "kind": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]"
+                                  },
+                                  "version": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]"
+                                  },
+                                  "paths": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]"
+                                  },
+                                  "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]",
+                                  "uniqueKeyPolicyKeys": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "4781880351108045502"
+                                    },
+                                    "name": "DocumentDB Database Account SQL Database Containers",
+                                    "description": "This module deploys a SQL Database Container in a CosmosDB Account."
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "sqlDatabaseName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the container."
+                                      }
+                                    },
+                                    "analyticalStorageTtl": {
+                                      "type": "int",
+                                      "defaultValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                                      }
+                                    },
+                                    "conflictResolutionPolicy": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/conflictResolutionPolicy"
+                                        },
+                                        "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "defaultTtl": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": -1,
+                                      "maxValue": 2147483647,
+                                      "metadata": {
+                                        "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "defaultValue": 400,
+                                      "metadata": {
+                                        "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                      }
+                                    },
+                                    "autoscaleSettingsMaxThroughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "maxValue": 1000000,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the SQL Database resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "paths": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 3,
+                                      "metadata": {
+                                        "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                                      }
+                                    },
+                                    "indexingPolicy": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                        },
+                                        "description": "Optional. Indexing policy of the container."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "uniqueKeyPolicyKeys": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/uniqueKeyPolicy/properties/uniqueKeys"
+                                        },
+                                        "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "defaultValue": "Hash",
+                                      "allowedValues": [
+                                        "Hash",
+                                        "MultiHash"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                                      }
+                                    },
+                                    "version": {
+                                      "type": "int",
+                                      "defaultValue": 1,
+                                      "allowedValues": [
+                                        1,
+                                        2
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "partitionKeyPaths",
+                                        "count": "[length(parameters('paths'))]",
+                                        "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]"
+                                      }
+                                    ]
+                                  },
+                                  "resources": {
+                                    "databaseAccount::sqlDatabase": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]"
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "container": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "resource": "[shallowMerge(createArray(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'id', parameters('name'), 'indexingPolicy', parameters('indexingPolicy'), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()), if(not(equals(parameters('defaultTtl'), null())), createObject('defaultTtl', parameters('defaultTtl')), createObject())))]",
+                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the container."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the container."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the container was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "sqlDatabase"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the SQL database."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the SQL database."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the SQL database was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_sqlRoleDefinitions": {
+                      "copy": {
+                        "name": "databaseAccount_sqlRoleDefinitions",
+                        "count": "[length(coalesce(parameters('sqlRoleDefinitions'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "dataActions": {
+                            "value": "[coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].dataActions]"
+                          },
+                          "roleName": {
+                            "value": "[coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].roleName]"
+                          },
+                          "assignableScopes": {
+                            "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]"
+                          },
+                          "sqlRoleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'assignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "8514367433037227852"
+                            },
+                            "name": "DocumentDB Database Account SQL Role Definitions.",
+                            "description": "This module deploys a SQL Role Definision in a CosmosDB Account."
+                          },
+                          "definitions": {
+                            "sqlRoleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                  }
+                                },
+                                "scope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the SQL Role Assignments."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The unique identifier of the Role Definition."
+                              }
+                            },
+                            "roleName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account."
+                              }
+                            },
+                            "dataActions": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "minLength": 1,
+                              "metadata": {
+                                "description": "Required. An array of data actions that are allowed."
+                              }
+                            },
+                            "assignableScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account."
+                              }
+                            },
+                            "sqlRoleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/sqlRoleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "enableReferencedModulesTelemetry": false
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "sqlRoleDefinition": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]",
+                              "properties": {
+                                "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]",
+                                "permissions": [
+                                  {
+                                    "dataActions": "[parameters('dataActions')]"
+                                  }
+                                ],
+                                "roleName": "[parameters('roleName')]",
+                                "type": "CustomRole"
+                              }
+                            },
+                            "databaseAccount_sqlRoleAssignments": {
+                              "copy": {
+                                "name": "databaseAccount_sqlRoleAssignments",
+                                "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "roleDefinitionIdOrName": {
+                                    "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]"
+                                  },
+                                  "principalId": {
+                                    "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "11817543900771838380"
+                                    },
+                                    "name": "DocumentDB Database Account SQL Role Assignments.",
+                                    "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                      }
+                                    },
+                                    "principalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                      }
+                                    },
+                                    "roleDefinitionIdOrName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier of the associated SQL Role Definition."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "scope": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInDataPlaneRoleNames": {
+                                      "Cosmos DB Built-in Data Reader": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000001', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]",
+                                      "Cosmos DB Built-in Data Contributor": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
+                                    },
+                                    "formattedRoleDefinition": "[coalesce(tryGet(variables('builtInDataPlaneRoleNames'), parameters('roleDefinitionIdOrName')), if(contains(parameters('roleDefinitionIdOrName'), '/sqlRoleDefinitions/'), parameters('roleDefinitionIdOrName'), format('{0}/sqlRoleDefinitions/{1}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('roleDefinitionIdOrName'))))]",
+                                    "formattedScope": "[replace(replace(coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))), '/sqlDatabases/', '/dbs/'), '/containers/', '/colls/')]"
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "sqlRoleAssignment": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope'))))]",
+                                      "properties": {
+                                        "principalId": "[parameters('principalId')]",
+                                        "roleDefinitionId": "[variables('formattedRoleDefinition')]",
+                                        "scope": "[variables('formattedScope')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the SQL Role Assignment."
+                                      },
+                                      "value": "[coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope')))]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the SQL Role Assignment."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope'))))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the SQL Role Definition was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "sqlRoleDefinition"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the SQL Role Definition."
+                              },
+                              "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName')))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the SQL Role Definition."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the SQL Role Definition was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "roleName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The role name of the SQL Role Definition."
+                              },
+                              "value": "[reference('sqlRoleDefinition').roleName]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_sqlRoleAssignments": {
+                      "copy": {
+                        "name": "databaseAccount_sqlRoleAssignments",
+                        "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "roleDefinitionIdOrName": {
+                            "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                          },
+                          "principalId": {
+                            "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "scope": {
+                            "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'scope')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "11817543900771838380"
+                            },
+                            "name": "DocumentDB Database Account SQL Role Assignments.",
+                            "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                              }
+                            },
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                              }
+                            },
+                            "roleDefinitionIdOrName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The unique identifier of the associated SQL Role Definition."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "scope": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "builtInDataPlaneRoleNames": {
+                              "Cosmos DB Built-in Data Reader": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000001', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]",
+                              "Cosmos DB Built-in Data Contributor": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
+                            },
+                            "formattedRoleDefinition": "[coalesce(tryGet(variables('builtInDataPlaneRoleNames'), parameters('roleDefinitionIdOrName')), if(contains(parameters('roleDefinitionIdOrName'), '/sqlRoleDefinitions/'), parameters('roleDefinitionIdOrName'), format('{0}/sqlRoleDefinitions/{1}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('roleDefinitionIdOrName'))))]",
+                            "formattedScope": "[replace(replace(coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))), '/sqlDatabases/', '/dbs/'), '/containers/', '/colls/')]"
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "sqlRoleAssignment": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope'))))]",
+                              "properties": {
+                                "principalId": "[parameters('principalId')]",
+                                "roleDefinitionId": "[variables('formattedRoleDefinition')]",
+                                "scope": "[variables('formattedScope')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the SQL Role Assignment."
+                              },
+                              "value": "[coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope')))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the SQL Role Assignment."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope'))))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the SQL Role Definition was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount",
+                        "databaseAccount_sqlDatabases",
+                        "databaseAccount_sqlRoleDefinitions"
+                      ]
+                    },
+                    "databaseAccount_cassandraRoleDefinitions": {
+                      "copy": {
+                        "name": "databaseAccount_cassandraRoleDefinitions",
+                        "count": "[length(coalesce(parameters('cassandraRoleDefinitions'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-cassandra-rd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "roleName": {
+                            "value": "[coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()].roleName]"
+                          },
+                          "dataActions": {
+                            "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]"
+                          },
+                          "notDataActions": {
+                            "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'notDataActions')]"
+                          },
+                          "assignableScopes": {
+                            "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]"
+                          },
+                          "cassandraRoleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'assignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "10787709019875067397"
+                            },
+                            "name": "DocumentDB Database Account Cassandra Role Definitions.",
+                            "description": "This module deploys a Cassandra Role Definition in a CosmosDB Account."
+                          },
+                          "definitions": {
+                            "cassandraRoleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The unique identifier of the role assignment."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The unique identifier for the associated AAD principal."
+                                  }
+                                },
+                                "scope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The data plane resource path for which access is being granted. Defaults to the current account."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The unique identifier of the Role Definition."
+                              }
+                            },
+                            "roleName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account."
+                              }
+                            },
+                            "dataActions": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. An array of data actions that are allowed. Note: Valid data action strings for Cassandra API are currently undocumented (as of API version 2025-05-01-preview). Please refer to official Azure documentation once available."
+                              }
+                            },
+                            "notDataActions": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. An array of data actions that are denied. Note: Unlike SQL RBAC, Cassandra RBAC supports deny rules (notDataActions) for granular access control. Valid data action strings are currently undocumented (as of API version 2025-05-01-preview)."
+                              }
+                            },
+                            "assignableScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Keyspace. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account."
+                              }
+                            },
+                            "cassandraRoleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/cassandraRoleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. An array of Cassandra Role Assignments to be created for the Cassandra Role Definition."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "cassandraRoleDefinition": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions",
+                              "apiVersion": "2025-05-01-preview",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]",
+                              "properties": {
+                                "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]",
+                                "permissions": [
+                                  {
+                                    "dataActions": "[parameters('dataActions')]",
+                                    "notDataActions": "[parameters('notDataActions')]"
+                                  }
+                                ],
+                                "roleName": "[parameters('roleName')]",
+                                "type": "CustomRole"
+                              }
+                            },
+                            "databaseAccount_cassandraRoleAssignments": {
+                              "copy": {
+                                "name": "databaseAccount_cassandraRoleAssignments",
+                                "count": "[length(coalesce(parameters('cassandraRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-cassandra-ra-{1}', uniqueString(deployment().name), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "roleDefinitionId": {
+                                    "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]"
+                                  },
+                                  "principalId": {
+                                    "value": "[coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "scope": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()], 'scope')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "14764024820910071147"
+                                    },
+                                    "name": "DocumentDB Database Account Cassandra Role Assignments.",
+                                    "description": "This module deploys a Cassandra Role Assignment in a CosmosDB Account."
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name unique identifier of the Cassandra Role Assignment."
+                                      }
+                                    },
+                                    "principalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                      }
+                                    },
+                                    "roleDefinitionId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier of the associated Cassandra Role Definition."
+                                      }
+                                    },
+                                    "scope": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The data plane resource path for which access is being granted through this Cassandra Role Assignment. Defaults to the current account."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "cassandraRoleAssignment": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments",
+                                      "apiVersion": "2025-05-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
+                                      "properties": {
+                                        "principalId": "[parameters('principalId')]",
+                                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                        "scope": "[coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Cassandra Role Assignment."
+                                      },
+                                      "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Cassandra Role Assignment."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the Cassandra Role Assignment was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "cassandraRoleDefinition"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the cassandra role definition."
+                              },
+                              "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName')))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the cassandra role definition."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the cassandra role definition was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_cassandraRoleAssignments": {
+                      "copy": {
+                        "name": "databaseAccount_cassandraRoleAssignments",
+                        "count": "[length(coalesce(parameters('cassandraRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-cassandra-ra-{1}', uniqueString(deployment().name), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                          },
+                          "principalId": {
+                            "value": "[coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()].principalId]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "scope": {
+                            "value": "[tryGet(coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()], 'scope')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "14764024820910071147"
+                            },
+                            "name": "DocumentDB Database Account Cassandra Role Assignments.",
+                            "description": "This module deploys a Cassandra Role Assignment in a CosmosDB Account."
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Name unique identifier of the Cassandra Role Assignment."
+                              }
+                            },
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The unique identifier of the associated Cassandra Role Definition."
+                              }
+                            },
+                            "scope": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The data plane resource path for which access is being granted through this Cassandra Role Assignment. Defaults to the current account."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "cassandraRoleAssignment": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments",
+                              "apiVersion": "2025-05-01-preview",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
+                              "properties": {
+                                "principalId": "[parameters('principalId')]",
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "scope": "[coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Cassandra Role Assignment."
+                              },
+                              "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Cassandra Role Assignment."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the Cassandra Role Assignment was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount",
+                        "databaseAccount_cassandraKeyspaces",
+                        "databaseAccount_cassandraRoleDefinitions"
+                      ]
+                    },
+                    "databaseAccount_mongodbDatabases": {
+                      "copy": {
+                        "name": "databaseAccount_mongodbDatabases",
+                        "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "collections": {
+                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]"
+                          },
+                          "autoscaleSettings": {
+                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'autoscaleSettings')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "13897098552792121791"
+                            },
+                            "name": "DocumentDB Database Account MongoDB Databases",
+                            "description": "This module deploys a MongoDB Database within a CosmosDB Account."
+                          },
+                          "definitions": {
+                            "collectionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the collection."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                  }
+                                },
+                                "indexes": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/indexes"
+                                    },
+                                    "description": "Required. Indexes for the collection."
+                                  }
+                                },
+                                "shardKey": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/shardKey"
+                                    },
+                                    "description": "Required. ShardKey for the collection."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a collection."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the mongodb database."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "defaultValue": 400,
+                              "metadata": {
+                                "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                              }
+                            },
+                            "collections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/collectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Collections in the mongodb database."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases@2025-04-15#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "autoscaleSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases@2025-04-15#properties/properties/properties/options/properties/autoscaleSettings"
+                                },
+                                "description": "Optional. Specifies the Autoscale settings. Note: Either throughput or autoscaleSettings is required, but not both."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2025-04-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "mongodbDatabase": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
+                              "apiVersion": "2025-04-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "resource": {
+                                  "id": "[parameters('name')]"
+                                },
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput'), 'autoscaleSettings', parameters('autoscaleSettings')))]"
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "mongodbDatabase_collections": {
+                              "copy": {
+                                "name": "mongodbDatabase_collections",
+                                "count": "[length(coalesce(parameters('collections'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "mongodbDatabaseName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]"
+                                  },
+                                  "indexes": {
+                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]"
+                                  },
+                                  "shardKey": {
+                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]"
+                                  },
+                                  "throughput": {
+                                    "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "16151461445994734468"
+                                    },
+                                    "name": "DocumentDB Database Account MongoDB Database Collections",
+                                    "description": "This module deploys a MongoDB Database Collection."
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "mongodbDatabaseName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the collection."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "defaultValue": 400,
+                                      "metadata": {
+                                        "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                      }
+                                    },
+                                    "indexes": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/indexes"
+                                        },
+                                        "description": "Required. Indexes for the collection."
+                                      }
+                                    },
+                                    "shardKey": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/shardKey"
+                                        },
+                                        "description": "Required. ShardKey for the collection."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]",
+                                      "properties": {
+                                        "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2025-04-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]",
+                                        "resource": {
+                                          "id": "[parameters('name')]",
+                                          "indexes": "[parameters('indexes')]",
+                                          "shardKey": "[parameters('shardKey')]"
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the mongodb database collection."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the mongodb database collection."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the mongodb database collection was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "mongodbDatabase"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the mongodb database."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the mongodb database."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the mongodb database was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_gremlinDatabases": {
+                      "copy": {
+                        "name": "databaseAccount_gremlinDatabases",
+                        "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "graphs": {
+                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]"
+                          },
+                          "maxThroughput": {
+                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "11959636451300474346"
+                            },
+                            "name": "DocumentDB Database Account Gremlin Databases",
+                            "description": "This module deploys a Gremlin Database within a CosmosDB Account."
+                          },
+                          "definitions": {
+                            "graphType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the graph."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the Gremlin graph resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "indexingPolicy": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                    },
+                                    "description": "Optional. Indexing policy of the graph."
+                                  },
+                                  "nullable": true
+                                },
+                                "partitionKeyPaths": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/partitionKey/properties/paths"
+                                    },
+                                    "description": "Optional. List of paths using which data within the container can be partitioned."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a graph."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Gremlin database."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases@2024-11-15#properties/tags"
+                                },
+                                "description": "Optional. Tags of the Gremlin database resource."
+                              },
+                              "nullable": true
+                            },
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "graphs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/graphType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of graphs to deploy in the Gremlin database."
+                              }
+                            },
+                            "maxThroughput": {
+                              "type": "int",
+                              "defaultValue": 4000,
+                              "metadata": {
+                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2025-04-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "gremlinDatabase": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                              "apiVersion": "2025-04-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                "resource": {
+                                  "id": "[parameters('name')]"
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "gremlinDatabase_gremlinGraphs": {
+                              "copy": {
+                                "name": "gremlinDatabase_gremlinGraphs",
+                                "count": "[length(coalesce(parameters('graphs'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('graphs'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('graphs'), createArray())[copyIndex()].name]"
+                                  },
+                                  "gremlinDatabaseName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "indexingPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('graphs'), createArray())[copyIndex()], 'indexingPolicy')]"
+                                  },
+                                  "partitionKeyPaths": {
+                                    "value": "[tryGet(coalesce(parameters('graphs'), createArray())[copyIndex()], 'partitionKeyPaths')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "10487122333182352122"
+                                    },
+                                    "name": "DocumentDB Database Accounts Gremlin Databases Graphs",
+                                    "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the graph."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the Gremlin graph resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "gremlinDatabaseName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "indexingPolicy": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                        },
+                                        "description": "Optional. Indexing policy of the graph."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "partitionKeyPaths": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/partitionKey/properties/paths"
+                                        },
+                                        "description": "Optional. List of paths using which data within the container can be partitioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount::gremlinDatabase": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]"
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "gremlinGraph": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "resource": {
+                                          "id": "[parameters('name')]",
+                                          "indexingPolicy": "[parameters('indexingPolicy')]",
+                                          "partitionKey": {
+                                            "paths": "[parameters('partitionKeyPaths')]"
+                                          }
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the graph."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the graph."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the graph was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "gremlinDatabase"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Gremlin database."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Gremlin database."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the Gremlin database was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_tables": {
+                      "copy": {
+                        "name": "databaseAccount_tables",
+                        "count": "[length(coalesce(parameters('tables'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "maxThroughput": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "1787500858429182824"
+                            },
+                            "name": "Azure Cosmos DB account tables",
+                            "description": "This module deploys a table within an Azure Cosmos DB Account."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the table."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.DocumentDB/databaseAccounts/tables@2025-04-15#properties/tags"
+                                },
+                                "description": "Optional. Tags for the table."
+                              },
+                              "nullable": true
+                            },
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "maxThroughput": {
+                              "type": "int",
+                              "defaultValue": 4000,
+                              "metadata": {
+                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2025-04-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "table": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/tables",
+                              "apiVersion": "2025-04-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                "resource": {
+                                  "id": "[parameters('name')]"
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the table."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the table."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the table was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_cassandraKeyspaces": {
+                      "copy": {
+                        "name": "databaseAccount_cassandraKeyspaces",
+                        "count": "[length(coalesce(parameters('cassandraKeyspaces'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-cassandradb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()].name]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "tables": {
+                            "value": "[tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'tables')]"
+                          },
+                          "views": {
+                            "value": "[tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'views')]"
+                          },
+                          "autoscaleSettingsMaxThroughput": {
+                            "value": "[tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'throughput')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "15257396763463366586"
+                            },
+                            "name": "DocumentDB Database Account Cassandra Keyspaces",
+                            "description": "This module deploys a Cassandra Keyspace within a CosmosDB Account."
+                          },
+                          "definitions": {
+                            "tableType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the table."
+                                  }
+                                },
+                                "schema": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/properties/properties/resource/properties/schema"
+                                    },
+                                    "description": "Required. Schema definition for the table."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags for the table."
+                                  },
+                                  "nullable": true
+                                },
+                                "defaultTtl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default TTL (Time To Live) in seconds for data in the table."
+                                  }
+                                },
+                                "analyticalStorageTtl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Analytical TTL for the table."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                                  }
+                                },
+                                "autoscaleSettingsMaxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum autoscale throughput for the table. Cannot be used with throughput."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a Cassandra table."
+                              }
+                            },
+                            "viewType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the view."
+                                  }
+                                },
+                                "viewDefinition": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. View definition (CQL statement)."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views@2025-05-01-preview#properties/tags"
+                                    },
+                                    "description": "Optional. Tags for the view."
+                                  },
+                                  "nullable": true
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                                  }
+                                },
+                                "autoscaleSettingsMaxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum autoscale throughput for the view. Cannot be used with throughput."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a Cassandra view (materialized view)."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Cassandra keyspace."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces@2024-11-15#properties/tags"
+                                },
+                                "description": "Optional. Tags of the Cassandra keyspace resource."
+                              },
+                              "nullable": true
+                            },
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Cosmos DB account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "tables": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/tableType"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Array of Cassandra tables to deploy in the keyspace."
+                              }
+                            },
+                            "views": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/viewType"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Array of Cassandra views (materialized views) to deploy in the keyspace."
+                              }
+                            },
+                            "autoscaleSettingsMaxThroughput": {
+                              "type": "int",
+                              "defaultValue": 4000,
+                              "metadata": {
+                                "description": "Optional. Maximum autoscale throughput for the keyspace. If not set, autoscale will be disabled. Setting throughput at the keyspace level is only recommended for development/test or when workload across all tables in the shared throughput keyspace is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the table level."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput. Setting throughput at the keyspace level is only recommended for development/test or when workload across all tables in the shared throughput keyspace is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the table level."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "cassandraKeyspace": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                "resource": {
+                                  "id": "[parameters('name')]"
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "cassandraKeyspace_tables": {
+                              "copy": {
+                                "name": "cassandraKeyspace_tables",
+                                "count": "[length(parameters('tables'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-cassandradb-{1}', uniqueString(deployment().name, parameters('name')), parameters('tables')[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('tables')[copyIndex()].name]"
+                                  },
+                                  "cassandraKeyspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "schema": {
+                                    "value": "[parameters('tables')[copyIndex()].schema]"
+                                  },
+                                  "analyticalStorageTtl": {
+                                    "value": "[tryGet(parameters('tables')[copyIndex()], 'analyticalStorageTtl')]"
+                                  },
+                                  "throughput": {
+                                    "value": "[tryGet(parameters('tables')[copyIndex()], 'throughput')]"
+                                  },
+                                  "autoscaleSettingsMaxThroughput": {
+                                    "value": "[tryGet(parameters('tables')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                  },
+                                  "defaultTtl": {
+                                    "value": "[tryGet(parameters('tables')[copyIndex()], 'defaultTtl')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('tables')[copyIndex()], 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "15998065591386988132"
+                                    },
+                                    "name": "DocumentDB Database Account Cassandra Keyspaces Tables",
+                                    "description": "This module deploys a Cassandra Table within a Cassandra Keyspace in a CosmosDB Account."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the Cassandra table."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the Cassandra table resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "cassandraKeyspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Cassandra Keyspace. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "schema": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/properties/properties/resource/properties/schema"
+                                        },
+                                        "description": "Required. Schema definition for the Cassandra table."
+                                      }
+                                    },
+                                    "analyticalStorageTtl": {
+                                      "type": "int",
+                                      "defaultValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Analytical TTL for the table. Default to 0 (disabled). Analytical store is enabled when set to a value other than 0. If set to -1, analytical store retains all historical data."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput. If not specified, the table will inherit throughput from the keyspace."
+                                      }
+                                    },
+                                    "autoscaleSettingsMaxThroughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Maximum autoscale throughput for the table. Cannot be used with throughput. If not specified, the table will inherit throughput from the keyspace."
+                                      }
+                                    },
+                                    "defaultTtl": {
+                                      "type": "int",
+                                      "defaultValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Default time to live in seconds. Default to 0 (disabled). If set to -1, items do not expire."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount::cassandraKeyspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'))]"
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "cassandraTable": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "resource": {
+                                          "id": "[parameters('name')]",
+                                          "schema": "[parameters('schema')]",
+                                          "defaultTtl": "[parameters('defaultTtl')]",
+                                          "analyticalStorageTtl": "[parameters('analyticalStorageTtl')]"
+                                        },
+                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(and(equals(parameters('throughput'), null()), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null()), 'throughput', parameters('throughput')))]"
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Cassandra table."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Cassandra table."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the Cassandra table was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "cassandraKeyspace"
+                              ]
+                            },
+                            "cassandraKeyspace_views": {
+                              "copy": {
+                                "name": "cassandraKeyspace_views",
+                                "count": "[length(parameters('views'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-cassandraview-{1}', uniqueString(deployment().name, parameters('name')), parameters('views')[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('views')[copyIndex()].name]"
+                                  },
+                                  "cassandraKeyspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "viewDefinition": {
+                                    "value": "[parameters('views')[copyIndex()].viewDefinition]"
+                                  },
+                                  "throughput": {
+                                    "value": "[tryGet(parameters('views')[copyIndex()], 'throughput')]"
+                                  },
+                                  "autoscaleSettingsMaxThroughput": {
+                                    "value": "[tryGet(parameters('views')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('views')[copyIndex()], 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "6617803098467821091"
+                                    },
+                                    "name": "DocumentDB Database Account Cassandra Keyspaces Views",
+                                    "description": "This module deploys a Cassandra View (Materialized View) within a Cassandra Keyspace in a CosmosDB Account."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the Cassandra view."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views@2025-05-01-preview#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the Cassandra view resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "cassandraKeyspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Cassandra Keyspace. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "viewDefinition": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. View definition of the Cassandra view. This is the CQL statement that defines the materialized view."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                                      }
+                                    },
+                                    "autoscaleSettingsMaxThroughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Maximum autoscale throughput for the view. Cannot be used with throughput."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount::cassandraKeyspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces",
+                                      "apiVersion": "2025-05-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'))]"
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2025-05-01-preview",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "cassandraView": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views",
+                                      "apiVersion": "2025-05-01-preview",
+                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "location": "[parameters('location')]",
+                                      "properties": {
+                                        "resource": {
+                                          "id": "[parameters('name')]",
+                                          "viewDefinition": "[parameters('viewDefinition')]"
+                                        },
+                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(and(equals(parameters('throughput'), null()), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null()), 'throughput', parameters('throughput')))]"
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Cassandra view."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Cassandra view."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the Cassandra view was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "cassandraKeyspace"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Cassandra keyspace."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Cassandra keyspace."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces', parameters('databaseAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the Cassandra keyspace was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_privateEndpoints": {
+                      "copy": {
+                        "name": "databaseAccount_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.5.1644",
+                              "templateHash": "16604612898799598358"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private dns zone group."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a private DNS zone group configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                },
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              },
+                              "nullable": true
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                },
+                                "description": "Optional. Custom DNS configurations."
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-10-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "24141742673128945"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private DNS zone group configuration."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "privateDnsZoneConfigs",
+                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "properties": {
+                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                              }
+                                            }
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                  "output": true
+                                },
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the database account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the database account."
+                      },
+                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the database account was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('databaseAccount', '2025-04-15', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('databaseAccount', '2025-04-15', 'full').location]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The endpoint of the database account."
+                      },
+                      "value": "[reference('databaseAccount').documentEndpoint]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the database account."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    },
+                    "primaryReadWriteKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary read-write key."
+                      },
+                      "value": "[listKeys('databaseAccount', '2025-04-15').primaryMasterKey]"
+                    },
+                    "primaryReadOnlyKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary read-only key."
+                      },
+                      "value": "[listKeys('databaseAccount', '2025-04-15').primaryReadonlyMasterKey]"
+                    },
+                    "primaryReadWriteConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary read-write connection string."
+                      },
+                      "value": "[listConnectionStrings('databaseAccount', '2025-04-15').connectionStrings[0].connectionString]"
+                    },
+                    "primaryReadOnlyConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary read-only connection string."
+                      },
+                      "value": "[listConnectionStrings('databaseAccount', '2025-04-15').connectionStrings[2].connectionString]"
+                    },
+                    "secondaryReadWriteKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary read-write key."
+                      },
+                      "value": "[listKeys('databaseAccount', '2025-04-15').secondaryMasterKey]"
+                    },
+                    "secondaryReadOnlyKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary read-only key."
+                      },
+                      "value": "[listKeys('databaseAccount', '2025-04-15').secondaryReadonlyMasterKey]"
+                    },
+                    "secondaryReadWriteConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary read-write connection string."
+                      },
+                      "value": "[listConnectionStrings('databaseAccount', '2025-04-15').connectionStrings[1].connectionString]"
+                    },
+                    "secondaryReadOnlyConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary read-only connection string."
+                      },
+                      "value": "[listConnectionStrings('databaseAccount', '2025-04-15').connectionStrings[3].connectionString]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Cosmos DB account."
+              },
+              "value": "[reference('cosmosAccount').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Cosmos DB account."
+              },
+              "value": "[reference('cosmosAccount').outputs.name.value]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the Cosmos DB account."
+              },
+              "value": "[format('https://{0}.documents.azure.com:443/', parameters('name'))]"
+            },
+            "databaseName": {
+              "type": "string",
+              "metadata": {
+                "description": "Database name."
+              },
+              "value": "[parameters('databaseName')]"
+            },
+            "containerName": {
+              "type": "string",
+              "metadata": {
+                "description": "Container name (first container)."
+              },
+              "value": "[parameters('containers')[0].name]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "log_analytics",
+        "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').cosmosDB)]",
+        "virtualNetwork"
+      ]
+    },
+    "sqlDBModule": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.sql-db.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "name": {
+            "value": "[format('sql-{0}', variables('solutionSuffix'))]"
+          },
+          "databaseName": {
+            "value": "[format('sqldb-{0}', variables('solutionSuffix'))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "deployerPrincipalId": {
+            "value": "[variables('deployingUserPrincipalId')]"
+          },
+          "deployerPrincipalName": {
+            "value": "[variables('deployingUserPrincipalName')]"
+          },
+          "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-sql-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-sql-{0}', variables('solutionSuffix')), 'service', 'sqlServer', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').sqlServer)).outputs.resourceId.value)))))), createObject('value', createArray()))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "7082930119694232055"
+            }
+          },
+          "definitions": {
+            "_1.lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointSingleServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private Endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the Private Endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/_1.lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('sql-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the SQL Server."
+              }
+            },
+            "databaseName": {
+              "type": "string",
+              "defaultValue": "[format('sqldb-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the SQL Database."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "deployerPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "Principal ID of the deployer for admin access."
+              }
+            },
+            "deployerPrincipalName": {
+              "type": "string",
+              "metadata": {
+                "description": "Principal name of the deployer for admin access."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "GP_S_Gen5",
+              "metadata": {
+                "description": "SKU name for the database."
+              }
+            },
+            "skuTier": {
+              "type": "string",
+              "defaultValue": "GeneralPurpose",
+              "metadata": {
+                "description": "SKU tier for the database."
+              }
+            },
+            "skuFamily": {
+              "type": "string",
+              "defaultValue": "Gen5",
+              "metadata": {
+                "description": "SKU family."
+              }
+            },
+            "skuCapacity": {
+              "type": "int",
+              "defaultValue": 2,
+              "metadata": {
+                "description": "vCore capacity."
+              }
+            },
+            "autoPauseDelay": {
+              "type": "int",
+              "defaultValue": 60,
+              "metadata": {
+                "description": "Auto-pause delay in minutes."
+              }
+            },
+            "minCapacity": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Minimum capacity (vCores)."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointSingleServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "resources": {
+            "sqlServer": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.sql.server.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "minimalTlsVersion": {
+                    "value": "1.2"
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "restrictOutboundNetworkAccess": {
+                    "value": "Disabled"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "administrators": {
+                    "value": {
+                      "azureADOnlyAuthentication": true,
+                      "login": "[parameters('deployerPrincipalName')]",
+                      "principalType": "User",
+                      "sid": "[parameters('deployerPrincipalId')]",
+                      "tenantId": "[subscription().tenantId]"
+                    }
+                  },
+                  "databases": {
+                    "value": [
+                      {
+                        "name": "[parameters('databaseName')]",
+                        "availabilityZone": -1,
+                        "collation": "SQL_Latin1_General_CP1_CI_AS",
+                        "autoPauseDelay": "[parameters('autoPauseDelay')]",
+                        "minCapacity": "[format('{0}', parameters('minCapacity'))]",
+                        "zoneRedundant": false,
+                        "sku": {
+                          "name": "[parameters('skuName')]",
+                          "tier": "[parameters('skuTier')]",
+                          "family": "[parameters('skuFamily')]",
+                          "capacity": "[parameters('skuCapacity')]"
+                        }
+                      }
+                    ]
+                  },
+                  "firewallRules": "[if(equals(parameters('publicNetworkAccess'), 'Enabled'), createObject('value', createArray(createObject('name', 'AllowSpecificRange', 'startIpAddress', '0.0.0.0', 'endIpAddress', '255.255.255.255'), createObject('name', 'AllowAllAzureServicesAndResourcesWithinAzureIps', 'startIpAddress', '0.0.0.0', 'endIpAddress', '0.0.0.0'))), createObject('value', createArray()))]",
+                  "privateEndpoints": {
+                    "value": "[parameters('privateEndpoints')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.39.26.7824",
+                      "templateHash": "6339757823399774705"
+                    },
+                    "name": "Azure SQL Servers",
+                    "description": "This module deploys an Azure SQL Server."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a private endpoint output."
+                      }
+                    },
+                    "auditSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the name of the audit settings."
+                          }
+                        },
+                        "auditActionsAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the Actions-Groups and Actions to audit."
+                          }
+                        },
+                        "isAzureMonitorTargetEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether audit events are sent to Azure Monitor."
+                          }
+                        },
+                        "isDevopsAuditEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the state of devops audit. If state is Enabled, devops logs will be sent to Azure Monitor."
+                          }
+                        },
+                        "isManagedIdentityInUse": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether Managed Identity is used to access blob storage."
+                          }
+                        },
+                        "isStorageSecondaryKeyInUse": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether storageAccountAccessKey value is the storage's secondary key."
+                          }
+                        },
+                        "queueDelayMs": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the amount of time in milliseconds that can elapse before audit actions are forced to be processed."
+                          }
+                        },
+                        "retentionDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the number of days to keep in the audit logs in the storage account."
+                          }
+                        },
+                        "state": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the state of the audit. If state is Enabled, storageEndpoint or isAzureMonitorTargetEnabled are required."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the identifier key of the auditing storage account."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for audit settings."
+                      }
+                    },
+                    "secretsExportConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the key vault where to store the secrets of this module."
+                          }
+                        },
+                        "sqlAdminPasswordSecretName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The sqlAdminPassword secret name to create."
+                          }
+                        },
+                        "sqlAzureConnectionStringSecretName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The sqlAzureConnectionString secret name to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a secrets export configuration."
+                      }
+                    },
+                    "serverExternalAdministratorType": {
+                      "type": "object",
+                      "properties": {
+                        "administratorType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "ActiveDirectory"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Type of the sever administrator."
+                          }
+                        },
+                        "azureADOnlyAuthentication": {
+                          "type": "bool",
+                          "metadata": {
+                            "description": "Required. Azure Active Directory only Authentication enabled."
+                          }
+                        },
+                        "login": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Login name of the server administrator."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Application",
+                            "Group",
+                            "User"
+                          ],
+                          "metadata": {
+                            "description": "Required. Principal Type of the sever administrator."
+                          }
+                        },
+                        "sid": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. SID (object ID) of the server administrator."
+                          }
+                        },
+                        "tenantId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tenant ID of the administrator."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a sever-external administrator."
+                      }
+                    },
+                    "databaseType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the Elastic Pool."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Sql/servers/databases@2023-08-01#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The lock settings of the database."
+                          }
+                        },
+                        "managedIdentities": {
+                          "$ref": "#/definitions/managedIdentityOnlyUserAssignedType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The managed identities for the database."
+                          }
+                        },
+                        "sku": {
+                          "$ref": "#/definitions/databaseSkuType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The database SKU."
+                          }
+                        },
+                        "autoPauseDelay": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Time in minutes after which database is automatically paused. A value of -1 means that automatic pause is disabled."
+                          }
+                        },
+                        "availabilityZone": {
+                          "type": "int",
+                          "allowedValues": [
+                            -1,
+                            1,
+                            2,
+                            3
+                          ],
+                          "metadata": {
+                            "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                          }
+                        },
+                        "catalogCollation": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Collation of the metadata catalog."
+                          }
+                        },
+                        "collation": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The collation of the database."
+                          }
+                        },
+                        "createMode": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Copy",
+                            "Default",
+                            "OnlineSecondary",
+                            "PointInTimeRestore",
+                            "Recovery",
+                            "Restore",
+                            "RestoreExternalBackup",
+                            "RestoreExternalBackupSecondary",
+                            "RestoreLongTermRetentionBackup",
+                            "Secondary"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the mode of database creation."
+                          }
+                        },
+                        "elasticPoolResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource identifier of the elastic pool containing this database."
+                          }
+                        },
+                        "customerManagedKey": {
+                          "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The customer managed key definition for database TDE."
+                          }
+                        },
+                        "federatedClientId": {
+                          "type": "string",
+                          "nullable": true,
+                          "minLength": 36,
+                          "maxLength": 36,
+                          "metadata": {
+                            "description": "Optional. The Client id used for cross tenant per database CMK scenario."
+                          }
+                        },
+                        "freeLimitExhaustionBehavior": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AutoPause",
+                            "BillOverUsage"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the behavior when monthly free limits are exhausted for the free database."
+                          }
+                        },
+                        "highAvailabilityReplicaCount": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The number of secondary replicas associated with the database that are used to provide high availability. Not applicable to a Hyperscale database within an elastic pool."
+                          }
+                        },
+                        "isLedgerOn": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether or not this database is a ledger database, which means all tables in the database are ledger tables."
+                          }
+                        },
+                        "licenseType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "BasePrice",
+                            "LicenseIncluded"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The license type to apply for this database."
+                          }
+                        },
+                        "longTermRetentionBackupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource identifier of the long term retention backup associated with create operation of this database."
+                          }
+                        },
+                        "maintenanceConfigurationId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Maintenance configuration id assigned to the database. This configuration defines the period when the maintenance updates will occur."
+                          }
+                        },
+                        "manualCutover": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether or not customer controlled manual cutover needs to be done during Update Database operation to Hyperscale tier."
+                          }
+                        },
+                        "maxSizeBytes": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The max size of the database expressed in bytes."
+                          }
+                        },
+                        "minCapacity": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Minimal capacity that database will always have allocated, if not paused."
+                          }
+                        },
+                        "performCutover": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. To trigger customer controlled manual cutover during the wait state while Scaling operation is in progress."
+                          }
+                        },
+                        "preferredEnclaveType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Default",
+                            "VBS"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Type of enclave requested on the database."
+                          }
+                        },
+                        "readScale": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The state of read-only routing. If enabled, connections that have application intent set to readonly in their connection string may be routed to a readonly secondary replica in the same region. Not applicable to a Hyperscale database within an elastic pool."
+                          }
+                        },
+                        "recoverableDatabaseResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource identifier of the recoverable database associated with create operation of this database."
+                          }
+                        },
+                        "recoveryServicesRecoveryPointResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource identifier of the recovery point associated with create operation of this database."
+                          }
+                        },
+                        "requestedBackupStorageRedundancy": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Geo",
+                            "GeoZone",
+                            "Local",
+                            "Zone"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The storage account type to be used to store backups for this database."
+                          }
+                        },
+                        "restorableDroppedDatabaseResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource identifier of the restorable dropped database associated with create operation of this database."
+                          }
+                        },
+                        "restorePointInTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the point in time (ISO8601 format) of the source database that will be restored to create the new database."
+                          }
+                        },
+                        "sampleName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the sample schema to apply when creating this database."
+                          }
+                        },
+                        "secondaryType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Geo",
+                            "Named",
+                            "Standby"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The secondary type of the database if it is a secondary."
+                          }
+                        },
+                        "sourceDatabaseDeletionDate": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the time that the database was deleted."
+                          }
+                        },
+                        "sourceDatabaseResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource identifier of the source database associated with create operation of this database."
+                          }
+                        },
+                        "sourceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource identifier of the source associated with the create operation of this database."
+                          }
+                        },
+                        "useFreeLimit": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether or not the database uses free monthly limits. Allowed on one database in a subscription."
+                          }
+                        },
+                        "zoneRedundant": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether or not this database is zone redundant, which means the replicas of this database will be spread across multiple availability zones."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the service."
+                          }
+                        },
+                        "backupShortTermRetentionPolicy": {
+                          "$ref": "#/definitions/shortTermBackupRetentionPolicyType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The short term backup retention policy for the database."
+                          }
+                        },
+                        "backupLongTermRetentionPolicy": {
+                          "$ref": "#/definitions/longTermBackupRetentionPolicyType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The long term backup retention policy for the database."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a database."
+                      }
+                    },
+                    "elasticPoolType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the Elastic Pool."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags of the resource."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The lock settings of the elastic pool."
+                          }
+                        },
+                        "sku": {
+                          "$ref": "#/definitions/skuType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The elastic pool SKU."
+                          }
+                        },
+                        "autoPauseDelay": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Time in minutes after which elastic pool is automatically paused. A value of -1 means that automatic pause is disabled."
+                          }
+                        },
+                        "availabilityZone": {
+                          "type": "int",
+                          "allowedValues": [
+                            -1,
+                            1,
+                            2,
+                            3
+                          ],
+                          "metadata": {
+                            "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                          }
+                        },
+                        "highAvailabilityReplicaCount": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The number of secondary replicas associated with the elastic pool that are used to provide high availability. Applicable only to Hyperscale elastic pools."
+                          }
+                        },
+                        "licenseType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "BasePrice",
+                            "LicenseIncluded"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The license type to apply for this elastic pool."
+                          }
+                        },
+                        "maintenanceConfigurationId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Maintenance configuration id assigned to the elastic pool. This configuration defines the period when the maintenance updates will will occur."
+                          }
+                        },
+                        "maxSizeBytes": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The storage limit for the database elastic pool in bytes."
+                          }
+                        },
+                        "minCapacity": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Minimal capacity that serverless pool will not shrink below, if not paused."
+                          }
+                        },
+                        "perDatabaseSettings": {
+                          "$ref": "#/definitions/perDatabaseSettingsType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The per database settings for the elastic pool."
+                          }
+                        },
+                        "preferredEnclaveType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Default",
+                            "VBS"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Type of enclave requested on the elastic pool."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "zoneRedundant": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether or not this elastic pool is zone redundant, which means the replicas of this elastic pool will be spread across multiple availability zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an elastic pool property."
+                      }
+                    },
+                    "vulnerabilityAssessmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the vulnerability assessment."
+                          }
+                        },
+                        "recurringScans": {
+                          "$ref": "#/definitions/recurringScansType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The recurring scans settings."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the storage account to store the scan reports."
+                          }
+                        },
+                        "useStorageAccountAccessKey": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether to use the storage account access key to access the storage account."
+                          }
+                        },
+                        "createStorageRoleAssignment": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether to create a role assignment for the storage account."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a vulnerability assessment."
+                      }
+                    },
+                    "firewallRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the firewall rule."
+                          }
+                        },
+                        "startIpAddress": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The start IP address of the firewall rule. Must be IPv4 format. Use value '0.0.0.0' for all Azure-internal IP addresses."
+                          }
+                        },
+                        "endIpAddress": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. Use value '0.0.0.0' for all Azure-internal IP addresses."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a firewall rule."
+                      }
+                    },
+                    "keyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the key. Must follow the [<keyVaultName>_<keyName>_<keyVersion>] pattern."
+                          }
+                        },
+                        "serverKeyType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureKeyVault",
+                            "ServiceManaged"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The server key type."
+                          }
+                        },
+                        "uri": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The URI of the server key. If the ServerKeyType is AzureKeyVault, then the URI is required. The AKV URI is required to be in this format: 'https://YourVaultName.azure.net/keys/YourKeyName/YourKeyVersion'."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a key."
+                      }
+                    },
+                    "virtualNetworkRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the Server Virtual Network Rule."
+                          }
+                        },
+                        "virtualNetworkSubnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the virtual network subnet."
+                          }
+                        },
+                        "ignoreMissingVnetServiceEndpoint": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Allow creating a firewall rule before the virtual network has vnet service endpoint enabled."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a virtual network rule."
+                      }
+                    },
+                    "securityAlertPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the Security Alert Policy."
+                          }
+                        },
+                        "disabledAlerts": {
+                          "type": "array",
+                          "allowedValues": [
+                            "Access_Anomaly",
+                            "Brute_Force",
+                            "Data_Exfiltration",
+                            "Sql_Injection",
+                            "Sql_Injection_Vulnerability",
+                            "Unsafe_Action"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Alerts to disable."
+                          }
+                        },
+                        "emailAccountAdmins": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies that the alert is sent to the account administrators."
+                          }
+                        },
+                        "emailAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies an array of email addresses to which the alert is sent."
+                          }
+                        },
+                        "retentionDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the number of days to keep in the Threat Detection audit logs."
+                          }
+                        },
+                        "state": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the state of the policy, whether it is enabled or disabled or a policy has not been applied yet on the specific database."
+                          }
+                        },
+                        "storageAccountAccessKey": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the identifier key of the Threat Detection audit storage account."
+                          }
+                        },
+                        "storageEndpoint": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the blob storage endpoint. This blob storage will hold all Threat Detection audit logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a security alert policy."
+                      }
+                    },
+                    "failoverGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the failover group."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags of the resource."
+                          }
+                        },
+                        "databases": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. List of databases in the failover group."
+                          }
+                        },
+                        "partnerServerResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. List of the partner server Resource Id for the failover group."
+                          }
+                        },
+                        "readOnlyEndpoint": {
+                          "$ref": "#/definitions/readOnlyEndpointType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Read-only endpoint of the failover group instance."
+                          }
+                        },
+                        "readWriteEndpoint": {
+                          "$ref": "#/definitions/readWriteEndpointType",
+                          "metadata": {
+                            "description": "Required. Read-write endpoint of the failover group instance."
+                          }
+                        },
+                        "secondaryType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Geo",
+                            "Standby"
+                          ],
+                          "metadata": {
+                            "description": "Required. Databases secondary type on partner server."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a failover group."
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.secretSetOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "secretResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resourceId of the exported secret."
+                          }
+                        },
+                        "secretUri": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI of the exported secret."
+                          }
+                        },
+                        "secretUriWithVersion": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI with version of the exported secret."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "customerManagedKeyWithAutoRotateType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                          }
+                        },
+                        "keyName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the customer managed key to use for encryption."
+                          }
+                        },
+                        "keyVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                          }
+                        },
+                        "autoRotationEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                          }
+                        },
+                        "userAssignedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "databaseSkuType": {
+                      "type": "object",
+                      "properties": {
+                        "capacity": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The capacity of the particular SKU."
+                          }
+                        },
+                        "family": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the SKU, typically, a letter + Number code, e.g. P3."
+                          }
+                        },
+                        "size": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Size of the particular SKU."
+                          }
+                        },
+                        "tier": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The tier or edition of the particular SKU, e.g. Basic, Premium."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The database SKU.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "database/main.bicep"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "longTermBackupRetentionPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "monthlyRetention": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Monthly retention in ISO 8601 duration format."
+                          }
+                        },
+                        "weeklyRetention": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Weekly retention in ISO 8601 duration format."
+                          }
+                        },
+                        "weekOfYear": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Week of year backup to keep for yearly retention."
+                          }
+                        },
+                        "yearlyRetention": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Yearly retention in ISO 8601 duration format."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The long-term backup retention policy for the database.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "database/main.bicep"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "managedIdentityOnlyUserAssignedType": {
+                      "type": "object",
+                      "properties": {
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if only user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "perDatabaseSettingsType": {
+                      "type": "object",
+                      "properties": {
+                        "autoPauseDelay": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Auto Pause Delay for per database within pool."
+                          }
+                        },
+                        "maxCapacity": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The maximum capacity any one database can consume. Examples: '0.5', '2'."
+                          }
+                        },
+                        "minCapacity": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The minimum capacity all databases are guaranteed. Examples: '0.5', '1'."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The per database settings for the elastic pool.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "elastic-pool/main.bicep"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "readOnlyEndpointType": {
+                      "type": "object",
+                      "properties": {
+                        "failoverPolicy": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "metadata": {
+                            "description": "Required. Failover policy of the read-only endpoint for the failover group."
+                          }
+                        },
+                        "targetServer": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The target partner server where the read-only endpoint points to."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a read-only endpoint.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "failover-group/main.bicep"
+                        }
+                      }
+                    },
+                    "readWriteEndpointType": {
+                      "type": "object",
+                      "properties": {
+                        "failoverPolicy": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Automatic",
+                            "Manual"
+                          ],
+                          "metadata": {
+                            "description": "Required. Failover policy of the read-write endpoint for the failover group. If failoverPolicy is Automatic then failoverWithDataLossGracePeriodMinutes is required."
+                          }
+                        },
+                        "failoverWithDataLossGracePeriodMinutes": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Grace period before failover with data loss is attempted for the read-write endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a read-write endpoint.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "failover-group/main.bicep"
+                        }
+                      }
+                    },
+                    "recurringScansType": {
+                      "type": "object",
+                      "properties": {
+                        "emails": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. Specifies an array of e-mail addresses to which the scan notification is sent."
+                          }
+                        },
+                        "emailSubscriptionAdmins": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies that the schedule scan notification will be sent to the subscription administrators."
+                          }
+                        },
+                        "isEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Recurring scans state."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for recurring scans.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "vulnerability-assessment/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "secretsOutputType": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": {
+                        "$ref": "#/definitions/_1.secretSetOutputType",
+                        "metadata": {
+                          "description": "An exported secret's references."
+                        }
+                      },
+                      "metadata": {
+                        "description": "A map of the exported secrets",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "shortTermBackupRetentionPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "diffBackupIntervalInHours": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Differential backup interval in hours. For Hyperscale tiers this value will be ignored."
+                          }
+                        },
+                        "retentionDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Point-in-time retention in days."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The short-term backup retention policy for the database.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "database/main.bicep"
+                        }
+                      }
+                    },
+                    "skuType": {
+                      "type": "object",
+                      "properties": {
+                        "capacity": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The capacity of the particular SKU."
+                          }
+                        },
+                        "family": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "BC_DC",
+                            "BC_Gen5",
+                            "BasicPool",
+                            "GP_DC",
+                            "GP_FSv2",
+                            "GP_Gen5",
+                            "HS_Gen5",
+                            "HS_MOPRMS",
+                            "HS_PRMS",
+                            "PremiumPool",
+                            "ServerlessPool",
+                            "StandardPool"
+                          ],
+                          "metadata": {
+                            "description": "Required. The name of the SKU, typically, a letter + Number code, e.g. P3."
+                          }
+                        },
+                        "size": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Size of the particular SKU."
+                          }
+                        },
+                        "tier": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The tier or edition of the particular SKU, e.g. Basic, Premium."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The elastic pool SKU.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "elastic-pool/main.bicep"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "administratorLogin": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. The administrator username for the server. Required if no `administrators` object for AAD authentication is provided."
+                      }
+                    },
+                    "administratorLoginPassword": {
+                      "type": "securestring",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. The administrator login password. Required if no `administrators` object for AAD authentication is provided."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the server."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "primaryUserAssignedIdentityResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. The resource ID of a user assigned identity to be used by default. Required if \"userAssignedIdentities\" is not empty."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Sql/servers@2023-08-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "databases": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/databaseType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The databases to create in the server."
+                      }
+                    },
+                    "elasticPools": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/elasticPoolType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The Elastic Pools to create in the server."
+                      }
+                    },
+                    "firewallRules": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/firewallRuleType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The firewall rules to create in the server."
+                      }
+                    },
+                    "virtualNetworkRules": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/virtualNetworkRuleType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The virtual network rules to create in the server."
+                      }
+                    },
+                    "securityAlertPolicies": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/securityAlertPolicyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The security alert policies to create in the server."
+                      }
+                    },
+                    "keys": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/keyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The keys to configure."
+                      }
+                    },
+                    "customerManagedKey": {
+                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The customer managed key definition for server TDE."
+                      }
+                    },
+                    "administrators": {
+                      "$ref": "#/definitions/serverExternalAdministratorType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. The Azure Active Directory (AAD) administrator authentication. Required if no `administratorLogin` & `administratorLoginPassword` is provided."
+                      }
+                    },
+                    "federatedClientId": {
+                      "type": "string",
+                      "nullable": true,
+                      "minLength": 36,
+                      "maxLength": 36,
+                      "metadata": {
+                        "description": "Optional. The Client id used for cross tenant CMK scenario."
+                      }
+                    },
+                    "minimalTlsVersion": {
+                      "type": "string",
+                      "defaultValue": "1.2",
+                      "allowedValues": [
+                        "1.0",
+                        "1.1",
+                        "1.2",
+                        "1.3"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Minimal TLS version allowed."
+                      }
+                    },
+                    "isIPv6Enabled": {
+                      "type": "string",
+                      "defaultValue": "Disabled",
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not to enable IPv6 support for this server."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "allowedValues": [
+                        "",
+                        "Enabled",
+                        "Disabled",
+                        "SecuredByPerimeter"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and neither firewall rules nor virtual network rules are set."
+                      }
+                    },
+                    "restrictOutboundNetworkAccess": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not to restrict outbound network access for this server."
+                      }
+                    },
+                    "connectionPolicy": {
+                      "type": "string",
+                      "defaultValue": "Default",
+                      "allowedValues": [
+                        "Default",
+                        "Redirect",
+                        "Proxy"
+                      ],
+                      "metadata": {
+                        "description": "Optional. SQL logical server connection policy."
+                      }
+                    },
+                    "vulnerabilityAssessmentsObj": {
+                      "$ref": "#/definitions/vulnerabilityAssessmentType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The vulnerability assessment configuration."
+                      }
+                    },
+                    "auditSettings": {
+                      "$ref": "#/definitions/auditSettingsType",
+                      "defaultValue": {
+                        "state": "Enabled"
+                      },
+                      "metadata": {
+                        "description": "Optional. The audit settings configuration. If you want to disable auditing, set the parmaeter to an empty object."
+                      }
+                    },
+                    "secretsExportConfiguration": {
+                      "$ref": "#/definitions/secretsExportConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                      }
+                    },
+                    "failoverGroups": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/failoverGroupType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The failover groups configuration."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "enableReferencedModulesTelemetry": false,
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                      "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                      "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+                      "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                      "Reservation Purchaser": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f7b75c60-3036-4b75-91c3-6b41c27c1689')]",
+                      "Resource Policy Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '36243c78-bf99-498c-9df9-86d9f8d28608')]",
+                      "SQL DB Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9b7fa17d-e63e-47b0-bb0a-15c516ac86ec')]",
+                      "SQL Security Manager": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '056cd41c-7e88-42e1-933e-88ba6a50c9c3')]",
+                      "SQL Server Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437')]",
+                      "SqlDb Migration Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '189207d4-bb67-4208-a635-b06afe8b2c57')]"
+                    },
+                    "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                  },
+                  "resources": {
+                    "cMKKeyVault::cMKKey": {
+                      "condition": "[and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults/keys",
+                      "apiVersion": "2025-05-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                    },
+                    "cMKKeyVault": {
+                      "condition": "[and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2025-05-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.sql-server.{0}.{1}', replace('0.21.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "server": {
+                      "type": "Microsoft.Sql/servers",
+                      "apiVersion": "2023-08-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "administratorLogin": "[parameters('administratorLogin')]",
+                        "administratorLoginPassword": "[parameters('administratorLoginPassword')]",
+                        "administrators": "[union(createObject('administratorType', 'ActiveDirectory'), coalesce(parameters('administrators'), createObject()))]",
+                        "federatedClientId": "[parameters('federatedClientId')]",
+                        "isIPv6Enabled": "[parameters('isIPv6Enabled')]",
+                        "keyId": "[if(not(equals(parameters('customerManagedKey'), null())), if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), if(not(variables('isHSMManagedCMK')), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), format('https://{0}.managedhsm.azure.net/keys/{1}/{2}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName, parameters('customerManagedKey').keyVersion)), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault::cMKKey').keyUri, format('https://{0}.managedhsm.azure.net/keys/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName)), if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault::cMKKey').keyUriWithVersion, fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.')))), null())]",
+                        "version": "12.0",
+                        "minimalTlsVersion": "[parameters('minimalTlsVersion')]",
+                        "primaryUserAssignedIdentityId": "[parameters('primaryUserAssignedIdentityResourceId')]",
+                        "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(and(not(empty(parameters('privateEndpoints'))), empty(parameters('firewallRules'))), empty(parameters('virtualNetworkRules'))), 'Disabled', null()))]",
+                        "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]"
+                      },
+                      "dependsOn": [
+                        "cMKKeyVault::cMKKey"
+                      ]
+                    },
+                    "server_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Sql/servers/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "server_roleAssignments": {
+                      "copy": {
+                        "name": "server_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Sql/servers/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Sql/servers', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "server_connection_policy": {
+                      "type": "Microsoft.Sql/servers/connectionPolicies",
+                      "apiVersion": "2023-08-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'default')]",
+                      "properties": {
+                        "connectionType": "[parameters('connectionPolicy')]"
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "server_databases": {
+                      "copy": {
+                        "name": "server_databases",
+                        "count": "[length(coalesce(parameters('databases'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-DB-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('databases'), createArray())[copyIndex()].name]"
+                          },
+                          "managedIdentities": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'managedIdentities')]"
+                          },
+                          "sku": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sku')]"
+                          },
+                          "autoPauseDelay": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'autoPauseDelay')]"
+                          },
+                          "availabilityZone": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'availabilityZone')]"
+                          },
+                          "catalogCollation": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'catalogCollation')]"
+                          },
+                          "collation": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'collation')]"
+                          },
+                          "createMode": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'createMode')]"
+                          },
+                          "elasticPoolResourceId": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'elasticPoolResourceId')]"
+                          },
+                          "customerManagedKey": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'customerManagedKey')]"
+                          },
+                          "federatedClientId": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'federatedClientId')]"
+                          },
+                          "freeLimitExhaustionBehavior": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'freeLimitExhaustionBehavior')]"
+                          },
+                          "highAvailabilityReplicaCount": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'highAvailabilityReplicaCount')]"
+                          },
+                          "isLedgerOn": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'isLedgerOn')]"
+                          },
+                          "licenseType": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'licenseType')]"
+                          },
+                          "lock": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'lock')]"
+                          },
+                          "longTermRetentionBackupResourceId": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'longTermRetentionBackupResourceId')]"
+                          },
+                          "maintenanceConfigurationId": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'maintenanceConfigurationId')]"
+                          },
+                          "manualCutover": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'manualCutover')]"
+                          },
+                          "maxSizeBytes": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'maxSizeBytes')]"
+                          },
+                          "minCapacity": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'minCapacity')]"
+                          },
+                          "performCutover": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'performCutover')]"
+                          },
+                          "preferredEnclaveType": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'preferredEnclaveType')]"
+                          },
+                          "readScale": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'readScale')]"
+                          },
+                          "recoverableDatabaseResourceId": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'recoverableDatabaseResourceId')]"
+                          },
+                          "recoveryServicesRecoveryPointResourceId": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'recoveryServicesRecoveryPointResourceId')]"
+                          },
+                          "requestedBackupStorageRedundancy": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'requestedBackupStorageRedundancy')]"
+                          },
+                          "restorableDroppedDatabaseResourceId": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'restorableDroppedDatabaseResourceId')]"
+                          },
+                          "restorePointInTime": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'restorePointInTime')]"
+                          },
+                          "sampleName": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sampleName')]"
+                          },
+                          "secondaryType": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'secondaryType')]"
+                          },
+                          "sourceDatabaseDeletionDate": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sourceDatabaseDeletionDate')]"
+                          },
+                          "sourceDatabaseResourceId": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sourceDatabaseResourceId')]"
+                          },
+                          "sourceResourceId": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sourceResourceId')]"
+                          },
+                          "useFreeLimit": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'useFreeLimit')]"
+                          },
+                          "zoneRedundant": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'zoneRedundant')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'diagnosticSettings')]"
+                          },
+                          "backupShortTermRetentionPolicy": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'backupShortTermRetentionPolicy')]"
+                          },
+                          "backupLongTermRetentionPolicy": {
+                            "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'backupLongTermRetentionPolicy')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "15166565101356255378"
+                            },
+                            "name": "SQL Server Database",
+                            "description": "This module deploys an Azure SQL Server Database."
+                          },
+                          "definitions": {
+                            "databaseSkuType": {
+                              "type": "object",
+                              "properties": {
+                                "capacity": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The capacity of the particular SKU."
+                                  }
+                                },
+                                "family": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the SKU, typically, a letter + Number code, e.g. P3."
+                                  }
+                                },
+                                "size": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Size of the particular SKU."
+                                  }
+                                },
+                                "tier": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The tier or edition of the particular SKU, e.g. Basic, Premium."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The database SKU."
+                              }
+                            },
+                            "shortTermBackupRetentionPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "diffBackupIntervalInHours": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Differential backup interval in hours. For Hyperscale tiers this value will be ignored."
+                                  }
+                                },
+                                "retentionDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Point-in-time retention in days."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The short-term backup retention policy for the database."
+                              }
+                            },
+                            "longTermBackupRetentionPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "monthlyRetention": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Monthly retention in ISO 8601 duration format."
+                                  }
+                                },
+                                "weeklyRetention": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Weekly retention in ISO 8601 duration format."
+                                  }
+                                },
+                                "weekOfYear": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Week of year backup to keep for yearly retention."
+                                  }
+                                },
+                                "yearlyRetention": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Yearly retention in ISO 8601 duration format."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The long-term backup retention policy for the database."
+                              }
+                            },
+                            "customerManagedKeyWithAutoRotateType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                  }
+                                },
+                                "keyName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the customer managed key to use for encryption."
+                                  }
+                                },
+                                "keyVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                                  }
+                                },
+                                "autoRotationEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                                  }
+                                },
+                                "userAssignedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "managedIdentityOnlyUserAssignedType": {
+                              "type": "object",
+                              "properties": {
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if only user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the database."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "sku": {
+                              "$ref": "#/definitions/databaseSkuType",
+                              "defaultValue": {
+                                "name": "GP_Gen5_2",
+                                "tier": "GeneralPurpose"
+                              },
+                              "metadata": {
+                                "description": "Optional. The database SKU."
+                              }
+                            },
+                            "autoPauseDelay": {
+                              "type": "int",
+                              "defaultValue": -1,
+                              "metadata": {
+                                "description": "Optional. Time in minutes after which database is automatically paused. A value of -1 means that automatic pause is disabled."
+                              }
+                            },
+                            "availabilityZone": {
+                              "type": "int",
+                              "allowedValues": [
+                                -1,
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                              }
+                            },
+                            "catalogCollation": {
+                              "type": "string",
+                              "defaultValue": "DATABASE_DEFAULT",
+                              "metadata": {
+                                "description": "Optional. Collation of the metadata catalog."
+                              }
+                            },
+                            "collation": {
+                              "type": "string",
+                              "defaultValue": "SQL_Latin1_General_CP1_CI_AS",
+                              "metadata": {
+                                "description": "Optional. The collation of the database."
+                              }
+                            },
+                            "createMode": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Copy",
+                                "Default",
+                                "OnlineSecondary",
+                                "PointInTimeRestore",
+                                "Recovery",
+                                "Restore",
+                                "RestoreExternalBackup",
+                                "RestoreExternalBackupSecondary",
+                                "RestoreLongTermRetentionBackup",
+                                "Secondary"
+                              ],
+                              "defaultValue": "Default",
+                              "metadata": {
+                                "description": "Optional. Specifies the mode of database creation."
+                              }
+                            },
+                            "elasticPoolResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the elastic pool containing this database."
+                              }
+                            },
+                            "federatedClientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "minLength": 36,
+                              "maxLength": 36,
+                              "metadata": {
+                                "description": "Optional. The Client id used for cross tenant per database CMK scenario."
+                              }
+                            },
+                            "freeLimitExhaustionBehavior": {
+                              "type": "string",
+                              "allowedValues": [
+                                "AutoPause",
+                                "BillOverUsage"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the behavior when monthly free limits are exhausted for the free database."
+                              }
+                            },
+                            "highAvailabilityReplicaCount": {
+                              "type": "int",
+                              "defaultValue": 0,
+                              "metadata": {
+                                "description": "Optional. The number of readonly secondary replicas associated with the database."
+                              }
+                            },
+                            "isLedgerOn": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Whether or not this database is a ledger database, which means all tables in the database are ledger tables. Note: the value of this property cannot be changed after the database has been created."
+                              }
+                            },
+                            "licenseType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "BasePrice",
+                                "LicenseIncluded"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The license type to apply for this database."
+                              }
+                            },
+                            "longTermRetentionBackupResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource identifier of the long term retention backup associated with create operation of this database."
+                              }
+                            },
+                            "maintenanceConfigurationId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Maintenance configuration ID assigned to the database. This configuration defines the period when the maintenance updates will occur."
+                              }
+                            },
+                            "manualCutover": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Whether or not customer controlled manual cutover needs to be done during Update Database operation to Hyperscale tier."
+                              }
+                            },
+                            "maxSizeBytes": {
+                              "type": "int",
+                              "defaultValue": 34359738368,
+                              "metadata": {
+                                "description": "Optional. The max size of the database expressed in bytes."
+                              }
+                            },
+                            "minCapacity": {
+                              "type": "string",
+                              "defaultValue": "0",
+                              "metadata": {
+                                "description": "Optional. Minimal capacity that database will always have allocated."
+                              }
+                            },
+                            "performCutover": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. To trigger customer controlled manual cutover during the wait state while Scaling operation is in progress."
+                              }
+                            },
+                            "preferredEnclaveType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Default",
+                                "VBS"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Type of enclave requested on the database i.e. Default or VBS enclaves."
+                              }
+                            },
+                            "readScale": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "defaultValue": "Disabled",
+                              "metadata": {
+                                "description": "Optional. The state of read-only routing."
+                              }
+                            },
+                            "recoverableDatabaseResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource identifier of the recoverable database associated with create operation of this database."
+                              }
+                            },
+                            "recoveryServicesRecoveryPointResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource identifier of the recovery point associated with create operation of this database."
+                              }
+                            },
+                            "requestedBackupStorageRedundancy": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Geo",
+                                "GeoZone",
+                                "Local",
+                                "Zone"
+                              ],
+                              "defaultValue": "Local",
+                              "metadata": {
+                                "description": "Optional. The storage account type to be used to store backups for this database."
+                              }
+                            },
+                            "restorableDroppedDatabaseResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource identifier of the restorable dropped database associated with create operation of this database."
+                              }
+                            },
+                            "restorePointInTime": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Point in time (ISO8601 format) of the source database to restore when createMode set to Restore or PointInTimeRestore."
+                              }
+                            },
+                            "sampleName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The name of the sample schema to apply when creating this database."
+                              }
+                            },
+                            "secondaryType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Geo",
+                                "Named",
+                                "Standby"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The secondary type of the database if it is a secondary."
+                              }
+                            },
+                            "sourceDatabaseDeletionDate": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The time that the database was deleted when restoring a deleted database."
+                              }
+                            },
+                            "sourceDatabaseResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource identifier of the source database associated with create operation of this database."
+                              }
+                            },
+                            "sourceResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource identifier of the source associated with the create operation of this database."
+                              }
+                            },
+                            "useFreeLimit": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Whether or not the database uses free monthly limits. Allowed on one database in a subscription."
+                              }
+                            },
+                            "zoneRedundant": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether or not this database is zone redundant."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Sql/servers/database@2023-08-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the databse."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "backupShortTermRetentionPolicy": {
+                              "$ref": "#/definitions/shortTermBackupRetentionPolicyType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The short term backup retention policy to create for the database."
+                              }
+                            },
+                            "backupLongTermRetentionPolicy": {
+                              "$ref": "#/definitions/longTermBackupRetentionPolicyType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The long term backup retention policy to create for the database."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityOnlyUserAssignedType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "customerManagedKey": {
+                              "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The customer managed key definition for database TDE."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null()), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                          },
+                          "resources": {
+                            "cMKKeyVault::cMKKey": {
+                              "condition": "[and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults/keys",
+                              "apiVersion": "2025-05-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                            },
+                            "server": {
+                              "existing": true,
+                              "type": "Microsoft.Sql/servers",
+                              "apiVersion": "2023-08-01",
+                              "name": "[parameters('serverName')]"
+                            },
+                            "cMKKeyVault": {
+                              "condition": "[and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2025-05-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                            },
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.sql-serverdb.{0}.{1}', replace('0.2.1', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "database": {
+                              "type": "Microsoft.Sql/servers/databases",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "sku": "[parameters('sku')]",
+                              "identity": "[variables('identity')]",
+                              "properties": {
+                                "autoPauseDelay": "[parameters('autoPauseDelay')]",
+                                "availabilityZone": "[if(not(equals(parameters('availabilityZone'), -1)), string(parameters('availabilityZone')), 'NoPreference')]",
+                                "catalogCollation": "[parameters('catalogCollation')]",
+                                "collation": "[parameters('collation')]",
+                                "createMode": "[parameters('createMode')]",
+                                "elasticPoolId": "[parameters('elasticPoolResourceId')]",
+                                "encryptionProtector": "[if(not(empty(parameters('customerManagedKey'))), if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), if(not(variables('isHSMManagedCMK')), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), format('https://{0}.managedhsm.azure.net/keys/{1}/{2}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName, parameters('customerManagedKey').keyVersion)), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault::cMKKey').keyUri, format('https://{0}.managedhsm.azure.net/keys/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName)), if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault::cMKKey').keyUriWithVersion, fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.')))), null())]",
+                                "encryptionProtectorAutoRotation": "[tryGet(parameters('customerManagedKey'), 'autoRotationEnabled')]",
+                                "federatedClientId": "[parameters('federatedClientId')]",
+                                "freeLimitExhaustionBehavior": "[parameters('freeLimitExhaustionBehavior')]",
+                                "highAvailabilityReplicaCount": "[parameters('highAvailabilityReplicaCount')]",
+                                "isLedgerOn": "[parameters('isLedgerOn')]",
+                                "licenseType": "[parameters('licenseType')]",
+                                "longTermRetentionBackupResourceId": "[parameters('longTermRetentionBackupResourceId')]",
+                                "maintenanceConfigurationId": "[parameters('maintenanceConfigurationId')]",
+                                "manualCutover": "[parameters('manualCutover')]",
+                                "maxSizeBytes": "[parameters('maxSizeBytes')]",
+                                "minCapacity": "[if(not(empty(parameters('minCapacity'))), json(parameters('minCapacity')), 0)]",
+                                "performCutover": "[parameters('performCutover')]",
+                                "preferredEnclaveType": "[parameters('preferredEnclaveType')]",
+                                "readScale": "[parameters('readScale')]",
+                                "recoverableDatabaseId": "[parameters('recoverableDatabaseResourceId')]",
+                                "recoveryServicesRecoveryPointId": "[parameters('recoveryServicesRecoveryPointResourceId')]",
+                                "requestedBackupStorageRedundancy": "[parameters('requestedBackupStorageRedundancy')]",
+                                "restorableDroppedDatabaseId": "[parameters('restorableDroppedDatabaseResourceId')]",
+                                "restorePointInTime": "[parameters('restorePointInTime')]",
+                                "sampleName": "[parameters('sampleName')]",
+                                "secondaryType": "[parameters('secondaryType')]",
+                                "sourceDatabaseDeletionDate": "[parameters('sourceDatabaseDeletionDate')]",
+                                "sourceDatabaseId": "[parameters('sourceDatabaseResourceId')]",
+                                "sourceResourceId": "[parameters('sourceResourceId')]",
+                                "useFreeLimit": "[parameters('useFreeLimit')]",
+                                "zoneRedundant": "[parameters('zoneRedundant')]"
+                              },
+                              "dependsOn": [
+                                "cMKKeyVault::cMKKey"
+                              ]
+                            },
+                            "database_diagnosticSettings": {
+                              "copy": {
+                                "name": "database_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Sql/servers/{0}/databases/{1}', parameters('serverName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', replace(parameters('name'), ' ', '_')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "database"
+                              ]
+                            },
+                            "database_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Sql/servers/{0}/databases/{1}', parameters('serverName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "database"
+                              ]
+                            },
+                            "database_backupShortTermRetentionPolicy": {
+                              "condition": "[not(empty(parameters('backupShortTermRetentionPolicy')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-shBakRetPol', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "serverName": {
+                                    "value": "[parameters('serverName')]"
+                                  },
+                                  "databaseName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "diffBackupIntervalInHours": {
+                                    "value": "[tryGet(parameters('backupShortTermRetentionPolicy'), 'diffBackupIntervalInHours')]"
+                                  },
+                                  "retentionDays": {
+                                    "value": "[tryGet(parameters('backupShortTermRetentionPolicy'), 'retentionDays')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "13123232463186414429"
+                                    },
+                                    "name": "Azure SQL Server Database Short Term Backup Retention Policies",
+                                    "description": "This module deploys an Azure SQL Server Database Short-Term Backup Retention Policy."
+                                  },
+                                  "parameters": {
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the parent SQL Server."
+                                      }
+                                    },
+                                    "databaseName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the parent database."
+                                      }
+                                    },
+                                    "diffBackupIntervalInHours": {
+                                      "type": "int",
+                                      "defaultValue": 24,
+                                      "metadata": {
+                                        "description": "Optional. Differential backup interval in hours. For Hyperscal tiers this value will be ignored."
+                                      }
+                                    },
+                                    "retentionDays": {
+                                      "type": "int",
+                                      "defaultValue": 7,
+                                      "metadata": {
+                                        "description": "Optional. Poin-in-time retention in days."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Sql/servers/databases/backupShortTermRetentionPolicies",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('serverName'), parameters('databaseName'), 'default')]",
+                                      "properties": {
+                                        "diffBackupIntervalInHours": "[if(equals(reference(resourceId('Microsoft.Sql/servers/databases', parameters('serverName'), parameters('databaseName')), '2023-08-01', 'full').sku.tier, 'Hyperscale'), null(), parameters('diffBackupIntervalInHours'))]",
+                                        "retentionDays": "[parameters('retentionDays')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the short-term policy was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the short-term policy."
+                                      },
+                                      "value": "default"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the short-term policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/databases/backupShortTermRetentionPolicies', parameters('serverName'), parameters('databaseName'), 'default')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "database"
+                              ]
+                            },
+                            "database_backupLongTermRetentionPolicy": {
+                              "condition": "[not(empty(parameters('backupLongTermRetentionPolicy')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-lgBakRetPol', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "serverName": {
+                                    "value": "[parameters('serverName')]"
+                                  },
+                                  "databaseName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "weeklyRetention": {
+                                    "value": "[tryGet(parameters('backupLongTermRetentionPolicy'), 'weeklyRetention')]"
+                                  },
+                                  "monthlyRetention": {
+                                    "value": "[tryGet(parameters('backupLongTermRetentionPolicy'), 'monthlyRetention')]"
+                                  },
+                                  "yearlyRetention": {
+                                    "value": "[tryGet(parameters('backupLongTermRetentionPolicy'), 'yearlyRetention')]"
+                                  },
+                                  "weekOfYear": {
+                                    "value": "[tryGet(parameters('backupLongTermRetentionPolicy'), 'weekOfYear')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "15206682237606175692"
+                                    },
+                                    "name": "SQL Server Database Long Term Backup Retention Policies",
+                                    "description": "This module deploys an Azure SQL Server Database Long-Term Backup Retention Policy."
+                                  },
+                                  "parameters": {
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the parent SQL Server."
+                                      }
+                                    },
+                                    "databaseName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the parent database."
+                                      }
+                                    },
+                                    "monthlyRetention": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Monthly retention in ISO 8601 duration format."
+                                      }
+                                    },
+                                    "weeklyRetention": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Weekly retention in ISO 8601 duration format."
+                                      }
+                                    },
+                                    "weekOfYear": {
+                                      "type": "int",
+                                      "defaultValue": 1,
+                                      "metadata": {
+                                        "description": "Optional. Week of year backup to keep for yearly retention."
+                                      }
+                                    },
+                                    "yearlyRetention": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Yearly retention in ISO 8601 duration format."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "server::database": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers/databases",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), parameters('databaseName'))]"
+                                    },
+                                    "server": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('serverName')]"
+                                    },
+                                    "backupLongTermRetentionPolicy": {
+                                      "type": "Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('serverName'), parameters('databaseName'), 'default')]",
+                                      "properties": {
+                                        "monthlyRetention": "[parameters('monthlyRetention')]",
+                                        "weeklyRetention": "[parameters('weeklyRetention')]",
+                                        "weekOfYear": "[parameters('weekOfYear')]",
+                                        "yearlyRetention": "[parameters('yearlyRetention')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the long-term policy was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the long-term policy."
+                                      },
+                                      "value": "default"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the long-term policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies', parameters('serverName'), parameters('databaseName'), 'default')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "database"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed database."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed database."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/databases', parameters('serverName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed database."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('database', '2023-08-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server",
+                        "server_elasticPools"
+                      ]
+                    },
+                    "server_elasticPools": {
+                      "copy": {
+                        "name": "server_elasticPools",
+                        "count": "[length(coalesce(parameters('elasticPools'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-SQLServer-ElasticPool-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('elasticPools'), createArray())[copyIndex()].name]"
+                          },
+                          "sku": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'sku')]"
+                          },
+                          "autoPauseDelay": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'autoPauseDelay')]"
+                          },
+                          "availabilityZone": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'availabilityZone')]"
+                          },
+                          "highAvailabilityReplicaCount": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'highAvailabilityReplicaCount')]"
+                          },
+                          "licenseType": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'licenseType')]"
+                          },
+                          "lock": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'lock')]"
+                          },
+                          "maintenanceConfigurationId": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'maintenanceConfigurationId')]"
+                          },
+                          "maxSizeBytes": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'maxSizeBytes')]"
+                          },
+                          "minCapacity": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'minCapacity')]"
+                          },
+                          "perDatabaseSettings": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'perDatabaseSettings')]"
+                          },
+                          "preferredEnclaveType": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'preferredEnclaveType')]"
+                          },
+                          "zoneRedundant": {
+                            "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'zoneRedundant')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "1733423336361222327"
+                            },
+                            "name": "SQL Server Elastic Pool",
+                            "description": "This module deploys an Azure SQL Server Elastic Pool."
+                          },
+                          "definitions": {
+                            "perDatabaseSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "autoPauseDelay": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Auto Pause Delay for per database within pool."
+                                  }
+                                },
+                                "maxCapacity": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The maximum capacity any one database can consume. Examples: '0.5', '2'."
+                                  }
+                                },
+                                "minCapacity": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The minimum capacity all databases are guaranteed. Examples: '0.5', '1'."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The per database settings for the elastic pool."
+                              }
+                            },
+                            "skuType": {
+                              "type": "object",
+                              "properties": {
+                                "capacity": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The capacity of the particular SKU."
+                                  }
+                                },
+                                "family": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "BC_DC",
+                                    "BC_Gen5",
+                                    "BasicPool",
+                                    "GP_DC",
+                                    "GP_FSv2",
+                                    "GP_Gen5",
+                                    "HS_Gen5",
+                                    "HS_MOPRMS",
+                                    "HS_PRMS",
+                                    "PremiumPool",
+                                    "ServerlessPool",
+                                    "StandardPool"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The name of the SKU, typically, a letter + Number code, e.g. P3."
+                                  }
+                                },
+                                "size": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Size of the particular SKU."
+                                  }
+                                },
+                                "tier": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The tier or edition of the particular SKU, e.g. Basic, Premium."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The elastic pool SKU."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Elastic Pool."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Sql/servers/elasticPools@2023-08-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the elastic pool."
+                              }
+                            },
+                            "sku": {
+                              "$ref": "#/definitions/skuType",
+                              "defaultValue": {
+                                "capacity": 2,
+                                "name": "GP_Gen5",
+                                "tier": "GeneralPurpose"
+                              },
+                              "metadata": {
+                                "description": "Optional. The elastic pool SKU."
+                              }
+                            },
+                            "autoPauseDelay": {
+                              "type": "int",
+                              "defaultValue": -1,
+                              "metadata": {
+                                "description": "Optional. Time in minutes after which elastic pool is automatically paused. A value of -1 means that automatic pause is disabled."
+                              }
+                            },
+                            "availabilityZone": {
+                              "type": "int",
+                              "allowedValues": [
+                                -1,
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                              }
+                            },
+                            "highAvailabilityReplicaCount": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The number of secondary replicas associated with the elastic pool that are used to provide high availability. Applicable only to Hyperscale elastic pools."
+                              }
+                            },
+                            "licenseType": {
+                              "type": "string",
+                              "defaultValue": "LicenseIncluded",
+                              "allowedValues": [
+                                "BasePrice",
+                                "LicenseIncluded"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The license type to apply for this elastic pool."
+                              }
+                            },
+                            "maintenanceConfigurationId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Maintenance configuration resource ID assigned to the elastic pool. This configuration defines the period when the maintenance updates will will occur."
+                              }
+                            },
+                            "maxSizeBytes": {
+                              "type": "int",
+                              "defaultValue": 34359738368,
+                              "metadata": {
+                                "description": "Optional. The storage limit for the database elastic pool in bytes."
+                              }
+                            },
+                            "minCapacity": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Minimal capacity that serverless pool will not shrink below, if not paused."
+                              }
+                            },
+                            "perDatabaseSettings": {
+                              "$ref": "#/definitions/perDatabaseSettingsType",
+                              "defaultValue": {
+                                "autoPauseDelay": -1,
+                                "maxCapacity": "2",
+                                "minCapacity": "0"
+                              },
+                              "metadata": {
+                                "description": "Optional. The per database settings for the elastic pool."
+                              }
+                            },
+                            "preferredEnclaveType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Default",
+                                "VBS"
+                              ],
+                              "defaultValue": "Default",
+                              "metadata": {
+                                "description": "Optional. Type of enclave requested on the elastic pool."
+                              }
+                            },
+                            "zoneRedundant": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Whether or not this elastic pool is zone redundant, which means the replicas of this elastic pool will be spread across multiple availability zones."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                              "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                              "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+                              "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                              "Reservation Purchaser": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f7b75c60-3036-4b75-91c3-6b41c27c1689')]",
+                              "Resource Policy Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '36243c78-bf99-498c-9df9-86d9f8d28608')]",
+                              "SQL DB Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9b7fa17d-e63e-47b0-bb0a-15c516ac86ec')]",
+                              "SQL Security Manager": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '056cd41c-7e88-42e1-933e-88ba6a50c9c3')]",
+                              "SQL Server Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437')]",
+                              "SqlDb Migration Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '189207d4-bb67-4208-a635-b06afe8b2c57')]"
+                            }
+                          },
+                          "resources": {
+                            "server": {
+                              "existing": true,
+                              "type": "Microsoft.Sql/servers",
+                              "apiVersion": "2023-08-01",
+                              "name": "[parameters('serverName')]"
+                            },
+                            "elasticPool": {
+                              "type": "Microsoft.Sql/servers/elasticPools",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "sku": "[parameters('sku')]",
+                              "properties": {
+                                "autoPauseDelay": "[parameters('autoPauseDelay')]",
+                                "availabilityZone": "[if(not(equals(parameters('availabilityZone'), -1)), string(parameters('availabilityZone')), 'NoPreference')]",
+                                "highAvailabilityReplicaCount": "[parameters('highAvailabilityReplicaCount')]",
+                                "licenseType": "[parameters('licenseType')]",
+                                "maintenanceConfigurationId": "[parameters('maintenanceConfigurationId')]",
+                                "maxSizeBytes": "[parameters('maxSizeBytes')]",
+                                "minCapacity": "[parameters('minCapacity')]",
+                                "perDatabaseSettings": "[if(not(empty(parameters('perDatabaseSettings'))), createObject('autoPauseDelay', tryGet(parameters('perDatabaseSettings'), 'autoPauseDelay'), 'maxCapacity', json(tryGet(parameters('perDatabaseSettings'), 'maxCapacity')), 'minCapacity', json(tryGet(parameters('perDatabaseSettings'), 'minCapacity'))), null())]",
+                                "preferredEnclaveType": "[parameters('preferredEnclaveType')]",
+                                "zoneRedundant": "[parameters('zoneRedundant')]"
+                              }
+                            },
+                            "elasticPool_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Sql/servers/{0}/elasticPools/{1}', parameters('serverName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "elasticPool"
+                              ]
+                            },
+                            "elasticPool_roleAssignments": {
+                              "copy": {
+                                "name": "elasticPool_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Sql/servers/{0}/elasticPools/{1}', parameters('serverName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Sql/servers', parameters('serverName')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "elasticPool"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed Elastic Pool."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed Elastic Pool."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/elasticPools', parameters('serverName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed Elastic Pool."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('elasticPool', '2023-08-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "server_privateEndpoints": {
+                      "copy": {
+                        "name": "server_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-server-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Sql/servers', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer'), copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Sql/servers', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Sql/servers', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer')))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Sql/servers', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Sql/servers', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.5.1644",
+                              "templateHash": "16604612898799598358"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private dns zone group."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a private DNS zone group configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                },
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              },
+                              "nullable": true
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                },
+                                "description": "Optional. Custom DNS configurations."
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-10-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "24141742673128945"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private DNS zone group configuration."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "privateDnsZoneConfigs",
+                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "properties": {
+                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                              }
+                                            }
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                  "output": true
+                                },
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "server_firewallRules": {
+                      "copy": {
+                        "name": "server_firewallRules",
+                        "count": "[length(coalesce(parameters('firewallRules'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-FirewallRules-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('firewallRules'), createArray())[copyIndex()].name]"
+                          },
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "endIpAddress": {
+                            "value": "[tryGet(coalesce(parameters('firewallRules'), createArray())[copyIndex()], 'endIpAddress')]"
+                          },
+                          "startIpAddress": {
+                            "value": "[tryGet(coalesce(parameters('firewallRules'), createArray())[copyIndex()], 'startIpAddress')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "3841110712005924932"
+                            },
+                            "name": "Azure SQL Server Firewall Rule",
+                            "description": "This module deploys an Azure SQL Server Firewall Rule."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Server Firewall Rule."
+                              }
+                            },
+                            "endIpAddress": {
+                              "type": "string",
+                              "defaultValue": "0.0.0.0",
+                              "metadata": {
+                                "description": "Optional. The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. Use value '0.0.0.0' for all Azure-internal IP addresses."
+                              }
+                            },
+                            "startIpAddress": {
+                              "type": "string",
+                              "defaultValue": "0.0.0.0",
+                              "metadata": {
+                                "description": "Optional. The start IP address of the firewall rule. Must be IPv4 format. Use value '0.0.0.0' for all Azure-internal IP addresses."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Sql/servers/firewallRules",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                              "properties": {
+                                "endIpAddress": "[parameters('endIpAddress')]",
+                                "startIpAddress": "[parameters('startIpAddress')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed firewall rule."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed firewall rule."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/firewallRules', parameters('serverName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed firewall rule."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "server_virtualNetworkRules": {
+                      "copy": {
+                        "name": "server_virtualNetworkRules",
+                        "count": "[length(coalesce(parameters('virtualNetworkRules'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-VirtualNetworkRules-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('virtualNetworkRules'), createArray())[copyIndex()].name]"
+                          },
+                          "ignoreMissingVnetServiceEndpoint": {
+                            "value": "[tryGet(coalesce(parameters('virtualNetworkRules'), createArray())[copyIndex()], 'ignoreMissingVnetServiceEndpoint')]"
+                          },
+                          "virtualNetworkSubnetResourceId": {
+                            "value": "[coalesce(parameters('virtualNetworkRules'), createArray())[copyIndex()].virtualNetworkSubnetResourceId]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "8492844379308217081"
+                            },
+                            "name": "Azure SQL Server Virtual Network Rules",
+                            "description": "This module deploys an Azure SQL Server Virtual Network Rule."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Server Virtual Network Rule."
+                              }
+                            },
+                            "ignoreMissingVnetServiceEndpoint": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Allow creating a firewall rule before the virtual network has vnet service endpoint enabled."
+                              }
+                            },
+                            "virtualNetworkSubnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the virtual network subnet."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Sql/servers/virtualNetworkRules",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                              "properties": {
+                                "ignoreMissingVnetServiceEndpoint": "[parameters('ignoreMissingVnetServiceEndpoint')]",
+                                "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed virtual network rule."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed virtual network rule."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/virtualNetworkRules', parameters('serverName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed virtual network rule."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "server_securityAlertPolicies": {
+                      "copy": {
+                        "name": "server_securityAlertPolicies",
+                        "count": "[length(coalesce(parameters('securityAlertPolicies'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-SecAlertPolicy-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()].name]"
+                          },
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "disabledAlerts": {
+                            "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'disabledAlerts')]"
+                          },
+                          "emailAccountAdmins": {
+                            "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'emailAccountAdmins')]"
+                          },
+                          "emailAddresses": {
+                            "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'emailAddresses')]"
+                          },
+                          "retentionDays": {
+                            "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'retentionDays')]"
+                          },
+                          "state": {
+                            "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'state')]"
+                          },
+                          "storageAccountAccessKey": {
+                            "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'storageAccountAccessKey')]"
+                          },
+                          "storageEndpoint": {
+                            "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'storageEndpoint')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "5279550187376165695"
+                            },
+                            "name": "Azure SQL Server Security Alert Policies",
+                            "description": "This module deploys an Azure SQL Server Security Alert Policy."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Security Alert Policy."
+                              }
+                            },
+                            "disabledAlerts": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": [],
+                              "allowedValues": [
+                                "Sql_Injection",
+                                "Sql_Injection_Vulnerability",
+                                "Access_Anomaly",
+                                "Data_Exfiltration",
+                                "Unsafe_Action",
+                                "Brute_Force"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Alerts to disable."
+                              }
+                            },
+                            "emailAccountAdmins": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies that the alert is sent to the account administrators."
+                              }
+                            },
+                            "emailAddresses": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies an array of email addresses to which the alert is sent."
+                              }
+                            },
+                            "retentionDays": {
+                              "type": "int",
+                              "defaultValue": 0,
+                              "metadata": {
+                                "description": "Optional. Specifies the number of days to keep in the Threat Detection audit logs."
+                              }
+                            },
+                            "state": {
+                              "type": "string",
+                              "defaultValue": "Disabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the state of the policy, whether it is enabled or disabled or a policy has not been applied yet on the specific database."
+                              }
+                            },
+                            "storageAccountAccessKey": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the identifier key of the Threat Detection audit storage account."
+                              }
+                            },
+                            "storageEndpoint": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the blob storage endpoint. This blob storage will hold all Threat Detection audit logs."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "server": {
+                              "existing": true,
+                              "type": "Microsoft.Sql/servers",
+                              "apiVersion": "2023-08-01",
+                              "name": "[parameters('serverName')]"
+                            },
+                            "securityAlertPolicy": {
+                              "type": "Microsoft.Sql/servers/securityAlertPolicies",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                              "properties": {
+                                "disabledAlerts": "[parameters('disabledAlerts')]",
+                                "emailAccountAdmins": "[parameters('emailAccountAdmins')]",
+                                "emailAddresses": "[parameters('emailAddresses')]",
+                                "retentionDays": "[parameters('retentionDays')]",
+                                "state": "[parameters('state')]",
+                                "storageAccountAccessKey": "[parameters('storageAccountAccessKey')]",
+                                "storageEndpoint": "[parameters('storageEndpoint')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed security alert policy."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed security alert policy."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/securityAlertPolicies', parameters('serverName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed security alert policy."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "server_vulnerabilityAssessment": {
+                      "condition": "[not(equals(parameters('vulnerabilityAssessmentsObj'), null()))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-VulnAssessm', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[parameters('vulnerabilityAssessmentsObj').name]"
+                          },
+                          "recurringScans": {
+                            "value": "[tryGet(parameters('vulnerabilityAssessmentsObj'), 'recurringScans')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[parameters('vulnerabilityAssessmentsObj').storageAccountResourceId]"
+                          },
+                          "useStorageAccountAccessKey": {
+                            "value": "[tryGet(parameters('vulnerabilityAssessmentsObj'), 'useStorageAccountAccessKey')]"
+                          },
+                          "createStorageRoleAssignment": {
+                            "value": "[tryGet(parameters('vulnerabilityAssessmentsObj'), 'createStorageRoleAssignment')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "10092162295370595463"
+                            },
+                            "name": "Azure SQL Server Vulnerability Assessments",
+                            "description": "This module deploys an Azure SQL Server Vulnerability Assessment."
+                          },
+                          "definitions": {
+                            "recurringScansType": {
+                              "type": "object",
+                              "properties": {
+                                "emails": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Specifies an array of e-mail addresses to which the scan notification is sent."
+                                  }
+                                },
+                                "emailSubscriptionAdmins": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies that the schedule scan notification will be sent to the subscription administrators."
+                                  }
+                                },
+                                "isEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Recurring scans state."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for recurring scans."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the vulnerability assessment."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The Name of SQL Server. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "recurringScans": {
+                              "$ref": "#/definitions/recurringScansType",
+                              "defaultValue": {
+                                "emails": [],
+                                "emailSubscriptionAdmins": false,
+                                "isEnabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The recurring scans settings."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A blob storage to hold the scan results."
+                              }
+                            },
+                            "useStorageAccountAccessKey": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Use Access Key to access the storage account. The storage account cannot be behind a firewall or virtual network. If an access key is not used, the SQL Server system assigned managed identity must be assigned the Storage Blob Data Contributor role on the storage account."
+                              }
+                            },
+                            "createStorageRoleAssignment": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Create the Storage Blob Data Contributor role assignment on the storage account. Note, the role assignment must not already exist on the storage account."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "server": {
+                              "existing": true,
+                              "type": "Microsoft.Sql/servers",
+                              "apiVersion": "2023-08-01",
+                              "name": "[parameters('serverName')]"
+                            },
+                            "vulnerabilityAssessment": {
+                              "type": "Microsoft.Sql/servers/vulnerabilityAssessments",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                              "properties": {
+                                "storageContainerPath": "[format('https://{0}.blob.{1}/vulnerability-assessment/', last(split(parameters('storageAccountResourceId'), '/')), environment().suffixes.storage)]",
+                                "storageAccountAccessKey": "[if(parameters('useStorageAccountAccessKey'), listKeys(parameters('storageAccountResourceId'), '2019-06-01').keys[0].value, null())]",
+                                "recurringScans": "[parameters('recurringScans')]"
+                              }
+                            },
+                            "storageAccount_sbdc_rbac": {
+                              "condition": "[and(not(parameters('useStorageAccountAccessKey')), parameters('createStorageRoleAssignment'))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-sbdc-rbac', parameters('serverName'))]",
+                              "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                  },
+                                  "managedInstanceIdentityPrincipalId": {
+                                    "value": "[reference('server', '2023-08-01', 'full').identity.principalId]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "2185022990623310445"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string"
+                                    },
+                                    "managedInstanceIdentityPrincipalId": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
+                                      "name": "[guid(format('{0}-{1}-Storage-Blob-Data-Contributor', resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), parameters('managedInstanceIdentityPrincipalId')))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                        "principalId": "[parameters('managedInstanceIdentityPrincipalId')]",
+                                        "principalType": "ServicePrincipal"
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed vulnerability assessment."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed vulnerability assessment."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/vulnerabilityAssessments', parameters('serverName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed vulnerability assessment."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server",
+                        "server_securityAlertPolicies"
+                      ]
+                    },
+                    "server_keys": {
+                      "copy": {
+                        "name": "server_keys",
+                        "count": "[length(coalesce(parameters('keys'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-Key-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "serverKeyType": {
+                            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'serverKeyType')]"
+                          },
+                          "uri": {
+                            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'uri')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "7398069928503308425"
+                            },
+                            "name": "Azure SQL Server Keys",
+                            "description": "This module deploys an Azure SQL Server Key."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The name of the key. Must follow the [<keyVaultName>_<keyName>_<keyVersion>] pattern."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent SQL server. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "serverKeyType": {
+                              "type": "string",
+                              "defaultValue": "ServiceManaged",
+                              "allowedValues": [
+                                "AzureKeyVault",
+                                "ServiceManaged"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The server key type."
+                              }
+                            },
+                            "uri": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The URI of the server key. If the ServerKeyType is AzureKeyVault, then the URI is required. The AKV URI is required to be in this format: 'https://YourVaultName.azure.net/keys/YourKeyName/YourKeyVersion'."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "splittedKeyUri": "[split(parameters('uri'), '/')]",
+                            "serverKeyName": "[if(empty(parameters('uri')), 'ServiceManaged', format('{0}_{1}_{2}', split(variables('splittedKeyUri')[2], '.')[0], variables('splittedKeyUri')[4], variables('splittedKeyUri')[5]))]"
+                          },
+                          "resources": {
+                            "server": {
+                              "existing": true,
+                              "type": "Microsoft.Sql/servers",
+                              "apiVersion": "2023-08-01",
+                              "name": "[parameters('serverName')]"
+                            },
+                            "key": {
+                              "type": "Microsoft.Sql/servers/keys",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('serverName'), coalesce(parameters('name'), variables('serverKeyName')))]",
+                              "properties": {
+                                "serverKeyType": "[parameters('serverKeyType')]",
+                                "uri": "[parameters('uri')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed server key."
+                              },
+                              "value": "[coalesce(parameters('name'), variables('serverKeyName'))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed server key."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/keys', parameters('serverName'), coalesce(parameters('name'), variables('serverKeyName')))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed server key."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "cmk_key": {
+                      "condition": "[not(equals(parameters('customerManagedKey'), null()))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-Key', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[format('{0}_{1}_{2}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'), if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), tryGet(parameters('customerManagedKey'), 'keyVersion'), if(not(variables('isHSMManagedCMK')), last(split(coalesce(tryGet(if(and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))), reference('cMKKeyVault::cMKKey', '2025-05-01', 'full'), null()), 'properties', 'keyUriWithVersion'), ''), '/')), fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.'))))]"
+                          },
+                          "serverKeyType": {
+                            "value": "AzureKeyVault"
+                          },
+                          "uri": "[if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), if(not(variables('isHSMManagedCMK')), createObject('value', format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion)), createObject('value', format('https://{0}.managedhsm.azure.net/keys/{1}/{2}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName, parameters('customerManagedKey').keyVersion))), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), if(not(variables('isHSMManagedCMK')), createObject('value', reference('cMKKeyVault::cMKKey').keyUri), createObject('value', format('https://{0}.managedhsm.azure.net/keys/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName))), if(not(variables('isHSMManagedCMK')), createObject('value', reference('cMKKeyVault::cMKKey').keyUriWithVersion), createObject('value', fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.')))))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "7398069928503308425"
+                            },
+                            "name": "Azure SQL Server Keys",
+                            "description": "This module deploys an Azure SQL Server Key."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The name of the key. Must follow the [<keyVaultName>_<keyName>_<keyVersion>] pattern."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent SQL server. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "serverKeyType": {
+                              "type": "string",
+                              "defaultValue": "ServiceManaged",
+                              "allowedValues": [
+                                "AzureKeyVault",
+                                "ServiceManaged"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The server key type."
+                              }
+                            },
+                            "uri": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The URI of the server key. If the ServerKeyType is AzureKeyVault, then the URI is required. The AKV URI is required to be in this format: 'https://YourVaultName.azure.net/keys/YourKeyName/YourKeyVersion'."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "splittedKeyUri": "[split(parameters('uri'), '/')]",
+                            "serverKeyName": "[if(empty(parameters('uri')), 'ServiceManaged', format('{0}_{1}_{2}', split(variables('splittedKeyUri')[2], '.')[0], variables('splittedKeyUri')[4], variables('splittedKeyUri')[5]))]"
+                          },
+                          "resources": {
+                            "server": {
+                              "existing": true,
+                              "type": "Microsoft.Sql/servers",
+                              "apiVersion": "2023-08-01",
+                              "name": "[parameters('serverName')]"
+                            },
+                            "key": {
+                              "type": "Microsoft.Sql/servers/keys",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('serverName'), coalesce(parameters('name'), variables('serverKeyName')))]",
+                              "properties": {
+                                "serverKeyType": "[parameters('serverKeyType')]",
+                                "uri": "[parameters('uri')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed server key."
+                              },
+                              "value": "[coalesce(parameters('name'), variables('serverKeyName'))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed server key."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/keys', parameters('serverName'), coalesce(parameters('name'), variables('serverKeyName')))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed server key."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "cMKKeyVault::cMKKey",
+                        "server"
+                      ]
+                    },
+                    "server_encryptionProtector": {
+                      "condition": "[not(equals(parameters('customerManagedKey'), null()))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-EncryProtector', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "sqlServerName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "serverKeyName": {
+                            "value": "[coalesce(tryGet(if(not(equals(parameters('customerManagedKey'), null())), reference('cmk_key'), null()), 'outputs', 'name', 'value'), '')]"
+                          },
+                          "serverKeyType": {
+                            "value": "AzureKeyVault"
+                          },
+                          "autoRotationEnabled": {
+                            "value": "[tryGet(parameters('customerManagedKey'), 'autoRotationEnabled')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "443247778605325916"
+                            },
+                            "name": "Azure SQL Server Encryption Protector",
+                            "description": "This module deploys an Azure SQL Server Encryption Protector."
+                          },
+                          "parameters": {
+                            "sqlServerName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the sql server. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "serverKeyName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the server key."
+                              }
+                            },
+                            "autoRotationEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Key auto rotation opt-in flag."
+                              }
+                            },
+                            "serverKeyType": {
+                              "type": "string",
+                              "defaultValue": "ServiceManaged",
+                              "allowedValues": [
+                                "AzureKeyVault",
+                                "ServiceManaged"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The encryption protector type."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Sql/servers/encryptionProtector",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('sqlServerName'), 'current')]",
+                              "properties": {
+                                "serverKeyType": "[parameters('serverKeyType')]",
+                                "autoRotationEnabled": "[parameters('autoRotationEnabled')]",
+                                "serverKeyName": "[parameters('serverKeyName')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed encryption protector."
+                              },
+                              "value": "current"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the encryption protector."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/encryptionProtector', parameters('sqlServerName'), 'current')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed encryption protector."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "cmk_key",
+                        "server"
+                      ]
+                    },
+                    "server_audit_settings": {
+                      "condition": "[not(empty(parameters('auditSettings')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-AuditSettings', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('auditSettings'), 'name'), 'default')]"
+                          },
+                          "state": {
+                            "value": "[tryGet(parameters('auditSettings'), 'state')]"
+                          },
+                          "auditActionsAndGroups": {
+                            "value": "[tryGet(parameters('auditSettings'), 'auditActionsAndGroups')]"
+                          },
+                          "isAzureMonitorTargetEnabled": {
+                            "value": "[tryGet(parameters('auditSettings'), 'isAzureMonitorTargetEnabled')]"
+                          },
+                          "isDevopsAuditEnabled": {
+                            "value": "[tryGet(parameters('auditSettings'), 'isDevopsAuditEnabled')]"
+                          },
+                          "isManagedIdentityInUse": {
+                            "value": "[tryGet(parameters('auditSettings'), 'isManagedIdentityInUse')]"
+                          },
+                          "isStorageSecondaryKeyInUse": {
+                            "value": "[tryGet(parameters('auditSettings'), 'isStorageSecondaryKeyInUse')]"
+                          },
+                          "queueDelayMs": {
+                            "value": "[tryGet(parameters('auditSettings'), 'queueDelayMs')]"
+                          },
+                          "retentionDays": {
+                            "value": "[tryGet(parameters('auditSettings'), 'retentionDays')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[tryGet(parameters('auditSettings'), 'storageAccountResourceId')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "16723116616667912196"
+                            },
+                            "name": "Azure SQL Server Audit Settings",
+                            "description": "This module deploys an Azure SQL Server Audit Settings."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the audit settings."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The Name of SQL Server. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "state": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the state of the audit. If state is Enabled, storageEndpoint or isAzureMonitorTargetEnabled are required."
+                              }
+                            },
+                            "auditActionsAndGroups": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": [
+                                "BATCH_COMPLETED_GROUP",
+                                "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
+                                "FAILED_DATABASE_AUTHENTICATION_GROUP"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the Actions-Groups and Actions to audit."
+                              }
+                            },
+                            "isAzureMonitorTargetEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Specifies whether audit events are sent to Azure Monitor."
+                              }
+                            },
+                            "isDevopsAuditEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies the state of devops audit. If state is Enabled, devops logs will be sent to Azure Monitor."
+                              }
+                            },
+                            "isManagedIdentityInUse": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether Managed Identity is used to access blob storage."
+                              }
+                            },
+                            "isStorageSecondaryKeyInUse": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether storageAccountAccessKey value is the storage's secondary key."
+                              }
+                            },
+                            "queueDelayMs": {
+                              "type": "int",
+                              "defaultValue": 1000,
+                              "metadata": {
+                                "description": "Optional. Specifies the amount of time in milliseconds that can elapse before audit actions are forced to be processed."
+                              }
+                            },
+                            "retentionDays": {
+                              "type": "int",
+                              "defaultValue": 90,
+                              "metadata": {
+                                "description": "Optional. Specifies the number of days to keep in the audit logs in the storage account."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. A blob storage to hold the auditing storage account."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "server": {
+                              "existing": true,
+                              "type": "Microsoft.Sql/servers",
+                              "apiVersion": "2023-08-01",
+                              "name": "[parameters('serverName')]"
+                            },
+                            "auditSettings": {
+                              "type": "Microsoft.Sql/servers/auditingSettings",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                              "properties": {
+                                "state": "[parameters('state')]",
+                                "auditActionsAndGroups": "[parameters('auditActionsAndGroups')]",
+                                "isAzureMonitorTargetEnabled": "[parameters('isAzureMonitorTargetEnabled')]",
+                                "isDevopsAuditEnabled": "[parameters('isDevopsAuditEnabled')]",
+                                "isManagedIdentityInUse": "[parameters('isManagedIdentityInUse')]",
+                                "isStorageSecondaryKeyInUse": "[parameters('isStorageSecondaryKeyInUse')]",
+                                "queueDelayMs": "[parameters('queueDelayMs')]",
+                                "retentionDays": "[parameters('retentionDays')]",
+                                "storageAccountAccessKey": "[if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('isManagedIdentityInUse'))), listKeys(parameters('storageAccountResourceId'), '2019-06-01').keys[0].value, null())]",
+                                "storageAccountSubscriptionId": "[if(not(empty(parameters('storageAccountResourceId'))), split(parameters('storageAccountResourceId'), '/')[2], null())]",
+                                "storageEndpoint": "[if(not(empty(parameters('storageAccountResourceId'))), format('https://{0}.blob.{1}', last(split(parameters('storageAccountResourceId'), '/')), environment().suffixes.storage), null())]"
+                              }
+                            },
+                            "storageAccount_sbdc_rbac": {
+                              "condition": "[and(parameters('isManagedIdentityInUse'), not(empty(parameters('storageAccountResourceId'))))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('storageAccount_sbdc_rbac-{0}', uniqueString('storageAccount_sbdc_rbac', deployment().name))]",
+                              "subscriptionId": "[split(coalesce(parameters('storageAccountResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(parameters('storageAccountResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                  },
+                                  "managedIdentityPrincipalId": "[if(equals(reference('server', '2023-08-01', 'full').identity.type, 'UserAssigned'), createObject('value', filter(items(reference('server', '2023-08-01', 'full').identity.userAssignedIdentities), lambda('identity', equals(lambdaVariables('identity').key, reference('server').primaryUserAssignedIdentityId)))[0].value.principalId), createObject('value', reference('server', '2023-08-01', 'full').identity.principalId))]"
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "623303847189521629"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string"
+                                    },
+                                    "managedIdentityPrincipalId": {
+                                      "type": "string"
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
+                                      "name": "[guid(format('{0}-{1}-Storage-Blob-Data-Contributor', resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), parameters('managedIdentityPrincipalId')))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                        "principalId": "[parameters('managedIdentityPrincipalId')]",
+                                        "principalType": "ServicePrincipal"
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed audit settings."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed audit settings."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/auditingSettings', parameters('serverName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed audit settings."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "secretsExport": {
+                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "keyVaultName": {
+                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                          },
+                          "secretsToSet": {
+                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'sqlAdminPasswordSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'sqlAdminPasswordSecretName'), 'value', parameters('administratorLoginPassword'))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'sqlAzureConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'sqlAzureConnectionStringSecretName'), 'value', format('Server={0}; Database={1}; User={2}; Password={3}', reference('server').fullyQualifiedDomainName, if(not(empty(parameters('databases'))), tryGet(parameters('databases'), 0, 'name'), ''), parameters('administratorLogin'), parameters('administratorLoginPassword')))), createArray()))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "13065384800228530324"
+                            }
+                          },
+                          "definitions": {
+                            "secretSetOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "secretResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resourceId of the exported secret."
+                                  }
+                                },
+                                "secretUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI of the exported secret."
+                                  }
+                                },
+                                "secretUriWithVersion": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI with version of the exported secret."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            },
+                            "secretToSetType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the secret to set."
+                                  }
+                                },
+                                "value": {
+                                  "type": "securestring",
+                                  "metadata": {
+                                    "description": "Required. The value of the secret to set."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "keyVaultName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Key Vault to set the secrets in."
+                              }
+                            },
+                            "secretsToSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretToSetType"
+                              },
+                              "metadata": {
+                                "description": "Required. The secrets to set in the Key Vault."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "keyVault": {
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('keyVaultName')]"
+                            },
+                            "secrets": {
+                              "copy": {
+                                "name": "secrets",
+                                "count": "[length(parameters('secretsToSet'))]"
+                              },
+                              "type": "Microsoft.KeyVault/vaults/secrets",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                              "properties": {
+                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "secretsSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretSetOutputType"
+                              },
+                              "metadata": {
+                                "description": "The references to the secrets exported to the provided Key Vault."
+                              },
+                              "copy": {
+                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                "input": {
+                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                                  "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server"
+                      ]
+                    },
+                    "failover_groups": {
+                      "copy": {
+                        "name": "failover_groups",
+                        "count": "[length(coalesce(parameters('failoverGroups'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Sql-FailoverGroup-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].name]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('failoverGroups'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "serverName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "databases": {
+                            "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].databases]"
+                          },
+                          "partnerServerResourceIds": {
+                            "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].partnerServerResourceIds]"
+                          },
+                          "readOnlyEndpoint": {
+                            "value": "[tryGet(coalesce(parameters('failoverGroups'), createArray())[copyIndex()], 'readOnlyEndpoint')]"
+                          },
+                          "readWriteEndpoint": {
+                            "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].readWriteEndpoint]"
+                          },
+                          "secondaryType": {
+                            "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].secondaryType]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "11585026026133533203"
+                            },
+                            "name": "Azure SQL Server failover group",
+                            "description": "This module deploys Azure SQL Server failover group."
+                          },
+                          "definitions": {
+                            "readOnlyEndpointType": {
+                              "type": "object",
+                              "properties": {
+                                "failoverPolicy": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "Enabled"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. Failover policy of the read-only endpoint for the failover group."
+                                  }
+                                },
+                                "targetServer": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The target partner server where the read-only endpoint points to."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a read-only endpoint."
+                              }
+                            },
+                            "readWriteEndpointType": {
+                              "type": "object",
+                              "properties": {
+                                "failoverPolicy": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Automatic",
+                                    "Manual"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. Failover policy of the read-write endpoint for the failover group. If failoverPolicy is Automatic then failoverWithDataLossGracePeriodMinutes is required."
+                                  }
+                                },
+                                "failoverWithDataLossGracePeriodMinutes": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Grace period before failover with data loss is attempted for the read-write endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a read-write endpoint."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the failover group."
+                              }
+                            },
+                            "serverName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The Name of SQL Server. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "databases": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "Required. List of databases in the failover group."
+                              }
+                            },
+                            "partnerServerResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "Required. List of the partner server Resource Ids for the failover group."
+                              }
+                            },
+                            "readOnlyEndpoint": {
+                              "$ref": "#/definitions/readOnlyEndpointType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Read-only endpoint of the failover group instance."
+                              }
+                            },
+                            "readWriteEndpoint": {
+                              "$ref": "#/definitions/readWriteEndpointType",
+                              "metadata": {
+                                "description": "Required. Read-write endpoint of the failover group instance."
+                              }
+                            },
+                            "secondaryType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Geo",
+                                "Standby"
+                              ],
+                              "metadata": {
+                                "description": "Required. Databases secondary type on partner server."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Sql/servers/failoverGroups@2023-08-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "server": {
+                              "existing": true,
+                              "type": "Microsoft.Sql/servers",
+                              "apiVersion": "2023-08-01",
+                              "name": "[parameters('serverName')]"
+                            },
+                            "failoverGroup": {
+                              "type": "Microsoft.Sql/servers/failoverGroups",
+                              "apiVersion": "2024-05-01-preview",
+                              "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "databases",
+                                    "count": "[length(parameters('databases'))]",
+                                    "input": "[resourceId('Microsoft.Sql/servers/databases', parameters('serverName'), parameters('databases')[copyIndex('databases')])]"
+                                  },
+                                  {
+                                    "name": "partnerServers",
+                                    "count": "[length(parameters('partnerServerResourceIds'))]",
+                                    "input": {
+                                      "id": "[parameters('partnerServerResourceIds')[copyIndex('partnerServers')]]"
+                                    }
+                                  }
+                                ],
+                                "readOnlyEndpoint": "[if(not(empty(parameters('readOnlyEndpoint'))), createObject('failoverPolicy', parameters('readOnlyEndpoint').failoverPolicy, 'targetServer', resourceId(resourceGroup().name, 'Microsoft.Sql/servers', parameters('readOnlyEndpoint').targetServer)), null())]",
+                                "readWriteEndpoint": "[parameters('readWriteEndpoint')]",
+                                "secondaryType": "[parameters('secondaryType')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed failover group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed failover group."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers/failoverGroups', parameters('serverName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed failover group."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "server",
+                        "server_databases"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed SQL server."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed SQL server."
+                      },
+                      "value": "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+                    },
+                    "fullyQualifiedDomainName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The fully qualified domain name of the deployed SQL server."
+                      },
+                      "value": "[reference('server').fullyQualifiedDomainName]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed SQL server."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('server', '2023-08-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('server', '2023-08-01', 'full').location]"
+                    },
+                    "exportedSecrets": {
+                      "$ref": "#/definitions/secretsOutputType",
+                      "metadata": {
+                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                      },
+                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(coalesce(tryGet(tryGet(tryGet(if(not(equals(parameters('secretsExportConfiguration'), null())), reference('secretsExport'), null()), 'outputs'), 'secretsSet'), 'value'), createArray()), lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the SQL server."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "serverFqdn": {
+              "type": "string",
+              "metadata": {
+                "description": "Fully qualified domain name of the SQL Server."
+              },
+              "value": "[format('{0}.database.windows.net', parameters('name'))]"
+            },
+            "databaseName": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the SQL Database."
+              },
+              "value": "[parameters('databaseName')]"
+            },
+            "serverResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the SQL Server."
+              },
+              "value": "[reference('sqlServer').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the SQL Server."
+              },
+              "value": "[reference('sqlServer').outputs.name.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').sqlServer)]",
+        "virtualNetwork"
+      ]
+    },
+    "hostingplan": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.app-service-plan.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "skuName": "[if(or(parameters('enableScalability'), parameters('enableRedundancy')), createObject('value', 'P1v3'), createObject('value', parameters('appServicePlanSku')))]",
+          "skuCapacity": "[if(parameters('enableScalability'), createObject('value', 3), createObject('value', 1))]",
+          "zoneRedundant": {
+            "value": "[parameters('enableRedundancy')]"
+          },
+          "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "15442179113759093660"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('asp-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the App Service Plan."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "B2",
+              "allowedValues": [
+                "F1",
+                "D1",
+                "B1",
+                "B2",
+                "B3",
+                "S1",
+                "S2",
+                "S3",
+                "P1",
+                "P2",
+                "P3",
+                "P4",
+                "P0v3",
+                "P0v4",
+                "P1v3",
+                "P1v4",
+                "P2v3",
+                "P3v3"
+              ],
+              "metadata": {
+                "description": "SKU name for the App Service Plan."
+              }
+            },
+            "reserved": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Whether the plan is Linux-based."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "linux",
+              "metadata": {
+                "description": "Kind of the App Service Plan."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "skuCapacity": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Number of instances (workers)."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Diagnostic settings for monitoring."
+              }
+            },
+            "zoneRedundant": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable zone redundancy. Requires Premium SKU (P1v3+)."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.web.serverfarm.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "skuName": {
+                    "value": "[parameters('skuName')]"
+                  },
+                  "skuCapacity": {
+                    "value": "[parameters('skuCapacity')]"
+                  },
+                  "reserved": {
+                    "value": "[parameters('reserved')]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]",
+                  "zoneRedundant": {
+                    "value": "[parameters('zoneRedundant')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.40.2.10011",
+                      "templateHash": "17925345736511474747"
+                    },
+                    "name": "App Service Plan",
+                    "description": "This module deploys an App Service Plan."
+                  },
+                  "definitions": {
+                    "diagnosticSettingMetricsOnlyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "minLength": 1,
+                      "maxLength": 60,
+                      "metadata": {
+                        "description": "Required. Name of the app service plan."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "P1v3",
+                      "metadata": {
+                        "example": "  'F1'\n  'B1'\n  'P1v3'\n  'I1v2'\n  'FC1'\n  ",
+                        "description": "Optional. The name of the SKU will Determine the tier, size, family of the App Service Plan. This defaults to P1v3 to leverage availability zones."
+                      }
+                    },
+                    "skuCapacity": {
+                      "type": "int",
+                      "defaultValue": 3,
+                      "metadata": {
+                        "description": "Optional. Number of workers associated with the App Service Plan. This defaults to 3, to leverage availability zones."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/kind"
+                        },
+                        "description": "Optional. Kind of server OS."
+                      },
+                      "defaultValue": "app"
+                    },
+                    "reserved": {
+                      "type": "bool",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/reserved"
+                        },
+                        "description": "Conditional. Defaults to false when creating Windows/app App Service Plan. Required if creating a Linux App Service Plan and must be set to true."
+                      },
+                      "defaultValue": "[equals(parameters('kind'), 'linux')]"
+                    },
+                    "appServiceEnvironmentResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The Resource ID of the App Service Environment to use for the App Service Plan."
+                      }
+                    },
+                    "workerTierName": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/workerTierName"
+                        },
+                        "description": "Optional. Target worker tier assigned to the App Service plan."
+                      },
+                      "nullable": true
+                    },
+                    "perSiteScaling": {
+                      "type": "bool",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/perSiteScaling"
+                        },
+                        "description": "Optional. If true, apps assigned to this App Service plan can be scaled independently. If false, apps assigned to this App Service plan will scale to all instances of the plan."
+                      },
+                      "defaultValue": false
+                    },
+                    "elasticScaleEnabled": {
+                      "type": "bool",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/elasticScaleEnabled"
+                        },
+                        "description": "Optional. Enable/Disable ElasticScaleEnabled App Service Plan."
+                      },
+                      "defaultValue": "[greater(parameters('maximumElasticWorkerCount'), 1)]"
+                    },
+                    "maximumElasticWorkerCount": {
+                      "type": "int",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/maximumElasticWorkerCount"
+                        },
+                        "description": "Optional. Maximum number of total workers allowed for this ElasticScaleEnabled App Service Plan."
+                      },
+                      "defaultValue": 1
+                    },
+                    "targetWorkerCount": {
+                      "type": "int",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/targetWorkerCount"
+                        },
+                        "description": "Optional. Scaling worker count."
+                      },
+                      "defaultValue": 0
+                    },
+                    "targetWorkerSize": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "allowedValues": [
+                        0,
+                        1,
+                        2
+                      ],
+                      "metadata": {
+                        "description": "Optional. The instance size of the hosting plan (small, medium, or large)."
+                      }
+                    },
+                    "zoneRedundant": {
+                      "type": "bool",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/zoneRedundant"
+                        },
+                        "description": "Optional. Zone Redundant server farms can only be used on Premium or ElasticPremium SKU tiers within ZRS Supported regions (https://learn.microsoft.com/en-us/azure/storage/common/redundancy-regions-zrs)."
+                      },
+                      "defaultValue": "[if(or(startsWith(parameters('skuName'), 'P'), startsWith(parameters('skuName'), 'EP')), true(), false())]"
+                    },
+                    "hyperV": {
+                      "type": "bool",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/hyperV"
+                        },
+                        "description": "Optional. If Hyper-V container app service plan true, false otherwise."
+                      },
+                      "nullable": true
+                    },
+                    "virtualNetworkSubnetId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the subnet to integrate the App Service Plan with for VNet integration."
+                      }
+                    },
+                    "isCustomMode": {
+                      "type": "bool",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/isCustomMode"
+                        },
+                        "description": "Optional. Set to true to enable Managed Instance custom mode. Required for App Service Managed Instance plans."
+                      },
+                      "defaultValue": false
+                    },
+                    "rdpEnabled": {
+                      "type": "bool",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/rdpEnabled"
+                        },
+                        "description": "Optional. Whether RDP is enabled for Managed Instance plans. Only applicable when isCustomMode is true. Requires a Bastion host deployed in the VNet."
+                      },
+                      "nullable": true
+                    },
+                    "installScripts": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/installScripts"
+                        },
+                        "description": "Optional. A list of install scripts for Managed Instance plans. Only applicable when isCustomMode is true."
+                      },
+                      "nullable": true
+                    },
+                    "planDefaultIdentity": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/planDefaultIdentity"
+                        },
+                        "description": "Optional. The default identity configuration for Managed Instance plans. Only applicable when isCustomMode is true."
+                      },
+                      "nullable": true
+                    },
+                    "registryAdapters": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/registryAdapters"
+                        },
+                        "description": "Optional. A list of registry adapters for Managed Instance plans. Only applicable when isCustomMode is true."
+                      },
+                      "nullable": true
+                    },
+                    "storageMounts": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/storageMounts"
+                        },
+                        "description": "Optional. A list of storage mounts for Managed Instance plans. Only applicable when isCustomMode is true."
+                      },
+                      "nullable": true
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/serverfarms@2025-03-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                      "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                      "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                    },
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.web-serverfarm.{0}.{1}', replace('0.7.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "appServicePlan": {
+                      "type": "Microsoft.Web/serverfarms",
+                      "apiVersion": "2025-03-01",
+                      "name": "[parameters('name')]",
+                      "kind": "[parameters('kind')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "sku": "[if(equals(parameters('skuName'), 'FC1'), createObject('name', parameters('skuName'), 'tier', 'FlexConsumption'), createObject('name', parameters('skuName'), 'capacity', parameters('skuCapacity')))]",
+                      "properties": {
+                        "workerTierName": "[parameters('workerTierName')]",
+                        "hostingEnvironmentProfile": "[if(not(equals(parameters('appServiceEnvironmentResourceId'), null())), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                        "perSiteScaling": "[parameters('perSiteScaling')]",
+                        "maximumElasticWorkerCount": "[parameters('maximumElasticWorkerCount')]",
+                        "elasticScaleEnabled": "[parameters('elasticScaleEnabled')]",
+                        "reserved": "[parameters('reserved')]",
+                        "targetWorkerCount": "[parameters('targetWorkerCount')]",
+                        "targetWorkerSizeId": "[parameters('targetWorkerSize')]",
+                        "zoneRedundant": "[parameters('zoneRedundant')]",
+                        "hyperV": "[parameters('hyperV')]",
+                        "isCustomMode": "[parameters('isCustomMode')]",
+                        "network": "[if(not(equals(parameters('virtualNetworkSubnetId'), null())), createObject('virtualNetworkSubnetId', parameters('virtualNetworkSubnetId')), null())]",
+                        "rdpEnabled": "[if(parameters('isCustomMode'), parameters('rdpEnabled'), null())]",
+                        "installScripts": "[if(parameters('isCustomMode'), parameters('installScripts'), null())]",
+                        "planDefaultIdentity": "[if(parameters('isCustomMode'), parameters('planDefaultIdentity'), null())]",
+                        "registryAdapters": "[if(parameters('isCustomMode'), parameters('registryAdapters'), null())]",
+                        "storageMounts": "[if(parameters('isCustomMode'), parameters('storageMounts'), null())]"
+                      }
+                    },
+                    "appServicePlan_diagnosticSettings": {
+                      "copy": {
+                        "name": "appServicePlan_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "appServicePlan"
+                      ]
+                    },
+                    "appServicePlan_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "appServicePlan"
+                      ]
+                    },
+                    "appServicePlan_roleAssignments": {
+                      "copy": {
+                        "name": "appServicePlan_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/serverfarms', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "appServicePlan"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the app service plan was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the app service plan."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the app service plan."
+                      },
+                      "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('appServicePlan', '2025-03-01', 'full').location]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('appServicePlan', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service Plan."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.web.serverfarm.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the App Service Plan."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.web.serverfarm.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "log_analytics"
+      ]
+    },
+    "container_registry": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.container-registry.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "name": {
+            "value": "[variables('containerRegistryResourceName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "sku": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Premium'), createObject('value', 'Standard'))]",
+          "adminUserEnabled": {
+            "value": false
+          },
+          "acrPushPrincipalIds": {
+            "value": [
+              "[variables('deployingUserPrincipalId')]"
+            ]
+          },
+          "acrPushPrincipalType": "[if(equals(parameters('deployingUserPrincipalType'), 'User'), createObject('value', 'User'), createObject('value', 'ServicePrincipal'))]",
+          "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "networkRuleSetDefaultAction": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Deny'), createObject('value', 'Allow'))]",
+          "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-{0}', variables('containerRegistryResourceName')), 'customNetworkInterfaceName', format('nic-{0}', variables('containerRegistryResourceName')), 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'service', 'registry', 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').containerRegistry)).outputs.resourceId.value)))))), createObject('value', createArray()))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "3930444124847538270"
+            }
+          },
+          "definitions": {
+            "_1.lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointSingleServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private Endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the Private Endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/_1.lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name used for naming convention."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[replace(format('cr{0}', parameters('solutionName')), '-', '')]",
+              "metadata": {
+                "description": "Name of the container registry."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for deployment."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Resource tags."
+              }
+            },
+            "sku": {
+              "type": "string",
+              "defaultValue": "Standard",
+              "allowedValues": [
+                "Basic",
+                "Standard",
+                "Premium"
+              ],
+              "metadata": {
+                "description": "SKU for the container registry."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "exportPolicyStatus": {
+              "type": "string",
+              "defaultValue": "enabled",
+              "metadata": {
+                "description": "Export policy status. Must be \"enabled\" when publicNetworkAccess is \"Enabled\"."
+              }
+            },
+            "azureADAuthenticationAsArmPolicyStatus": {
+              "type": "string",
+              "defaultValue": "enabled",
+              "allowedValues": [
+                "enabled",
+                "disabled"
+              ],
+              "metadata": {
+                "description": "ARM-audience AAD token policy status. Keep \"enabled\" for App Service managed-identity ACR pulls."
+              }
+            },
+            "acrPullPrincipalIds": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Principal IDs to assign AcrPull role."
+              }
+            },
+            "acrPushPrincipalIds": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Principal IDs to assign AcrPush role (typically the deployer)."
+              }
+            },
+            "acrPushPrincipalType": {
+              "type": "string",
+              "defaultValue": "User",
+              "allowedValues": [
+                "User",
+                "ServicePrincipal",
+                "Group"
+              ],
+              "metadata": {
+                "description": "Principal type for AcrPush assignments (User for azd user, ServicePrincipal for CI)."
+              }
+            },
+            "adminUserEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable the ACR admin user (username/password). Used by App Service for reliable image pulls behind a private VNet."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointSingleServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "networkRuleSetDefaultAction": {
+              "type": "string",
+              "defaultValue": "Allow",
+              "allowedValues": [
+                "Allow",
+                "Deny"
+              ],
+              "metadata": {
+                "description": "Default action for the network rule set. Use Allow when no private endpoint is in place; Deny for private-only."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable Azure telemetry collection."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "pullRoleAssignments",
+                "count": "[length(parameters('acrPullPrincipalIds'))]",
+                "input": {
+                  "principalId": "[parameters('acrPullPrincipalIds')[copyIndex('pullRoleAssignments')]]",
+                  "roleDefinitionIdOrName": "[variables('acrPullRoleId')]",
+                  "principalType": "ServicePrincipal"
+                }
+              },
+              {
+                "name": "pushRoleAssignments",
+                "count": "[length(parameters('acrPushPrincipalIds'))]",
+                "input": {
+                  "principalId": "[parameters('acrPushPrincipalIds')[copyIndex('pushRoleAssignments')]]",
+                  "roleDefinitionIdOrName": "[variables('acrPushRoleId')]",
+                  "principalType": "[parameters('acrPushPrincipalType')]"
+                }
+              }
+            ],
+            "acrPullRoleId": "7f951dda-4ed3-4680-a7ca-43fe172d538d",
+            "acrPushRoleId": "8311e382-0749-4cb8-b61a-304f252e45ec",
+            "roleAssignments": "[concat(if(not(empty(parameters('acrPullPrincipalIds'))), variables('pullRoleAssignments'), createArray()), if(not(empty(parameters('acrPushPrincipalIds'))), variables('pushRoleAssignments'), createArray()))]"
+          },
+          "resources": {
+            "containerRegistry": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.containerregistry.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "acrSku": {
+                    "value": "[parameters('sku')]"
+                  },
+                  "acrAdminUserEnabled": {
+                    "value": "[parameters('adminUserEnabled')]"
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "exportPolicyStatus": {
+                    "value": "[parameters('exportPolicyStatus')]"
+                  },
+                  "azureADAuthenticationAsArmPolicyStatus": {
+                    "value": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
+                  },
+                  "roleAssignments": "[if(not(empty(variables('roleAssignments'))), createObject('value', variables('roleAssignments')), createObject('value', createArray()))]",
+                  "privateEndpoints": {
+                    "value": "[parameters('privateEndpoints')]"
+                  },
+                  "networkRuleSetDefaultAction": {
+                    "value": "[parameters('networkRuleSetDefaultAction')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.42.1.51946",
+                      "templateHash": "1509121545318808417"
+                    },
+                    "name": "Azure Container Registries (ACR)",
+                    "description": "This module deploys an Azure Container Registry (ACR)."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "credentialSetType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the credential set."
+                          }
+                        },
+                        "managedIdentities": {
+                          "$ref": "#/definitions/managedIdentityOnlySysAssignedType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The managed identity definition for this resource."
+                          }
+                        },
+                        "authCredentials": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/authCredentialsType"
+                          },
+                          "metadata": {
+                            "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential."
+                          }
+                        },
+                        "loginServer": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The credentials are stored for this upstream or login server."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a credential set."
+                      }
+                    },
+                    "scopeMapsType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the scope map."
+                          }
+                        },
+                        "actions": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/scopeMaps@2025-03-01-preview#properties/properties/properties/actions"
+                            },
+                            "description": "Required. The list of scoped permissions for registry artifacts."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The user friendly description of the scope map."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a scope map."
+                      }
+                    },
+                    "cacheRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined."
+                          }
+                        },
+                        "sourceRepository": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Source repository pulled from upstream."
+                          }
+                        },
+                        "targetRepository": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                          }
+                        },
+                        "credentialSetResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the credential store which is associated with the cache rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a cache rule."
+                      }
+                    },
+                    "replicationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the replication."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for all resources."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/replications@2025-03-01-preview#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        },
+                        "regionEndpointEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                          }
+                        },
+                        "zoneRedundancy": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries@2025-03-01-preview#properties/properties/properties/zoneRedundancy"
+                            },
+                            "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a replication."
+                      }
+                    },
+                    "taskType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the task."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for all resources."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        },
+                        "platform": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/platform"
+                            },
+                            "description": "Optional. The platform properties for the task."
+                          },
+                          "nullable": true
+                        },
+                        "step": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/step"
+                            },
+                            "description": "Optional. The step properties for the task."
+                          },
+                          "nullable": true
+                        },
+                        "trigger": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/trigger"
+                            },
+                            "description": "Optional. The trigger properties for the task."
+                          },
+                          "nullable": true
+                        },
+                        "status": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/status"
+                            },
+                            "description": "Optional. The status of the task at the time the operation was called."
+                          },
+                          "nullable": true
+                        },
+                        "timeout": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timeout in seconds for the task to run before it is automatically disabled."
+                          }
+                        },
+                        "agentConfiguration": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/agentConfiguration"
+                            },
+                            "description": "Optional. The agent configuration for the task."
+                          },
+                          "nullable": true
+                        },
+                        "agentPoolName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the agent pool to run the task on. If not specified, the task will run on Microsoft-hosted agents."
+                          }
+                        },
+                        "isSystemTask": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether this is a system task or not. System tasks have some additional restrictions and are used for internal purposes by Microsoft services, such as Azure DevOps pipelines integration."
+                          }
+                        },
+                        "logTemplate": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The log template for the task to use when creating logs in Log Analytics."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a task."
+                      }
+                    },
+                    "tokenType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the token."
+                          }
+                        },
+                        "scopeMapResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the scope map which defines the permissions for this token."
+                          }
+                        },
+                        "status": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/tokens@2025-11-01#properties/properties/properties/status"
+                            },
+                            "description": "Optional. The status of the token at the time the operation was called."
+                          },
+                          "nullable": true
+                        },
+                        "credentials": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/authCredentialsType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The list of credentials associated with the token. Usually consists of a primary and an optional secondary credential."
+                          }
+                        }
+                      }
+                    },
+                    "webhookType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "minLength": 5,
+                          "maxLength": 50,
+                          "metadata": {
+                            "description": "Optional. The name of the registry webhook."
+                          }
+                        },
+                        "serviceUri": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The service URI for the webhook to post notifications."
+                          }
+                        },
+                        "status": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/webhooks@2025-03-01-preview#properties/properties/properties/status"
+                            },
+                            "description": "Optional. The status of the webhook at the time the operation was called."
+                          },
+                          "nullable": true
+                        },
+                        "action": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The list of actions that trigger the webhook to post notifications."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for all resources."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/webhooks@2025-03-01-preview#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        },
+                        "customHeaders": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.ContainerRegistry/registries/webhooks@2025-03-01-preview#properties/properties/properties/customHeaders"
+                            },
+                            "description": "Optional. Custom headers that will be added to the webhook notifications."
+                          },
+                          "nullable": true
+                        },
+                        "scope": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a webhook."
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "authCredentialsType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the credential."
+                          }
+                        },
+                        "usernameSecretIdentifier": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. KeyVault Secret URI for accessing the username."
+                          }
+                        },
+                        "passwordSecretIdentifier": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. KeyVault Secret URI for accessing the password."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for auth credentials.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "credential-set/main.bicep"
+                        }
+                      }
+                    },
+                    "customerManagedKeyWithAutoRotateType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                          }
+                        },
+                        "keyName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the customer managed key to use for encryption."
+                          }
+                        },
+                        "keyVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                          }
+                        },
+                        "autoRotationEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                          }
+                        },
+                        "userAssignedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "managedIdentityOnlySysAssignedType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "minLength": 5,
+                      "maxLength": 50,
+                      "metadata": {
+                        "description": "Required. Name of your Azure Container Registry."
+                      }
+                    },
+                    "acrAdminUserEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enable admin user that have push / pull permission to the registry."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "autoGeneratedDomainNameLabelScope": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "NoReuse",
+                        "ResourceGroupReuse",
+                        "SubscriptionReuse",
+                        "TenantReuse",
+                        "Unsecure"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The domain name label reuse scope."
+                      }
+                    },
+                    "roleAssignmentMode": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "AbacRepositoryPermissions",
+                        "LegacyRegistryPermissions"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The registry permissions role assignment mode."
+                      }
+                    },
+                    "acrSku": {
+                      "type": "string",
+                      "defaultValue": "Premium",
+                      "allowedValues": [
+                        "Basic",
+                        "Premium",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Tier of your Azure container registry."
+                      }
+                    },
+                    "exportPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the export policy is enabled or not."
+                      }
+                    },
+                    "quarantinePolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "trustPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "retentionPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "enabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the retention policy is enabled or not."
+                      }
+                    },
+                    "retentionPolicyDays": {
+                      "type": "int",
+                      "defaultValue": 15,
+                      "metadata": {
+                        "description": "Optional. The number of days to retain an untagged manifest after which it gets purged."
+                      }
+                    },
+                    "azureADAuthenticationAsArmPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registry is enabled or not. Default is disabled."
+                      }
+                    },
+                    "softDeletePolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Soft Delete policy status. Default is disabled."
+                      }
+                    },
+                    "softDeletePolicyDays": {
+                      "type": "int",
+                      "defaultValue": 7,
+                      "metadata": {
+                        "description": "Optional. The number of days after which a soft-deleted item is permanently deleted."
+                      }
+                    },
+                    "dataEndpointEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set.  Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "networkRuleBypassOptions": {
+                      "type": "string",
+                      "defaultValue": "AzureServices",
+                      "allowedValues": [
+                        "AzureServices",
+                        "None"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry."
+                      }
+                    },
+                    "networkRuleSetDefaultAction": {
+                      "type": "string",
+                      "defaultValue": "Deny",
+                      "allowedValues": [
+                        "Allow",
+                        "Deny"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The default action of allow or deny when no other rules match."
+                      }
+                    },
+                    "networkRuleSetIpRules": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'. Set to an empty array to explicitly configure no allowed IPs."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "zoneRedundancy": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                      }
+                    },
+                    "replications": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/replicationType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. All replications to create."
+                      }
+                    },
+                    "webhooks": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/webhookType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. All webhooks to create."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.ContainerRegistry/registries@2025-04-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service. If neither metrics nor logs are specified, all metrics & logs are configured by default. If either one is specified, the other is ignored."
+                      }
+                    },
+                    "anonymousPullEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers."
+                      }
+                    },
+                    "customerManagedKey": {
+                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The customer managed key definition."
+                      }
+                    },
+                    "cacheRules": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/cacheRuleType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of Cache Rules."
+                      }
+                    },
+                    "credentialSets": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/credentialSetType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of Credential Sets."
+                      }
+                    },
+                    "scopeMaps": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/scopeMapsType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Scope maps setting."
+                      }
+                    },
+                    "tokens": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/tokenType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tokens to create for the container registry."
+                      }
+                    },
+                    "tasks": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/taskType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of ACR Tasks to create."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]",
+                      "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]",
+                      "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
+                      "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]",
+                      "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]",
+                      "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]",
+                      "Container Registry Repository Catalog Lister": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'bfdb9389-c9a5-478a-bb2f-ba9ca092c3c7')]",
+                      "Container Registry Repository Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2efddaa5-3f1f-4df3-97df-af3f13818f4c')]",
+                      "Container Registry Repository Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b93aa761-3e63-49ed-ac28-beffa264f7ac')]",
+                      "Container Registry Repository Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a1e307c-b015-4ebd-883e-5b7698a07328')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    },
+                    "publicNetworkAccessMode": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]",
+                    "shouldConfigureNetworkRuleSet": "[or(not(equals(parameters('networkRuleSetIpRules'), null())), and(equals(variables('publicNetworkAccessMode'), 'Enabled'), equals(parameters('networkRuleSetDefaultAction'), 'Deny')))]"
+                  },
+                  "resources": {
+                    "cMKKeyVault::cMKKey": {
+                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults/keys",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.12.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "cMKKeyVault": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                    },
+                    "cMKUserAssignedIdentity": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                      "apiVersion": "2024-11-30",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                    },
+                    "registry": {
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2025-06-01-preview",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "identity": "[variables('identity')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('acrSku')]"
+                      },
+                      "properties": {
+                        "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]",
+                        "adminUserEnabled": "[parameters('acrAdminUserEnabled')]",
+                        "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                        "roleAssignmentMode": "[parameters('roleAssignmentMode')]",
+                        "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, tryGet(parameters('customerManagedKey'), 'keyVersion')), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), reference('cMKKeyVault::cMKKey').keyUri, reference('cMKKeyVault::cMKKey').keyUriWithVersion)))), null())]",
+                        "policies": {
+                          "azureADAuthenticationAsArmPolicy": {
+                            "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
+                          },
+                          "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]",
+                          "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]",
+                          "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]",
+                          "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]",
+                          "softDeletePolicy": {
+                            "retentionDays": "[parameters('softDeletePolicyDays')]",
+                            "status": "[parameters('softDeletePolicyStatus')]"
+                          }
+                        },
+                        "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]",
+                        "publicNetworkAccess": "[variables('publicNetworkAccessMode')]",
+                        "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]",
+                        "networkRuleSet": "[if(variables('shouldConfigureNetworkRuleSet'), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', coalesce(parameters('networkRuleSetIpRules'), createArray())), null())]",
+                        "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]"
+                      },
+                      "dependsOn": [
+                        "cMKKeyVault::cMKKey",
+                        "cMKUserAssignedIdentity"
+                      ]
+                    },
+                    "registry_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_diagnosticSettings": {
+                      "copy": {
+                        "name": "registry_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups')), createArray(createObject('category', 'AllMetrics')), createArray())))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups')), createArray(createObject('category', 'AllMetrics')), createArray()))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups')), createArray(createObject('category', 'AllMetrics')), createArray()))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories')), createArray(createObject('categoryGroup', 'allLogs')), createArray())))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories')), createArray(createObject('categoryGroup', 'allLogs')), createArray()))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories')), createArray(createObject('categoryGroup', 'allLogs')), createArray()))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories')), createArray(createObject('categoryGroup', 'allLogs')), createArray()))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_roleAssignments": {
+                      "copy": {
+                        "name": "registry_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_scopeMaps": {
+                      "copy": {
+                        "name": "registry_scopeMaps",
+                        "count": "[length(coalesce(parameters('scopeMaps'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Registry-Scope-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "actions": {
+                            "value": "[coalesce(parameters('scopeMaps'), createArray())[copyIndex()].actions]"
+                          },
+                          "description": {
+                            "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'description')]"
+                          },
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.42.1.51946",
+                              "templateHash": "3787322352564227867"
+                            },
+                            "name": "Container Registries scope maps",
+                            "description": "This module deploys an Azure Container Registry (ACR) scope map."
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}-scopemaps', parameters('registryName'))]",
+                              "metadata": {
+                                "description": "Optional. The name of the scope map."
+                              }
+                            },
+                            "actions": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "Required. The list of scoped permissions for registry artifacts."
+                              }
+                            },
+                            "description": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The user friendly description of the scope map."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.containerregistry-registry-scopemap.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2025-11-01",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "scopeMap": {
+                              "type": "Microsoft.ContainerRegistry/registries/scopeMaps",
+                              "apiVersion": "2025-11-01",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "properties": {
+                                "actions": "[parameters('actions')]",
+                                "description": "[parameters('description')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the scope map."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the scope map was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the scope map."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/scopeMaps', parameters('registryName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_replications": {
+                      "copy": {
+                        "name": "registry_replications",
+                        "count": "[length(coalesce(parameters('replications'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]"
+                          },
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]"
+                          },
+                          "regionEndpointEnabled": {
+                            "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]"
+                          },
+                          "zoneRedundancy": {
+                            "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.42.1.51946",
+                              "templateHash": "6219097750044645017"
+                            },
+                            "name": "Azure Container Registry (ACR) Replications",
+                            "description": "This module deploys an Azure Container Registry (ACR) Replication."
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the replication."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries/replications@2025-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "regionEndpointEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                              }
+                            },
+                            "zoneRedundancy": {
+                              "type": "string",
+                              "defaultValue": "Disabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.containerregistry-registry-repl.{0}.{1}', replace('0.1.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2025-11-01",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "replication": {
+                              "type": "Microsoft.ContainerRegistry/registries/replications",
+                              "apiVersion": "2025-11-01",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]",
+                                "zoneRedundancy": "[parameters('zoneRedundancy')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the replication."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the replication."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the replication was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('replication', '2025-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_credentialSets": {
+                      "copy": {
+                        "name": "registry_credentialSets",
+                        "count": "[length(coalesce(parameters('credentialSets'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Registry-CredentialSet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].name]"
+                          },
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].managedIdentities]"
+                          },
+                          "authCredentials": {
+                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].authCredentials]"
+                          },
+                          "loginServer": {
+                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].loginServer]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.42.1.51946",
+                              "templateHash": "13412699468141336519"
+                            },
+                            "name": "Container Registries Credential Sets",
+                            "description": "This module deploys an ACR Credential Set."
+                          },
+                          "definitions": {
+                            "authCredentialsType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the credential."
+                                  }
+                                },
+                                "usernameSecretIdentifier": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. KeyVault Secret URI for accessing the username."
+                                  }
+                                },
+                                "passwordSecretIdentifier": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. KeyVault Secret URI for accessing the password."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for auth credentials."
+                              }
+                            },
+                            "managedIdentityOnlySysAssignedType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the credential set."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityOnlySysAssignedType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "authCredentials": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/authCredentialsType"
+                              },
+                              "metadata": {
+                                "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential."
+                              }
+                            },
+                            "loginServer": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The credentials are stored for this upstream or login server."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.containerregistry-registry-credset.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2025-11-01",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "credentialSet": {
+                              "type": "Microsoft.ContainerRegistry/registries/credentialSets",
+                              "apiVersion": "2025-11-01",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', null())), null())]",
+                              "properties": {
+                                "authCredentials": "[parameters('authCredentials')]",
+                                "loginServer": "[parameters('loginServer')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The Name of the Credential Set."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Credential Set."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Credential Set."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/credentialSets', parameters('registryName'), parameters('name'))]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('credentialSet', '2025-11-01', 'full'), 'identity'), 'principalId')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_cacheRules": {
+                      "copy": {
+                        "name": "registry_cacheRules",
+                        "count": "[length(coalesce(parameters('cacheRules'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "sourceRepository": {
+                            "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "targetRepository": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]"
+                          },
+                          "credentialSetResourceId": {
+                            "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.42.1.51946",
+                              "templateHash": "1319901650921923538"
+                            },
+                            "name": "Container Registry Cache",
+                            "description": "The cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache))."
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[replace(replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-'), '*', '')]",
+                              "metadata": {
+                                "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined."
+                              }
+                            },
+                            "sourceRepository": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Source repository pulled from upstream."
+                              }
+                            },
+                            "targetRepository": {
+                              "type": "string",
+                              "defaultValue": "[parameters('sourceRepository')]",
+                              "metadata": {
+                                "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                              }
+                            },
+                            "credentialSetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the credential store which is associated with the cache rule. Required only when pulling from authenticated upstream registries (e.g., Docker Hub). Omit for anonymous public registries such as MCR (mcr.microsoft.com)."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.containerregistry-registry-cacherule.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2025-11-01",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "cacheRule": {
+                              "type": "Microsoft.ContainerRegistry/registries/cacheRules",
+                              "apiVersion": "2025-11-01",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "properties": {
+                                "sourceRepository": "[parameters('sourceRepository')]",
+                                "targetRepository": "[parameters('targetRepository')]",
+                                "credentialSetResourceId": "[parameters('credentialSetResourceId')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The Name of the Cache Rule."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Cache Rule."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Cache Rule."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry",
+                        "registry_credentialSets"
+                      ]
+                    },
+                    "registry_tokens": {
+                      "copy": {
+                        "name": "registry_tokens",
+                        "count": "[length(coalesce(parameters('tokens'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Registry-Token-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('tokens'), createArray())[copyIndex()].name]"
+                          },
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "scopeMapResourceId": {
+                            "value": "[coalesce(parameters('tokens'), createArray())[copyIndex()].scopeMapResourceId]"
+                          },
+                          "status": {
+                            "value": "[tryGet(coalesce(parameters('tokens'), createArray())[copyIndex()], 'status')]"
+                          },
+                          "credentials": {
+                            "value": "[tryGet(coalesce(parameters('tokens'), createArray())[copyIndex()], 'credentials')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.42.1.51946",
+                              "templateHash": "5970335582661416899"
+                            },
+                            "name": "Container Registries Tokens",
+                            "description": "Deploys an Azure Container Registry (ACR) Token."
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "minLength": 5,
+                              "maxLength": 50,
+                              "metadata": {
+                                "description": "Required. The name of the token."
+                              }
+                            },
+                            "scopeMapResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the scope map to which the token will be associated with."
+                              }
+                            },
+                            "status": {
+                              "type": "string",
+                              "defaultValue": "enabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The status of the token. Default is enabled."
+                              }
+                            },
+                            "credentials": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries/tokens@2025-11-01#properties/properties/properties/credentials"
+                                },
+                                "description": "Optional. The credentials associated with the token for authentication."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.containerregistry-registry-token.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2025-11-01",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "token": {
+                              "type": "Microsoft.ContainerRegistry/registries/tokens",
+                              "apiVersion": "2025-11-01",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "properties": {
+                                "scopeMapId": "[parameters('scopeMapResourceId')]",
+                                "status": "[parameters('status')]",
+                                "credentials": "[if(not(empty(coalesce(parameters('credentials'), createArray()))), createObject('certificates', tryGet(parameters('credentials'), 'certificates'), 'passwords', tryGet(parameters('credentials'), 'passwords')), null())]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the token."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the token was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the token."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/tokens', parameters('registryName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry",
+                        "registry_scopeMaps"
+                      ]
+                    },
+                    "registry_tasks": {
+                      "copy": {
+                        "name": "registry_tasks",
+                        "count": "[length(coalesce(parameters('tasks'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Registry-Task-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('tasks'), createArray())[copyIndex()].name]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "platform": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'platform')]"
+                          },
+                          "step": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'step')]"
+                          },
+                          "trigger": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'trigger')]"
+                          },
+                          "status": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'status')]"
+                          },
+                          "timeout": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'timeout')]"
+                          },
+                          "agentConfiguration": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'agentConfiguration')]"
+                          },
+                          "agentPoolName": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'agentPoolName')]"
+                          },
+                          "credentials": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'credentials')]"
+                          },
+                          "isSystemTask": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'isSystemTask')]"
+                          },
+                          "logTemplate": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'logTemplate')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'managedIdentities')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.42.1.51946",
+                              "templateHash": "2468771835002458415"
+                            },
+                            "name": "Container Registries Tasks",
+                            "description": "Deploys an Azure Container Registry (ACR) Task that can be used to automate container image builds and other workflows ([ref](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tasks-overview))."
+                          },
+                          "definitions": {
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "minLength": 5,
+                              "maxLength": 50,
+                              "metadata": {
+                                "description": "Required. The name of the task."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "platform": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/platform"
+                                },
+                                "description": "Optional. The platform properties against which the task has to run."
+                              },
+                              "nullable": true
+                            },
+                            "step": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/step"
+                                },
+                                "description": "Optional. The task step properties. Exactly one of dockerBuildStep, encodedTaskStep, or fileTaskStep must be provided."
+                              },
+                              "nullable": true
+                            },
+                            "trigger": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/trigger"
+                                },
+                                "description": "Optional. The properties that describe all triggers for the task."
+                              },
+                              "nullable": true
+                            },
+                            "status": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The current status of task."
+                              }
+                            },
+                            "timeout": {
+                              "type": "int",
+                              "defaultValue": 3600,
+                              "minValue": 300,
+                              "maxValue": 28800,
+                              "metadata": {
+                                "description": "Optional. Run timeout in seconds."
+                              }
+                            },
+                            "agentConfiguration": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/agentConfiguration"
+                                },
+                                "description": "Optional. The machine configuration of the run agent."
+                              },
+                              "nullable": true
+                            },
+                            "agentPoolName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The dedicated agent pool for the task."
+                              }
+                            },
+                            "credentials": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/credentials"
+                                },
+                                "description": "Optional. The properties that describe the credentials that will be used when the task is invoked."
+                              },
+                              "nullable": true
+                            },
+                            "isSystemTask": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The value of this property indicates whether the task resource is system task or not."
+                              }
+                            },
+                            "logTemplate": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The template that describes the repository and tag information for run log artifact."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.containerregistry-registry-task.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2025-11-01",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "task": {
+                              "type": "Microsoft.ContainerRegistry/registries/tasks",
+                              "apiVersion": "2025-03-01-preview",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "identity": "[variables('identity')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "agentConfiguration": "[parameters('agentConfiguration')]",
+                                "agentPoolName": "[parameters('agentPoolName')]",
+                                "credentials": "[parameters('credentials')]",
+                                "isSystemTask": "[parameters('isSystemTask')]",
+                                "logTemplate": "[parameters('logTemplate')]",
+                                "platform": "[parameters('platform')]",
+                                "status": "[parameters('status')]",
+                                "step": "[parameters('step')]",
+                                "timeout": "[parameters('timeout')]",
+                                "trigger": "[parameters('trigger')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the task."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the task was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the task."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/tasks', parameters('registryName'), parameters('name'))]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('task', '2025-03-01-preview', 'full').location]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('task', '2025-03-01-preview', 'full'), 'identity'), 'principalId')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_webhooks": {
+                      "copy": {
+                        "name": "registry_webhooks",
+                        "count": "[length(coalesce(parameters('webhooks'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]"
+                          },
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
+                          },
+                          "action": {
+                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action')]"
+                          },
+                          "customHeaders": {
+                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]"
+                          },
+                          "scope": {
+                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]"
+                          },
+                          "status": {
+                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]"
+                          },
+                          "serviceUri": {
+                            "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.42.1.51946",
+                              "templateHash": "3200175097987099858"
+                            },
+                            "name": "Azure Container Registry (ACR) Webhooks",
+                            "description": "This module deploys an Azure Container Registry (ACR) Webhook."
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}webhook', parameters('registryName'))]",
+                              "minLength": 5,
+                              "maxLength": 50,
+                              "metadata": {
+                                "description": "Optional. The name of the registry webhook."
+                              }
+                            },
+                            "serviceUri": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "Required. The service URI for the webhook to post notifications."
+                              }
+                            },
+                            "status": {
+                              "type": "string",
+                              "defaultValue": "enabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The status of the webhook at the time the operation was called."
+                              }
+                            },
+                            "action": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": [
+                                "chart_delete",
+                                "chart_push",
+                                "delete",
+                                "push",
+                                "quarantine"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The list of actions that trigger the webhook to post notifications."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries/webhooks@2025-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "customHeaders": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Custom headers that will be added to the webhook notifications."
+                              }
+                            },
+                            "scope": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.containerregistry-registry-webhook.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2025-11-01",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "webhook": {
+                              "type": "Microsoft.ContainerRegistry/registries/webhooks",
+                              "apiVersion": "2025-11-01",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "actions": "[parameters('action')]",
+                                "customHeaders": "[parameters('customHeaders')]",
+                                "scope": "[parameters('scope')]",
+                                "serviceUri": "[parameters('serviceUri')]",
+                                "status": "[parameters('status')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the webhook."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the webhook."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Azure container registry."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "actions": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "The actions of the webhook."
+                              },
+                              "value": "[reference('webhook').actions]"
+                            },
+                            "status": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The status of the webhook."
+                              },
+                              "value": "[reference('webhook').status]"
+                            },
+                            "provistioningState": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The provisioning state of the webhook."
+                              },
+                              "value": "[reference('webhook').provisioningState]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('webhook', '2025-11-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_privateEndpoints": {
+                      "copy": {
+                        "name": "registry_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "18436885663402767850"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private dns zone group."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a private DNS zone group configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                },
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              },
+                              "nullable": true
+                            },
+                            "ipVersionType": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                },
+                                "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                              },
+                              "defaultValue": "IPv4"
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                },
+                                "description": "Optional. Custom DNS configurations."
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                },
+                                "ipVersionType": "[parameters('ipVersionType')]"
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "9935179114830442414"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private DNS zone group configuration."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "privateDnsZoneConfigs",
+                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "properties": {
+                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                              }
+                                            }
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                  "output": true
+                                },
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry",
+                        "registry_replications"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Name of the Azure container registry."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "loginServer": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The reference to the Azure container registry."
+                      },
+                      "value": "[reference('registry').loginServer]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Azure container registry."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Azure container registry."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('registry', '2025-06-01-preview', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('registry', '2025-06-01-preview', 'full').location]"
+                    },
+                    "credentialSetsSystemAssignedMIPrincipalIds": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The Principal IDs of the ACR Credential Sets system-assigned identities."
+                      },
+                      "copy": {
+                        "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]",
+                        "input": "[tryGet(tryGet(reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+                      }
+                    },
+                    "credentialSetsResourceIds": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The Resource IDs of the ACR Credential Sets."
+                      },
+                      "copy": {
+                        "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]",
+                        "input": "[reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs.resourceId.value]"
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the Azure container registry."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the container registry."
+              },
+              "value": "[reference('containerRegistry').outputs.name.value]"
+            },
+            "loginServer": {
+              "type": "string",
+              "metadata": {
+                "description": "The login server URL."
+              },
+              "value": "[reference('containerRegistry').outputs.loginServer.value]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the container registry."
+              },
+              "value": "[reference('containerRegistry').outputs.resourceId.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').containerRegistry)]",
+        "virtualNetwork"
+      ]
+    },
+    "backend_docker": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[format('api-{0}', variables('solutionSuffix'))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[union(parameters('tags'), createObject('azd-service-name', 'api'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "serverFarmResourceId": {
+            "value": "[reference('hostingplan').outputs.resourceId.value]"
+          },
+          "kind": {
+            "value": "[parameters('kind')]"
+          },
+          "linuxFxVersion": {
+            "value": "[variables('placeholderImageName')]"
+          },
+          "virtualNetworkSubnetId": "[if(parameters('enablePrivateNetworking'), createObject('value', reference('virtualNetwork').outputs.webserverfarmSubnetResourceId.value), createObject('value', ''))]",
+          "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "vnetRouteAllEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+          "imagePullTraffic": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+          "contentShareTraffic": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+          "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-api-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-api-{0}', variables('solutionSuffix')), 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'service', 'sites', 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').webApp)).outputs.resourceId.value)))))), createObject('value', createArray()))]",
+          "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+          "managedIdentities": {
+            "value": {
+              "systemAssigned": true
+            }
+          },
+          "acrUseManagedIdentityCreds": {
+            "value": true
+          },
+          "appSettings": {
+            "value": {
+              "WEBSITES_PORT": "8000",
+              "AZURE_OPENAI_ENDPOINT": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.endpoint.value, reference('ai_foundry_project').outputs.endpoint.value)]",
+              "AZURE_OPENAI_CHAT_DEPLOYMENT": "[parameters('gptModelName')]",
+              "AZURE_OPENAI_EMBEDDING_DEPLOYMENT": "[parameters('embeddingModel')]",
+              "AZURE_SEARCH_ENDPOINT": "[reference('ai_search').outputs.endpoint.value]",
+              "AZURE_SEARCH_INDEX_NAME": "knowledge-mining-index",
+              "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.azureOpenAiCuEndpoint.value, reference('ai_foundry_project').outputs.azureOpenAiCuEndpoint.value)]",
+              "AZURE_STORAGE_ACCOUNT": "[reference('storage_account').outputs.name.value]",
+              "AZURE_SQL_SERVER": "[reference('sqlDBModule').outputs.serverFqdn.value]",
+              "AZURE_SQL_DATABASE": "[reference('sqlDBModule').outputs.databaseName.value]",
+              "AZURE_COSMOS_ENDPOINT": "[if(parameters('deployCosmos'), reference('cosmosDBModule').outputs.endpoint.value, '')]",
+              "AZURE_COSMOS_DATABASE": "[if(parameters('deployCosmos'), 'km-db', '')]",
+              "AZURE_AD_TENANT_ID": "[parameters('azureAdTenantId')]",
+              "AZURE_AD_CLIENT_ID": "[parameters('azureAdClientId')]",
+              "AZURE_AI_AGENT_ENDPOINT": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.projectEndpoint.value, reference('ai_foundry_project').outputs.projectEndpoint.value)]",
+              "AZURE_AI_SEARCH_CONNECTION_NAME": "[reference('foundry_search_connection').outputs.connectionName.value]",
+              "API_APP_NAME": "[format('api-{0}', variables('solutionSuffix'))]",
+              "APP_FRONTEND_HOSTNAME": "[format('https://app-{0}.azurewebsites.net', variables('solutionSuffix'))]",
+              "APP_ENV": "Prod",
+              "ADMIN_API_KEY": "[parameters('adminApiKey')]",
+              "SOLUTION_SUFFIX": "[variables('solutionSuffix')]",
+              "APPLICATIONINSIGHTS_CONNECTION_STRING": "[if(parameters('enableMonitoring'), reference('app_insights').outputs.connectionString.value, '')]"
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "7275312158093319855"
+            }
+          },
+          "definitions": {
+            "_1.lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointSingleServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private Endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the Private Endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/_1.lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[parameters('solutionName')]",
+              "metadata": {
+                "description": "Name of the App Service."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "serverFarmResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service Plan."
+              }
+            },
+            "linuxFxVersion": {
+              "type": "string",
+              "metadata": {
+                "description": "Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag)."
+              }
+            },
+            "appSettings": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Application settings key-value pairs."
+              }
+            },
+            "applicationInsightResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of Application Insights for monitoring integration."
+              }
+            },
+            "alwaysOn": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Whether to enable Always On."
+              }
+            },
+            "healthCheckPath": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Health check path for the app."
+              }
+            },
+            "webSocketsEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to enable WebSockets."
+              }
+            },
+            "appCommandLine": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Command line for the application."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "app,linux",
+              "allowedValues": [
+                "functionapp",
+                "functionapp,linux",
+                "functionapp,workflowapp",
+                "functionapp,workflowapp,linux",
+                "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
+                "app,linux",
+                "app",
+                "linux,api",
+                "api",
+                "app,linux,container",
+                "app,container,windows"
+              ],
+              "metadata": {
+                "description": "Required. Type of site to deploy."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Diagnostic settings for monitoring."
+              }
+            },
+            "virtualNetworkSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Subnet resource ID for VNet integration."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "acrUseManagedIdentityCreds": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether the app pulls its container image from ACR using its managed identity."
+              }
+            },
+            "acrUserManagedIdentityID": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Client ID of the user-assigned identity used for ACR image pulls (empty = system-assigned)."
+              }
+            },
+            "vnetRouteAllEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to route all outbound traffic through the virtual network."
+              }
+            },
+            "imagePullTraffic": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to route image pull traffic through the virtual network."
+              }
+            },
+            "contentShareTraffic": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to route content share traffic through the virtual network."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointSingleServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "resources": {
+            "site": {
+              "existing": true,
+              "type": "Microsoft.Web/sites",
+              "apiVersion": "2025-03-01",
+              "name": "[parameters('name')]"
+            },
+            "logsConfig": {
+              "type": "Microsoft.Web/sites/config",
+              "apiVersion": "2025-03-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+              "properties": {
+                "applicationLogs": {
+                  "fileSystem": {
+                    "level": "Verbose"
+                  }
+                },
+                "detailedErrorMessages": {
+                  "enabled": true
+                },
+                "failedRequestsTracing": {
+                  "enabled": true
+                },
+                "httpLogs": {
+                  "fileSystem": {
+                    "enabled": true,
+                    "retentionInDays": 1,
+                    "retentionInMb": 35
+                  }
+                }
+              },
+              "dependsOn": [
+                "appService"
+              ]
+            },
+            "appService": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.web.site.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "serverFarmResourceId": {
+                    "value": "[parameters('serverFarmResourceId')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "siteConfig": {
+                    "value": {
+                      "alwaysOn": "[parameters('alwaysOn')]",
+                      "ftpsState": "Disabled",
+                      "linuxFxVersion": "[parameters('linuxFxVersion')]",
+                      "minTlsVersion": "1.2",
+                      "healthCheckPath": "[if(not(empty(parameters('healthCheckPath'))), parameters('healthCheckPath'), null())]",
+                      "webSocketsEnabled": "[parameters('webSocketsEnabled')]",
+                      "appCommandLine": "[parameters('appCommandLine')]",
+                      "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]",
+                      "acrUseManagedIdentityCreds": "[parameters('acrUseManagedIdentityCreds')]",
+                      "acrUserManagedIdentityID": "[if(not(empty(parameters('acrUserManagedIdentityID'))), parameters('acrUserManagedIdentityID'), null())]"
+                    }
+                  },
+                  "e2eEncryptionEnabled": {
+                    "value": true
+                  },
+                  "configs": {
+                    "value": [
+                      {
+                        "name": "appsettings",
+                        "properties": "[parameters('appSettings')]",
+                        "applicationInsightResourceId": "[if(not(empty(parameters('applicationInsightResourceId'))), parameters('applicationInsightResourceId'), null())]"
+                      }
+                    ]
+                  },
+                  "outboundVnetRouting": {
+                    "value": {
+                      "contentShareTraffic": "[parameters('contentShareTraffic')]",
+                      "imagePullTraffic": "[parameters('imagePullTraffic')]"
+                    }
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "privateEndpoints": {
+                    "value": "[parameters('privateEndpoints')]"
+                  },
+                  "virtualNetworkSubnetResourceId": "[if(not(empty(parameters('virtualNetworkSubnetId'))), createObject('value', parameters('virtualNetworkSubnetId')), createObject('value', null()))]",
+                  "basicPublishingCredentialsPolicies": {
+                    "value": [
+                      {
+                        "name": "ftp",
+                        "allow": false
+                      },
+                      {
+                        "name": "scm",
+                        "allow": false
+                      }
+                    ]
+                  },
+                  "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.43.8.12551",
+                      "templateHash": "15230222474470713470"
+                    },
+                    "name": "Web/Function Apps",
+                    "description": "This module deploys a Web or Function App."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "configType": {
+                      "type": "object",
+                      "discriminator": {
+                        "propertyName": "name",
+                        "mapping": {
+                          "appsettings": {
+                            "$ref": "#/definitions/appSettingsConfigType"
+                          },
+                          "authsettings": {
+                            "$ref": "#/definitions/authSettingsConfigType"
+                          },
+                          "authsettingsV2": {
+                            "$ref": "#/definitions/authSettingsV2ConfigType"
+                          },
+                          "azurestorageaccounts": {
+                            "$ref": "#/definitions/azureStorageAccountConfigType"
+                          },
+                          "backup": {
+                            "$ref": "#/definitions/backupConfigType"
+                          },
+                          "connectionstrings": {
+                            "$ref": "#/definitions/connectionStringsConfigType"
+                          },
+                          "logs": {
+                            "$ref": "#/definitions/logsConfigType"
+                          },
+                          "metadata": {
+                            "$ref": "#/definitions/metadataConfigType"
+                          },
+                          "pushsettings": {
+                            "$ref": "#/definitions/pushSettingsConfigType"
+                          },
+                          "slotConfigNames": {
+                            "$ref": "#/definitions/slotConfigNamesConfigType"
+                          },
+                          "web": {
+                            "$ref": "#/definitions/webConfigType"
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a site configuration."
+                      }
+                    },
+                    "slotConfigNamesConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "slotConfigNames"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "appSettingNames": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of application settings names."
+                              }
+                            },
+                            "azureStorageConfigNames": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of external Azure storage account identifiers."
+                              }
+                            },
+                            "connectionStringNames": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of connection string names."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a slotConfigNames configuration."
+                      }
+                    },
+                    "slotType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the slot."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for all Resources."
+                          }
+                        },
+                        "serverFarmResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the app service plan to use for the slot."
+                          }
+                        },
+                        "managedEnvironmentResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                          }
+                        },
+                        "httpsOnly": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
+                          }
+                        },
+                        "clientAffinityEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If client affinity is enabled."
+                          }
+                        },
+                        "clientAffinityProxyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance."
+                          }
+                        },
+                        "clientAffinityPartitioningEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. To enable client affinity partitioning using CHIPS cookies."
+                          }
+                        },
+                        "appServiceEnvironmentResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the app service environment to use for this resource."
+                          }
+                        },
+                        "managedIdentities": {
+                          "$ref": "#/definitions/managedIdentityAllType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The managed identity definition for this resource."
+                          }
+                        },
+                        "keyVaultAccessIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                          }
+                        },
+                        "storageAccountRequired": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Checks if Customer provided storage account is required."
+                          }
+                        },
+                        "virtualNetworkSubnetResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                          }
+                        },
+                        "siteConfig": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/siteConfig"
+                            },
+                            "description": "Optional. The site config object."
+                          },
+                          "nullable": true
+                        },
+                        "functionAppConfig": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/functionAppConfig"
+                            },
+                            "description": "Optional. The Function App config object."
+                          },
+                          "nullable": true
+                        },
+                        "configs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/configType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The web site config."
+                          }
+                        },
+                        "extensions": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "metadata": {
+                              "__bicep_resource_derived_type!": {
+                                "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The extensions configuration."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The lock settings of the service."
+                          }
+                        },
+                        "privateEndpoints": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/privateEndpointSingleServiceType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Configuration details for private endpoints."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the service."
+                          }
+                        },
+                        "clientCertEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                          }
+                        },
+                        "clientCertExclusionPaths": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                          }
+                        },
+                        "clientCertMode": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/clientCertMode"
+                            },
+                            "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
+                          },
+                          "nullable": true
+                        },
+                        "cloningInfo": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/cloningInfo"
+                            },
+                            "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                          },
+                          "nullable": true
+                        },
+                        "containerSize": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Size of the function container."
+                          }
+                        },
+                        "customDomainVerificationId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                          }
+                        },
+                        "dailyMemoryTimeQuota": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                          }
+                        },
+                        "hostNameSslStates": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/hostNameSslStates"
+                            },
+                            "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                          },
+                          "nullable": true
+                        },
+                        "hyperV": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Hyper-V sandbox."
+                          }
+                        },
+                        "publicNetworkAccess": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                            },
+                            "description": "Optional. Allow or block all public traffic."
+                          },
+                          "nullable": true
+                        },
+                        "redundancyMode": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/redundancyMode"
+                            },
+                            "description": "Optional. Site redundancy mode."
+                          },
+                          "nullable": true
+                        },
+                        "basicPublishingCredentialsPolicies": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The site publishing credential policy names which are associated with the site slot."
+                          }
+                        },
+                        "outboundVnetRouting": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                            },
+                            "description": "Optional. The outbound VNET routing configuration for the slot."
+                          },
+                          "nullable": true
+                        },
+                        "hybridConnectionRelays": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/hybridConnectionRelayType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Names of hybrid connection relays to connect app with."
+                          }
+                        },
+                        "hostNameBindings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/hostNameBindingType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host Name Bindings for the slot."
+                          }
+                        },
+                        "dnsConfiguration": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/dnsConfiguration"
+                            },
+                            "description": "Optional. Property to configure various DNS related settings for a site."
+                          },
+                          "nullable": true
+                        },
+                        "autoGeneratedDomainNameLabelScope": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                            },
+                            "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                          },
+                          "nullable": true
+                        },
+                        "sshEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether to enable SSH access."
+                          }
+                        },
+                        "daprConfig": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/daprConfig"
+                            },
+                            "description": "Optional. Dapr configuration of the app."
+                          },
+                          "nullable": true
+                        },
+                        "ipMode": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/ipMode"
+                            },
+                            "description": "Optional. Specifies the IP mode of the app."
+                          },
+                          "nullable": true
+                        },
+                        "resourceConfig": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/resourceConfig"
+                            },
+                            "description": "Optional. Function app resource requirements."
+                          },
+                          "nullable": true
+                        },
+                        "workloadProfileName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Workload profile name for function app to execute on."
+                          }
+                        },
+                        "hostNamesDisabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                          }
+                        },
+                        "reserved": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                          }
+                        },
+                        "scmSiteAlsoStopped": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                          }
+                        },
+                        "e2eEncryptionEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. End to End Encryption Setting."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a slot."
+                      }
+                    },
+                    "extensionType": {
+                      "type": "object",
+                      "properties": {
+                        "properties": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                            },
+                            "description": "Optional. Sets the properties."
+                          },
+                          "nullable": true
+                        }
+                      }
+                    },
+                    "basicPublishingCredentialsPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "ftp",
+                            "scm"
+                          ],
+                          "metadata": {
+                            "description": "Required. The name of the resource."
+                          }
+                        },
+                        "allow": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Set to true to enable or false to disable a publishing method."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for all Resources."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a basic publishing credential policy."
+                      }
+                    },
+                    "hybridConnectionRelayType": {
+                      "type": "object",
+                      "properties": {
+                        "hybridConnectionResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the relay namespace hybrid connection."
+                          }
+                        },
+                        "sendKeyName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the authorization rule send key to use."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a hybrid connection relay."
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_2.certificateType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Certificate name."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource location."
+                          }
+                        },
+                        "hostNames": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Certificate host names."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        },
+                        "kind": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Kind of resource."
+                          }
+                        },
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Key Vault resource ID."
+                          }
+                        },
+                        "keyVaultSecretName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Key Vault secret name."
+                          }
+                        },
+                        "serverFarmResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Server farm resource ID."
+                          }
+                        },
+                        "canonicalName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                          }
+                        },
+                        "password": {
+                          "type": "securestring",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Certificate password."
+                          }
+                        },
+                        "pfxBlob": {
+                          "type": "securestring",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Certificate data in PFX format."
+                          }
+                        },
+                        "domainValidationMethod": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Method of domain validation for free certificate."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a certificate.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "modules/certificate.bicep"
+                        }
+                      }
+                    },
+                    "_3.scmIpSecurityRestrictionType": {
+                      "type": "object",
+                      "properties": {
+                        "action": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Allow",
+                            "Deny"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Allow or Deny access for this IP range."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. IP restriction rule description."
+                          }
+                        },
+                        "headers": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "metadata": {
+                              "description": "Required. A header."
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. IP restriction rule headers.\nX-Forwarded-Host (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), all hosts(or lack of) are allowed.\n- A value is compared using ordinal-ignore-case (excluding port number).\n- Subdomain wildcards are permitted but don't match the root domain. For example, *.contoso.com matches the subdomain foo.contoso.com\nbut not the root domain contoso.com or multi-level foo.bar.contoso.com\n- Unicode host names are allowed but are converted to Punycode for matching.\n\nX-Forwarded-For (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), any forwarded-for chains (or lack of) are allowed.\n- If any address (excluding port number) in the chain (comma separated) matches the CIDR defined by the property.\n\nX-Azure-FDID and X-FD-HealthProbe.\nThe matching logic is exact match."
+                          }
+                        },
+                        "ipAddress": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. IP address the security restriction is valid for. It can be in form of pure ipv4 address (required SubnetMask property) or CIDR notation such as ipv4/mask (leading bit match). For CIDR, SubnetMask property must not be specified."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. IP restriction rule name."
+                          }
+                        },
+                        "priority": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Priority of IP restriction rule."
+                          }
+                        },
+                        "subnetMask": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Subnet mask for the range of IP addresses the restriction is valid for."
+                          }
+                        },
+                        "subnetTrafficTag": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. (internal) Subnet traffic tag."
+                          }
+                        },
+                        "tag": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Default",
+                            "ServiceTag",
+                            "XffProxy"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Defines what this IP filter will be used for. This is to support IP filtering on proxies."
+                          }
+                        },
+                        "vnetSubnetResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Virtual network resource id."
+                          }
+                        },
+                        "vnetTrafficTag": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. (internal) Vnet traffic tag."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a IP security restriction.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "_3.slowRequestBasedTriggerType": {
+                      "type": "object",
+                      "properties": {
+                        "count": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request Count."
+                          }
+                        },
+                        "path": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request Path."
+                          }
+                        },
+                        "timeInterval": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Time interval."
+                          }
+                        },
+                        "timeTaken": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Time taken."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of aslow request based trigger.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "appSettingsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "appsettings"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "storageAccountUseIdentityAuthentication": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                          }
+                        },
+                        "applicationInsightResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                          }
+                        },
+                        "retainCurrentAppSettings": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The retain the current app settings. Defaults to true."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. An app settings key-value pair."
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of an app settings configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "authSettingsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "authsettings"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "aadClaimsAuthorization": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets a JSON string containing the Azure AD Acl settings."
+                              }
+                            },
+                            "additionalLoginParams": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                              }
+                            },
+                            "allowedAudiences": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting."
+                              }
+                            },
+                            "allowedExternalRedirectUrls": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                              }
+                            },
+                            "authFilePath": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The path of the config file containing auth settings. If the path is relative, base will the site's root directory."
+                              }
+                            },
+                            "clientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                              }
+                            },
+                            "clientSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                              }
+                            },
+                            "clientSecretCertificateThumbprint": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                              }
+                            },
+                            "clientSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                              }
+                            },
+                            "configVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization."
+                              }
+                            },
+                            "defaultProvider": {
+                              "type": "string",
+                              "allowedValues": [
+                                "AzureActiveDirectory",
+                                "Facebook",
+                                "Github",
+                                "Google",
+                                "MicrosoftAccount",
+                                "Twitter"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                              }
+                            },
+                            "enabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                              }
+                            },
+                            "facebookAppId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                              }
+                            },
+                            "facebookAppSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                              }
+                            },
+                            "facebookAppSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the app secret used for Facebook Login."
+                              }
+                            },
+                            "facebookOAuthScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                              }
+                            },
+                            "gitHubClientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Client Id of the GitHub app used for login. This setting is required for enabling Github login."
+                              }
+                            },
+                            "gitHubClientSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login."
+                              }
+                            },
+                            "gitHubClientSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the client secret of the Github app used for GitHub Login."
+                              }
+                            },
+                            "gitHubOAuthScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication."
+                              }
+                            },
+                            "googleClientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                              }
+                            },
+                            "googleClientSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                              }
+                            },
+                            "googleClientSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the client secret associated with the Google web application."
+                              }
+                            },
+                            "googleOAuthScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, \"openid\", \"profile\", and \"email\" are used as default scopes. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                              }
+                            },
+                            "isAuthFromFile": {
+                              "type": "string",
+                              "allowedValues": [
+                                "false",
+                                "true"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. \"true\" if the auth config settings should be read from a file, \"false\" otherwise."
+                              }
+                            },
+                            "issuer": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                              }
+                            },
+                            "microsoftAccountClientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                              }
+                            },
+                            "microsoftAccountClientSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                              }
+                            },
+                            "microsoftAccountClientSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication."
+                              }
+                            },
+                            "microsoftAccountOAuthScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, \"wl.basic\" is used as the default scope. Microsoft Account Scopes and permissions [documentation](https://msdn.microsoft.com/en-us/library/dn631845.aspx)."
+                              }
+                            },
+                            "runtimeVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                              }
+                            },
+                            "tokenRefreshExtensionHours": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                              }
+                            },
+                            "tokenStoreEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows. The default is `false`."
+                              }
+                            },
+                            "twitterConsumerKey": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                              }
+                            },
+                            "twitterConsumerSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                              }
+                            },
+                            "twitterConsumerSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                              }
+                            },
+                            "unauthenticatedClientAction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "AllowAnonymous",
+                                "RedirectToLoginPage"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                              }
+                            },
+                            "validateIssuer": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of an auth settings configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "authSettingsV2ConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "authsettingsV2"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "globalValidation": {
+                              "type": "object",
+                              "properties": {
+                                "excludedPaths": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The paths for which unauthenticated flow would not be redirected to the login page."
+                                  }
+                                },
+                                "redirectToProvider": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                  }
+                                },
+                                "requireAuthentication": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `true` if the authentication flow is required by every request."
+                                  }
+                                },
+                                "unauthenticatedClientAction": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AllowAnonymous",
+                                    "RedirectToLoginPage",
+                                    "Return401",
+                                    "Return403"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings that determines the validation flow of users using App Service Authentication/Authorization."
+                              }
+                            },
+                            "httpSettings": {
+                              "type": "object",
+                              "properties": {
+                                "forwardProxy": {
+                                  "type": "object",
+                                  "properties": {
+                                    "convention": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Custom",
+                                        "NoProxy",
+                                        "Standard"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The convention used to determine the url of the request made."
+                                      }
+                                    },
+                                    "customHostHeaderName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The name of the header containing the host of the request."
+                                      }
+                                    },
+                                    "customProtoHeaderName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The name of the header containing the scheme of the request."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of a forward proxy used to make the requests."
+                                  }
+                                },
+                                "requireHttps": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `false` if the authentication/authorization responses not having the HTTPS scheme are permissible."
+                                  }
+                                },
+                                "routes": {
+                                  "type": "object",
+                                  "properties": {
+                                    "apiPrefix": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The prefix that should precede all the authentication/authorization paths."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the paths HTTP requests."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against App Service Authentication/Authorization."
+                              }
+                            },
+                            "identityProviders": {
+                              "type": "object",
+                              "properties": {
+                                "apple": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Apple provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the client secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Apple registration."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Apple provider."
+                                  }
+                                },
+                                "azureActiveDirectory": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "isAutoProvisioned": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "disableWWWAuthenticate": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the www-authenticate provider should be omitted from the request."
+                                          }
+                                        },
+                                        "loginParameters": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Active Directory login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                          }
+                                        },
+                                        "clientSecretCertificateIssuer": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                          }
+                                        },
+                                        "clientSecretCertificateSubjectAlternativeName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                          }
+                                        },
+                                        "clientSecretCertificateThumbprint": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                          }
+                                        },
+                                        "openIdIssuer": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Active Directory app registration."
+                                      }
+                                    },
+                                    "validation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedAudiences": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The list of audiences that can make successful authentication/authorization requests."
+                                          }
+                                        },
+                                        "defaultAuthorizationPolicy": {
+                                          "type": "object",
+                                          "properties": {
+                                            "allowedApplications": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory allowed applications."
+                                              }
+                                            },
+                                            "allowedPrincipals": {
+                                              "type": "object",
+                                              "properties": {
+                                                "groups": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The list of the allowed groups."
+                                                  }
+                                                },
+                                                "identities": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The list of the allowed identities."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory allowed principals."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the default authorization policy."
+                                          }
+                                        },
+                                        "jwtClaimChecks": {
+                                          "type": "object",
+                                          "properties": {
+                                            "allowedClientApplications": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The list of the allowed client applications."
+                                              }
+                                            },
+                                            "allowedGroups": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The list of the allowed groups."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the checks that should be made while validating the JWT Claims."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Azure Active directory provider."
+                                  }
+                                },
+                                "azureStaticWebApps": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Azure Static Web Apps provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Static Web Apps registration."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Azure Static Web Apps provider."
+                                  }
+                                },
+                                "customOpenIdConnectProviders": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Set to `false` if the custom Open ID provider provider should not be enabled."
+                                        }
+                                      },
+                                      "login": {
+                                        "type": "object",
+                                        "properties": {
+                                          "nameClaimType": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of the claim that contains the users name."
+                                            }
+                                          },
+                                          "scopes": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "string"
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                            }
+                                          }
+                                        },
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The configuration settings of the login flow of the custom Open ID Connect provider."
+                                        }
+                                      },
+                                      "registration": {
+                                        "type": "object",
+                                        "properties": {
+                                          "clientCredential": {
+                                            "type": "object",
+                                            "properties": {
+                                              "clientSecretSettingName": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The app setting that contains the client secret for the custom Open ID Connect provider."
+                                                }
+                                              },
+                                              "method": {
+                                                "type": "string",
+                                                "allowedValues": [
+                                                  "ClientSecretPost"
+                                                ],
+                                                "metadata": {
+                                                  "description": "Required. The method that should be used to authenticate the user."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The authentication credentials of the custom Open ID Connect provider."
+                                            }
+                                          },
+                                          "clientId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The client id of the custom Open ID Connect provider."
+                                            }
+                                          },
+                                          "openIdConnectConfiguration": {
+                                            "type": "object",
+                                            "properties": {
+                                              "authorizationEndpoint": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint to be used to make an authorization request."
+                                                }
+                                              },
+                                              "certificationUri": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint that provides the keys necessary to validate the token."
+                                                }
+                                              },
+                                              "issuer": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint that issues the token."
+                                                }
+                                              },
+                                              "tokenEndpoint": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint to be used to request a token."
+                                                }
+                                              },
+                                              "wellKnownOpenIdConfiguration": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint that contains all the configuration endpoints for the provider."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The configuration settings of the endpoints used for the custom Open ID Connect provider."
+                                            }
+                                          }
+                                        },
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The configuration settings of the app registration for the custom Open ID Connect provider."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The alias of each custom Open ID Connect provider."
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider."
+                                  }
+                                },
+                                "facebook": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Facebook provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "graphApiVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The version of the Facebook api to be used while logging in."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "appId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The App ID of the app used for login."
+                                          }
+                                        },
+                                        "appSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the app secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the Facebook provider."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Facebook provider."
+                                  }
+                                },
+                                "gitHub": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the GitHub provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the client secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the GitHub provider."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the GitHub provider."
+                                  }
+                                },
+                                "google": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Google provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the client secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the Google provider."
+                                      }
+                                    },
+                                    "validation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedAudiences": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Google provider."
+                                  }
+                                },
+                                "legacyMicrosoftAccount": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the legacy Microsoft Account provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the client secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the legacy Microsoft Account provider."
+                                      }
+                                    },
+                                    "validation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedAudiences": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the legacy Microsoft Account provider token validation flow."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the legacy Microsoft Account provider."
+                                  }
+                                },
+                                "twitter": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Twitter provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "consumerKey": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                          }
+                                        },
+                                        "consumerSecretSettingName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the Twitter provider."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Twitter provider."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings of each of the identity providers used to configure App Service Authentication/Authorization."
+                              }
+                            },
+                            "login": {
+                              "type": "object",
+                              "properties": {
+                                "allowedExternalRedirectUrls": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                  }
+                                },
+                                "cookieExpiration": {
+                                  "type": "object",
+                                  "properties": {
+                                    "convention": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "FixedTime",
+                                        "IdentityProviderDerived"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The convention used when determining the session cookie's expiration."
+                                      }
+                                    },
+                                    "timeToExpiration": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The time after the request is made when the session cookie should expire."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the session cookie's expiration."
+                                  }
+                                },
+                                "nonce": {
+                                  "type": "object",
+                                  "properties": {
+                                    "nonceExpirationInterval": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The time after the request is made when the nonce should expire."
+                                      }
+                                    },
+                                    "validateNonce": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the nonce should not be validated while completing the login flow."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the nonce used in the login flow."
+                                  }
+                                },
+                                "preserveUrlFragmentsForLogins": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `true` if the fragments from the request are preserved after the login request is made."
+                                  }
+                                },
+                                "routes": {
+                                  "type": "object",
+                                  "properties": {
+                                    "logoutEndpoint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The endpoint at which a logout request should be made."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The routes that specify the endpoints used for login and logout requests."
+                                  }
+                                },
+                                "tokenStore": {
+                                  "type": "object",
+                                  "properties": {
+                                    "azureBlobStorage": {
+                                      "type": "object",
+                                      "properties": {
+                                        "sasUrlSettingName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the app setting containing the SAS URL of the blob storage containing the tokens."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the storage of the tokens if blob storage is used."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows."
+                                      }
+                                    },
+                                    "fileSystem": {
+                                      "type": "object",
+                                      "properties": {
+                                        "directory": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The directory in which the tokens will be stored."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the storage of the tokens if a file system is used."
+                                      }
+                                    },
+                                    "tokenRefreshExtensionHours": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the token store."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings of the login flow of users using App Service Authentication/Authorization."
+                              }
+                            },
+                            "platform": {
+                              "type": "object",
+                              "properties": {
+                                "configFilePath": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The path of the config file containing auth settings if they come from a file. If the path is relative, base will the site's root directory."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                  }
+                                },
+                                "runtimeVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings of the platform of App Service Authentication/Authorization."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of an authSettingsV2 configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "azureStorageAccountConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "azurestorageaccounts"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "object",
+                            "properties": {
+                              "accessKey": {
+                                "type": "securestring",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Access key for the storage account."
+                                }
+                              },
+                              "accountName": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of the storage account."
+                                }
+                              },
+                              "mountPath": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                }
+                              },
+                              "protocol": {
+                                "type": "string",
+                                "allowedValues": [
+                                  "Http",
+                                  "Nfs",
+                                  "Smb"
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Mounting protocol to use for the storage account."
+                                }
+                              },
+                              "shareName": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                }
+                              },
+                              "type": {
+                                "type": "string",
+                                "allowedValues": [
+                                  "AzureBlob",
+                                  "AzureFiles"
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Type of storage."
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Azure Storage Info configuration."
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of an Azure Storage Account configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "backupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "backup"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "backupName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Name of the backup."
+                              }
+                            },
+                            "backupSchedule": {
+                              "type": "object",
+                              "properties": {
+                                "frequencyInterval": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. How often the backup should be executed (e.g. for weekly backup, this should be set to 7 and FrequencyUnit should be set to Day)."
+                                  }
+                                },
+                                "frequencyUnit": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Day",
+                                    "Hour"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The unit of time for how often the backup should be executed (e.g. for weekly backup, this should be set to Day and FrequencyInterval should be set to 7)."
+                                  }
+                                },
+                                "keepAtLeastOneBackup": {
+                                  "type": "bool",
+                                  "metadata": {
+                                    "description": "Required. Set to `True` if the retention policy should always keep at least one backup in the storage account, regardless how old it is."
+                                  }
+                                },
+                                "retentionPeriodInDays": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. After how many days backups should be deleted."
+                                  }
+                                },
+                                "startTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. When the schedule should start working."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Schedule for the backup if it is executed periodically."
+                              }
+                            },
+                            "databases": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "connectionString": {
+                                    "type": "securestring",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Contains a connection string to a database which is being backed up or restored. If the restore should happen to a new database, the database name inside is the new one."
+                                    }
+                                  },
+                                  "connectionStringName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Contains a connection string name that is linked to the SiteConfig.ConnectionStrings. This is used during restore with overwrite connection strings options."
+                                    }
+                                  },
+                                  "databaseType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "LocalMySql",
+                                      "MySql",
+                                      "PostgreSql",
+                                      "SqlAzure"
+                                    ],
+                                    "metadata": {
+                                      "description": "Required. Database type (e.g. SqlAzure / MySql)."
+                                    }
+                                  },
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the setting."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Databases included in the backup."
+                              }
+                            },
+                            "enabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `True` if the backup schedule is enabled (must be included in that case), `false` if the backup schedule should be disabled."
+                              }
+                            },
+                            "storageAccountUrl": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. SAS URL to the container."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a backup configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "connectionStringsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "connectionstrings"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "object",
+                            "properties": {
+                              "type": {
+                                "type": "string",
+                                "allowedValues": [
+                                  "ApiHub",
+                                  "Custom",
+                                  "DocDb",
+                                  "EventHub",
+                                  "MySql",
+                                  "NotificationHub",
+                                  "PostgreSQL",
+                                  "RedisCache",
+                                  "SQLAzure",
+                                  "SQLServer",
+                                  "ServiceBus"
+                                ],
+                                "metadata": {
+                                  "description": "Required. Type of database."
+                                }
+                              },
+                              "value": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Value of pair."
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of the connection string setting."
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a connection string configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "hostNameBindingsOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the host name binding."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the host name binding."
+                          }
+                        },
+                        "resourceGroupName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the resource group the resource was deployed into."
+                          }
+                        },
+                        "certificateThumbprint": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The thumbprint of the certificate."
+                          }
+                        },
+                        "certificateResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The resource ID of the certificate."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "hostNameBindingType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Hostname in the hostname binding. Defaults to the host name of the app/slot if not specified."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Kind of resource."
+                          }
+                        },
+                        "azureResourceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Azure resource name."
+                          }
+                        },
+                        "azureResourceType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "TrafficManager",
+                            "Website"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                          }
+                        },
+                        "customHostNameDnsRecordType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "A",
+                            "CName"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                          }
+                        },
+                        "domainResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Fully qualified ARM domain resource URI."
+                          }
+                        },
+                        "hostNameType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Managed",
+                            "Verified"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                          }
+                        },
+                        "siteName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. App Service app name."
+                          }
+                        },
+                        "sslState": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "IpBasedEnabled",
+                            "SniEnabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                          }
+                        },
+                        "thumbprint": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. SSL certificate thumbprint."
+                          }
+                        },
+                        "certificate": {
+                          "$ref": "#/definitions/_2.certificateType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Certificate creation properties. If specified, a certificate will be created and used for this hostname binding."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a host name binding.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "logsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "logs"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "applicationLogs": {
+                              "type": "object",
+                              "properties": {
+                                "azureBlobStorage": {
+                                  "type": "object",
+                                  "properties": {
+                                    "level": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Error",
+                                        "Information",
+                                        "Off",
+                                        "Verbose",
+                                        "Warning"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Log level."
+                                      }
+                                    },
+                                    "retentionInDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                      }
+                                    },
+                                    "sasUrl": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application logs to blob storage configuration."
+                                  }
+                                },
+                                "azureTableStorage": {
+                                  "type": "object",
+                                  "properties": {
+                                    "level": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Error",
+                                        "Information",
+                                        "Off",
+                                        "Verbose",
+                                        "Warning"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Log level."
+                                      }
+                                    },
+                                    "sasUrl": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. SAS URL to an Azure table with add/query/delete permissions."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application logs to azure table storage configuration."
+                                  }
+                                },
+                                "fileSystem": {
+                                  "type": "object",
+                                  "properties": {
+                                    "level": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Error",
+                                        "Information",
+                                        "Off",
+                                        "Verbose",
+                                        "Warning"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Log level."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application logs to file system configuration."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application Logs for Azure configuration."
+                              }
+                            },
+                            "detailedErrorMessages": {
+                              "type": "object",
+                              "properties": {
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Detailed error messages configuration."
+                              }
+                            },
+                            "failedRequestsTracing": {
+                              "type": "object",
+                              "properties": {
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Failed requests tracing configuration."
+                              }
+                            },
+                            "httpLogs": {
+                              "type": "object",
+                              "properties": {
+                                "azureBlobStorage": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                      }
+                                    },
+                                    "retentionInDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                      }
+                                    },
+                                    "sasUrl": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Http logs to azure blob storage configuration."
+                                  }
+                                },
+                                "fileSystem": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                      }
+                                    },
+                                    "retentionInDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Retention in days. Remove files older than X days. 0 or lower means no retention."
+                                      }
+                                    },
+                                    "retentionInMb": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 25,
+                                      "maxValue": 100,
+                                      "metadata": {
+                                        "description": "Optional. Maximum size in megabytes that http log files can use. When reached old log files will be removed to make space for new ones."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Http logs to file system configuration."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. HTTP logs configuration."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a logs configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "metadataConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "metadata"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata key value pair."
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a metadata configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "pushSettingsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "pushsettings"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "dynamicTagsJson": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                              }
+                            },
+                            "isPushEnabled": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                              }
+                            },
+                            "tagsRequiringAuth": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                              }
+                            },
+                            "tagWhitelistJson": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a pushSettings configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "webConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "web"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "acrUseManagedIdentityCreds": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Flag to use Managed Identity Creds for ACR pull."
+                              }
+                            },
+                            "acrUserManagedIdentityID": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. If using user managed identity, the user managed identity ClientId."
+                              }
+                            },
+                            "alwaysOn": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if 'Always On' is enabled."
+                              }
+                            },
+                            "apiDefinition": {
+                              "type": "object",
+                              "properties": {
+                                "url": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The URL of the API definition."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Information about the formal API definition for the app."
+                              }
+                            },
+                            "apiManagementConfig": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. APIM-Api Identifier."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure API management settings linked to the app."
+                              }
+                            },
+                            "appCommandLine": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. App command line to launch."
+                              }
+                            },
+                            "appSettings": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Name of the pair."
+                                    }
+                                  },
+                                  "value": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Value of the pair."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application settings."
+                              }
+                            },
+                            "autoHealEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if Auto Heal is enabled."
+                              }
+                            },
+                            "autoHealRules": {
+                              "type": "object",
+                              "properties": {
+                                "actions": {
+                                  "type": "object",
+                                  "properties": {
+                                    "actionType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "CustomAction",
+                                        "LogEvent",
+                                        "Recycle"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Predefined action to be taken."
+                                      }
+                                    },
+                                    "customAction": {
+                                      "type": "object",
+                                      "properties": {
+                                        "exe": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Executable to be run."
+                                          }
+                                        },
+                                        "parameters": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Parameters for the executable."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Custom action to be taken."
+                                      }
+                                    },
+                                    "minProcessExecutionTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Minimum time the process must execute before taking the action."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Actions to be executed when a rule is triggered."
+                                  }
+                                },
+                                "triggers": {
+                                  "type": "object",
+                                  "properties": {
+                                    "privateBytesInKB": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on private bytes."
+                                      }
+                                    },
+                                    "requests": {
+                                      "type": "object",
+                                      "properties": {
+                                        "count": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request Count."
+                                          }
+                                        },
+                                        "timeInterval": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Time interval."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on total requests."
+                                      }
+                                    },
+                                    "slowRequests": {
+                                      "$ref": "#/definitions/_3.slowRequestBasedTriggerType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on request execution time."
+                                      }
+                                    },
+                                    "slowRequestsWithPath": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/_3.slowRequestBasedTriggerType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on multiple Slow Requests Rule with path."
+                                      }
+                                    },
+                                    "statusCodes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "count": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Request Count."
+                                            }
+                                          },
+                                          "path": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Request Path."
+                                            }
+                                          },
+                                          "status": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. HTTP status code."
+                                            }
+                                          },
+                                          "subStatus": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Request Sub Status."
+                                            }
+                                          },
+                                          "timeInterval": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Time interval."
+                                            }
+                                          },
+                                          "win32Status": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Win32 error code."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on status codes."
+                                      }
+                                    },
+                                    "statusCodesRange": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "count": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Request Count."
+                                            }
+                                          },
+                                          "path": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Path."
+                                            }
+                                          },
+                                          "statusCodes": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. HTTP status code."
+                                            }
+                                          },
+                                          "timeInterval": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Time interval."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on status codes ranges."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Conditions that describe when to execute the auto-heal actions."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Auto Heal rules."
+                              }
+                            },
+                            "autoSwapSlotName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Auto-swap slot name."
+                              }
+                            },
+                            "azureStorageAccounts": {
+                              "type": "object",
+                              "properties": {},
+                              "additionalProperties": {
+                                "type": "object",
+                                "properties": {
+                                  "accessKey": {
+                                    "type": "securestring",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Access key for the storage account."
+                                    }
+                                  },
+                                  "accountName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the storage account."
+                                    }
+                                  },
+                                  "mountPath": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                    }
+                                  },
+                                  "protocol": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Http",
+                                      "Nfs",
+                                      "Smb"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Mounting protocol to use for the storage account."
+                                    }
+                                  },
+                                  "shareName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                    }
+                                  },
+                                  "type": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureBlob",
+                                      "AzureFiles"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Type of storage."
+                                    }
+                                  }
+                                },
+                                "metadata": {
+                                  "description": "Required. A storage account configuration."
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of Azure Storage Accounts."
+                              }
+                            },
+                            "connectionStrings": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "connectionString": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Connection string value."
+                                    }
+                                  },
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of connection string."
+                                    }
+                                  },
+                                  "type": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "ApiHub",
+                                      "Custom",
+                                      "DocDb",
+                                      "EventHub",
+                                      "MySql",
+                                      "NotificationHub",
+                                      "PostgreSQL",
+                                      "RedisCache",
+                                      "SQLAzure",
+                                      "SQLServer",
+                                      "ServiceBus"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Type of database."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Connection strings."
+                              }
+                            },
+                            "cors": {
+                              "type": "object",
+                              "properties": {
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Gets or sets the list of origins that should be allowed to make cross-origin calls (for example: http://example.com:12345). Use \"*\" to allow all."
+                                  }
+                                },
+                                "supportCredentials": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Gets or sets whether CORS requests with credentials are allowed. See [ref](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Requests_with_credentials) for more details."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Cross-Origin Resource Sharing (CORS) settings."
+                              }
+                            },
+                            "defaultDocuments": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Default documents."
+                              }
+                            },
+                            "detailedErrorLoggingEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if detailed error logging is enabled."
+                              }
+                            },
+                            "documentRoot": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Document root."
+                              }
+                            },
+                            "elasticWebAppScaleLimit": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 0,
+                              "metadata": {
+                                "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to apps in plans where ElasticScaleEnabled is `true`."
+                              }
+                            },
+                            "experiments": {
+                              "type": "object",
+                              "properties": {
+                                "rampUpRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "actionHostName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Hostname of a slot to which the traffic will be redirected if decided to. E.g. myapp-stage.azurewebsites.net."
+                                        }
+                                      },
+                                      "changeDecisionCallbackUrl": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified."
+                                        }
+                                      },
+                                      "changeIntervalInMinutes": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Specifies interval in minutes to reevaluate ReroutePercentage."
+                                        }
+                                      },
+                                      "changeStep": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. In auto ramp up scenario this is the step to add/remove from `ReroutePercentage` until it reaches `MinReroutePercentage` or `MaxReroutePercentage`. Site metrics are checked every N minutes specified in `ChangeIntervalInMinutes`. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified in `ChangeDecisionCallbackUrl`."
+                                        }
+                                      },
+                                      "maxReroutePercentage": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Specifies upper boundary below which ReroutePercentage will stay."
+                                        }
+                                      },
+                                      "minReroutePercentage": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Specifies lower boundary above which ReroutePercentage will stay."
+                                        }
+                                      },
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the routing rule. The recommended name would be to point to the slot which will receive the traffic in the experiment."
+                                        }
+                                      },
+                                      "reroutePercentage": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Percentage of the traffic which will be redirected to `ActionHostName`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. List of ramp-up rules."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. This is work around for polymorphic types."
+                              }
+                            },
+                            "ftpsState": {
+                              "type": "string",
+                              "allowedValues": [
+                                "AllAllowed",
+                                "Disabled",
+                                "FtpsOnly"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. State of FTP / FTPS service."
+                              }
+                            },
+                            "functionAppScaleLimit": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 0,
+                              "metadata": {
+                                "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to the Consumption and Elastic Premium Plans."
+                              }
+                            },
+                            "functionsRuntimeScaleMonitoringEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets or sets a value indicating whether functions runtime scale monitoring is enabled. When enabled, the ScaleController will not monitor event sources directly, but will instead call to the runtime to get scale status."
+                              }
+                            },
+                            "handlerMappings": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "arguments": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Command-line arguments to be passed to the script processor."
+                                    }
+                                  },
+                                  "extension": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Requests with this extension will be handled using the specified FastCGI application."
+                                    }
+                                  },
+                                  "scriptProcessor": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The absolute path to the FastCGI application."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Handler mappings."
+                              }
+                            },
+                            "healthCheckPath": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Health check path."
+                              }
+                            },
+                            "http20Enabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Allow clients to connect over http2.0."
+                              }
+                            },
+                            "httpLoggingEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if HTTP logging is enabled."
+                              }
+                            },
+                            "ipSecurityRestrictions": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/_3.scmIpSecurityRestrictionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. IP security restrictions for main."
+                              }
+                            },
+                            "ipSecurityRestrictionsDefaultAction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Default action for main access restriction if no rules are matched."
+                              }
+                            },
+                            "javaContainer": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Java container."
+                              }
+                            },
+                            "javaContainerVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Java container version."
+                              }
+                            },
+                            "javaVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Java version."
+                              }
+                            },
+                            "keyVaultReferenceIdentity": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Identity to use for Key Vault Reference authentication."
+                              }
+                            },
+                            "limits": {
+                              "type": "object",
+                              "properties": {
+                                "maxDiskSizeInMb": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum allowed disk size usage in MB."
+                                  }
+                                },
+                                "maxMemoryInMb": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum allowed memory usage in MB."
+                                  }
+                                },
+                                "maxPercentageCpu": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum allowed CPU usage percentage."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Site limits."
+                              }
+                            },
+                            "linuxFxVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Linux App Framework and version."
+                              }
+                            },
+                            "loadBalancing": {
+                              "type": "string",
+                              "allowedValues": [
+                                "LeastRequests",
+                                "LeastRequestsWithTieBreaker",
+                                "LeastResponseTime",
+                                "PerSiteRoundRobin",
+                                "RequestHash",
+                                "WeightedRoundRobin",
+                                "WeightedTotalTraffic"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Site load balancing."
+                              }
+                            },
+                            "localMySqlEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` to enable local MySQL."
+                              }
+                            },
+                            "logsDirectorySizeLimit": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. HTTP logs directory size limit."
+                              }
+                            },
+                            "managedPipelineMode": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Classic",
+                                "Integrated"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Managed pipeline mode."
+                              }
+                            },
+                            "managedServiceIdentityId": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Managed Service Identity Id."
+                              }
+                            },
+                            "metadata": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Pair name."
+                                    }
+                                  },
+                                  "value": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Pair Value."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application metadata. This property cannot be retrieved, since it may contain secrets."
+                              }
+                            },
+                            "minimumElasticInstanceCount": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 0,
+                              "maxValue": 20,
+                              "metadata": {
+                                "description": "Optional. Number of minimum instance count for a site. This setting only applies to the Elastic Plans."
+                              }
+                            },
+                            "minTlsCipherSuite": {
+                              "type": "string",
+                              "allowedValues": [
+                                "TLS_AES_128_GCM_SHA256",
+                                "TLS_AES_256_GCM_SHA384",
+                                "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+                                "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                                "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                                "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                                "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+                                "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                                "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                                "TLS_RSA_WITH_AES_128_CBC_SHA",
+                                "TLS_RSA_WITH_AES_128_CBC_SHA256",
+                                "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                                "TLS_RSA_WITH_AES_256_CBC_SHA",
+                                "TLS_RSA_WITH_AES_256_CBC_SHA256",
+                                "TLS_RSA_WITH_AES_256_GCM_SHA384"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The minimum strength TLS cipher suite allowed for an application."
+                              }
+                            },
+                            "minTlsVersion": {
+                              "type": "string",
+                              "allowedValues": [
+                                "1.0",
+                                "1.1",
+                                "1.2",
+                                "1.3"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. MinTlsVersion: configures the minimum version of TLS required for SSL requests."
+                              }
+                            },
+                            "netFrameworkVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. .NET Framework version."
+                              }
+                            },
+                            "nodeVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Version of Node.js."
+                              }
+                            },
+                            "numberOfWorkers": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Number of workers."
+                              }
+                            },
+                            "phpVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Version of PHP."
+                              }
+                            },
+                            "powerShellVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Version of PowerShell."
+                              }
+                            },
+                            "preWarmedInstanceCount": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 0,
+                              "maxValue": 10,
+                              "metadata": {
+                                "description": "Optional. Number of preWarmed instances. This setting only applies to the Consumption and Elastic Plans."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Property to allow or block all public traffic."
+                              }
+                            },
+                            "publishingUsername": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Publishing user name."
+                              }
+                            },
+                            "push": {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "dynamicTagsJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                      }
+                                    },
+                                    "isPushEnabled": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                      }
+                                    },
+                                    "tagsRequiringAuth": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                      }
+                                    },
+                                    "tagWhitelistJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. PushSettings resource specific properties."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Push endpoint settings."
+                              }
+                            },
+                            "pythonVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Version of Python."
+                              }
+                            },
+                            "remoteDebuggingEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if remote debugging is enabled."
+                              }
+                            },
+                            "remoteDebuggingVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Remote debugging version."
+                              }
+                            },
+                            "requestTracingEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if request tracing is enabled."
+                              }
+                            },
+                            "requestTracingExpirationTime": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Request tracing expiration time."
+                              }
+                            },
+                            "scmIpSecurityRestrictions": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/_3.scmIpSecurityRestrictionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. IP security restrictions for scm."
+                              }
+                            },
+                            "scmIpSecurityRestrictionsDefaultAction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Default action for scm access restriction if no rules are matched."
+                              }
+                            },
+                            "scmIpSecurityRestrictionsUseMain": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. IP security restrictions for scm to use main."
+                              }
+                            },
+                            "scmMinTlsVersion": {
+                              "type": "string",
+                              "allowedValues": [
+                                "1.0",
+                                "1.1",
+                                "1.2",
+                                "1.3"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. ScmMinTlsVersion: configures the minimum version of TLS required for SSL requests for SCM site."
+                              }
+                            },
+                            "scmType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "BitbucketGit",
+                                "BitbucketHg",
+                                "CodePlexGit",
+                                "CodePlexHg",
+                                "Dropbox",
+                                "ExternalGit",
+                                "ExternalHg",
+                                "GitHub",
+                                "LocalGit",
+                                "None",
+                                "OneDrive",
+                                "Tfs",
+                                "VSO",
+                                "VSTSRM"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. SCM type."
+                              }
+                            },
+                            "tracingOptions": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tracing options."
+                              }
+                            },
+                            "use32BitWorkerProcess": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` to use 32-bit worker process."
+                              }
+                            },
+                            "virtualApplications": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "physicalPath": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Physical path."
+                                    }
+                                  },
+                                  "preloadEnabled": {
+                                    "type": "bool",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Set to `true` if preloading is enabled."
+                                    }
+                                  },
+                                  "virtualDirectories": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "physicalPath": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Physical path."
+                                          }
+                                        },
+                                        "virtualPath": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Path to virtual application."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Virtual directories for virtual application."
+                                    }
+                                  },
+                                  "virtualPath": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Virtual path."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Virtual applications."
+                              }
+                            },
+                            "vnetName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Virtual Network name."
+                              }
+                            },
+                            "vnetPrivatePortsCount": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The number of private ports assigned to this app. These will be assigned dynamically on runtime."
+                              }
+                            },
+                            "vnetRouteAllEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+                              }
+                            },
+                            "websiteTimeZone": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Sets the time zone a site uses for generating timestamps. Compatible with Linux and Windows App Service. Setting the WEBSITE_TIME_ZONE app setting takes precedence over this config. For Linux, expects tz database values https://www.iana.org/time-zones (for a quick reference see [ref](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)). For Windows, expects one of the time zones listed under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones."
+                              }
+                            },
+                            "webSocketsEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if WebSocket is enabled."
+                              }
+                            },
+                            "windowsFxVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Xenon App Framework and version."
+                              }
+                            },
+                            "xManagedServiceIdentityId": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Explicit Managed Service Identity Id."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a web configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the site."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "allowedValues": [
+                        "functionapp",
+                        "functionapp,linux",
+                        "functionapp,workflowapp",
+                        "functionapp,workflowapp,linux",
+                        "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
+                        "app,linux",
+                        "app",
+                        "linux,api",
+                        "api",
+                        "app,linux,container",
+                        "app,container,windows"
+                      ],
+                      "metadata": {
+                        "description": "Required. Type of site to deploy."
+                      }
+                    },
+                    "serverFarmResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource ID of the app service plan to use for the site. Set as empty string when using a managed environment id for container apps."
+                      }
+                    },
+                    "managedEnvironmentResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                      }
+                    },
+                    "httpsOnly": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Configures a site to accept only HTTPS requests. Issues redirect for HTTP requests."
+                      }
+                    },
+                    "clientAffinityEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. If client affinity is enabled."
+                      }
+                    },
+                    "clientAffinityProxyEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance. Default is true."
+                      }
+                    },
+                    "clientAffinityPartitioningEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. To enable client affinity partitioning using CHIPS cookies, this will add the partitioned property to the affinity cookies; false to stop sending partitioned affinity cookies. Default is false."
+                      }
+                    },
+                    "appServiceEnvironmentResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the app service environment to use for this resource."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "keyVaultAccessIdentityResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                      }
+                    },
+                    "storageAccountRequired": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Checks if Customer provided storage account is required."
+                      }
+                    },
+                    "virtualNetworkSubnetResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                      }
+                    },
+                    "scmSiteAlsoStopped": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                      }
+                    },
+                    "siteConfig": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/siteConfig"
+                        },
+                        "description": "Optional. The site config object. The defaults are set to the following values: alwaysOn: true, minTlsVersion: '1.2', ftpsState: 'FtpsOnly'."
+                      },
+                      "defaultValue": {
+                        "alwaysOn": true,
+                        "minTlsVersion": "1.2",
+                        "ftpsState": "FtpsOnly"
+                      }
+                    },
+                    "outboundVnetRouting": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                        },
+                        "description": "Optional. The outbound VNET routing configuration for the site."
+                      },
+                      "nullable": true
+                    },
+                    "configs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/configType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The web site config."
+                      }
+                    },
+                    "functionAppConfig": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/functionAppConfig"
+                        },
+                        "description": "Optional. The Function App configuration object."
+                      },
+                      "nullable": true
+                    },
+                    "extensions": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/extensionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The extensions configuration."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "slots": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/slotType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for deployment slots for an app."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "clientCertEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                      }
+                    },
+                    "clientCertExclusionPaths": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                      }
+                    },
+                    "clientCertMode": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/clientCertMode"
+                        },
+                        "description": "Optional. This composes with ClientCertEnabled setting.\n- ClientCertEnabled=false means ClientCert is ignored.\n- ClientCertEnabled=true and ClientCertMode=Required means ClientCert is required.\n- ClientCertEnabled=true and ClientCertMode=Optional means ClientCert is optional or accepted.\n"
+                      },
+                      "defaultValue": "Optional"
+                    },
+                    "cloningInfo": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/cloningInfo"
+                        },
+                        "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                      },
+                      "nullable": true
+                    },
+                    "containerSize": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Size of the function container."
+                      }
+                    },
+                    "dailyMemoryTimeQuota": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                      }
+                    },
+                    "enabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                      }
+                    },
+                    "hostNameSslStates": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/hostNameSslStates"
+                        },
+                        "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                      },
+                      "nullable": true
+                    },
+                    "hyperV": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Hyper-V sandbox."
+                      }
+                    },
+                    "redundancyMode": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/redundancyMode"
+                        },
+                        "description": "Optional. Site redundancy mode."
+                      },
+                      "defaultValue": "None"
+                    },
+                    "basicPublishingCredentialsPolicies": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The site publishing credential policy names which are associated with the sites."
+                      }
+                    },
+                    "hybridConnectionRelays": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/hybridConnectionRelayType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Names of hybrid connection relays to connect app with."
+                      }
+                    },
+                    "hostNameBindings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/hostNameBindingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Host Name Bindings for the site."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                        },
+                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set."
+                      },
+                      "nullable": true
+                    },
+                    "e2eEncryptionEnabled": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. End to End Encryption Setting."
+                      }
+                    },
+                    "dnsConfiguration": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/dnsConfiguration"
+                        },
+                        "description": "Optional. Property to configure various DNS related settings for a site."
+                      },
+                      "nullable": true
+                    },
+                    "autoGeneratedDomainNameLabelScope": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                        },
+                        "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                      },
+                      "nullable": true
+                    },
+                    "sshEnabled": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Whether to enable SSH access."
+                      }
+                    },
+                    "daprConfig": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/daprConfig"
+                        },
+                        "description": "Optional. Dapr configuration of the app."
+                      },
+                      "nullable": true
+                    },
+                    "ipMode": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/ipMode"
+                        },
+                        "description": "Optional. Specifies the IP mode of the app."
+                      },
+                      "nullable": true
+                    },
+                    "resourceConfig": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/resourceConfig"
+                        },
+                        "description": "Optional. Function app resource requirements."
+                      },
+                      "nullable": true
+                    },
+                    "workloadProfileName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Workload profile name for function app to execute on."
+                      }
+                    },
+                    "hostNamesDisabled": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                      }
+                    },
+                    "reserved": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                      }
+                    },
+                    "extendedLocation": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/extendedLocation"
+                        },
+                        "description": "Optional. Extended location of the resource."
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "managedEnvironmentSupportedKinds": [
+                      "functionapp,linux,container,azurecontainerapps"
+                    ],
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                      "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                      "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('46d3xbcp.res.web-site.{0}.{1}', replace('0.23.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "app": {
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2025-03-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "kind": "[parameters('kind')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "extendedLocation": "[parameters('extendedLocation')]",
+                      "properties": {
+                        "managedEnvironmentId": "[parameters('managedEnvironmentResourceId')]",
+                        "serverFarmId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), not(empty(parameters('managedEnvironmentResourceId')))), null(), parameters('serverFarmResourceId'))]",
+                        "clientAffinityEnabled": "[if(not(empty(parameters('serverFarmResourceId'))), parameters('clientAffinityEnabled'), null())]",
+                        "clientAffinityProxyEnabled": "[parameters('clientAffinityProxyEnabled')]",
+                        "clientAffinityPartitioningEnabled": "[parameters('clientAffinityPartitioningEnabled')]",
+                        "httpsOnly": "[parameters('httpsOnly')]",
+                        "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                        "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                        "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                        "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]",
+                        "siteConfig": "[parameters('siteConfig')]",
+                        "functionAppConfig": "[parameters('functionAppConfig')]",
+                        "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                        "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                        "clientCertMode": "[if(not(empty(parameters('serverFarmResourceId'))), parameters('clientCertMode'), null())]",
+                        "cloningInfo": "[parameters('cloningInfo')]",
+                        "containerSize": "[parameters('containerSize')]",
+                        "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                        "enabled": "[parameters('enabled')]",
+                        "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                        "hyperV": "[parameters('hyperV')]",
+                        "redundancyMode": "[parameters('redundancyMode')]",
+                        "publicNetworkAccess": "[if(not(empty(parameters('serverFarmResourceId'))), if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled')), null())]",
+                        "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
+                        "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]",
+                        "dnsConfiguration": "[parameters('dnsConfiguration')]",
+                        "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                        "outboundVnetRouting": "[parameters('outboundVnetRouting')]",
+                        "sshEnabled": "[parameters('sshEnabled')]",
+                        "daprConfig": "[parameters('daprConfig')]",
+                        "ipMode": "[parameters('ipMode')]",
+                        "resourceConfig": "[parameters('resourceConfig')]",
+                        "workloadProfileName": "[parameters('workloadProfileName')]",
+                        "hostNamesDisabled": "[parameters('hostNamesDisabled')]",
+                        "reserved": "[parameters('reserved')]"
+                      }
+                    },
+                    "app_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_diagnosticSettings": {
+                      "copy": {
+                        "name": "app_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_roleAssignments": {
+                      "copy": {
+                        "name": "app_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_config": {
+                      "copy": {
+                        "name": "app_config",
+                        "count": "[length(coalesce(parameters('configs'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Site-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                          },
+                          "applicationInsightResourceId": {
+                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountResourceId')]"
+                          },
+                          "storageAccountUseIdentityAuthentication": {
+                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication')]"
+                          },
+                          "properties": {
+                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                          },
+                          "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites', parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]",
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "8196639045793921819"
+                            },
+                            "name": "Site App Settings",
+                            "description": "This module deploys a Site App Setting."
+                          },
+                          "parameters": {
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "allowedValues": [
+                                "appsettings",
+                                "authsettings",
+                                "authsettingsV2",
+                                "azurestorageaccounts",
+                                "backup",
+                                "connectionstrings",
+                                "logs",
+                                "metadata",
+                                "pushsettings",
+                                "slotConfigNames",
+                                "web"
+                              ],
+                              "metadata": {
+                                "description": "Required. The name of the config."
+                              }
+                            },
+                            "properties": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The properties of the config. Note: This parameter is highly dependent on the config type, defined by its name."
+                              }
+                            },
+                            "storageAccountUseIdentityAuthentication": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                              }
+                            },
+                            "applicationInsightResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "currentAppSettings": {
+                              "type": "object",
+                              "properties": {},
+                              "additionalProperties": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The key-values pairs of the current app settings."
+                                }
+                              },
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The current app settings."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-siteconfig.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "applicationInsights": {
+                              "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.Insights/components",
+                              "apiVersion": "2020-02-02",
+                              "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
+                              "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
+                            },
+                            "storageAccount": {
+                              "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-06-01",
+                              "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                            },
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2025-03-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "config": {
+                              "type": "Microsoft.Web/sites/config",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                              "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys('storageAccount', '2025-06-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/')), 'AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob, 'AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue, 'AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table), createObject())), if(not(empty(parameters('applicationInsightResourceId'))), shallowMerge(createArray(createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), if(not(contains(parameters('properties'), 'ApplicationInsightsAgent_EXTENSION_VERSION')), createObject('ApplicationInsightsAgent_EXTENSION_VERSION', if(contains(createArray('functionapp,linux', 'functionapp,workflowapp,linux', 'functionapp,linux,container', 'functionapp,linux,container,azurecontainerapps', 'app,linux', 'linux,api', 'app,linux,container'), reference('app', '2025-03-01', 'full').kind), '~3', '~2')), createObject()))), createObject()))]",
+                              "dependsOn": [
+                                "app",
+                                "applicationInsights",
+                                "storageAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the site config."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the site config."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the site config was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_extensions": {
+                      "copy": {
+                        "name": "app_extensions",
+                        "count": "[length(coalesce(parameters('extensions'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Site-Extension-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "properties": {
+                            "value": "[coalesce(parameters('extensions'), createArray())[copyIndex()].properties]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "13172204291630325256"
+                            },
+                            "name": "Site Deployment Extension ",
+                            "description": "This module deploys a Site extension for MSDeploy."
+                          },
+                          "parameters": {
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the parent site resource."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "MSDeploy",
+                              "allowedValues": [
+                                "MSDeploy"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The name of the extension."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "defaultValue": "MSDeploy",
+                              "allowedValues": [
+                                "MSDeploy"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The kind of extension."
+                              }
+                            },
+                            "properties": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                                },
+                                "description": "Optional. Sets the properties."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-site-extension.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2025-03-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "msdeploy": {
+                              "type": "Microsoft.Web/sites/extensions",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                              "kind": "[parameters('kind')]",
+                              "properties": "[parameters('properties')]"
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the extension was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_slots": {
+                      "copy": {
+                        "name": "app_slots",
+                        "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('slots'), createArray())[copyIndex()].name]"
+                          },
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "kind": {
+                            "value": "[parameters('kind')]"
+                          },
+                          "serverFarmResourceId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), not(empty(parameters('managedEnvironmentResourceId')))), createObject('value', null()), createObject('value', parameters('serverFarmResourceId')))]",
+                          "managedEnvironmentResourceId": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedEnvironmentResourceId'), parameters('managedEnvironmentResourceId'))]"
+                          },
+                          "httpsOnly": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'httpsOnly'), parameters('httpsOnly'))]"
+                          },
+                          "appServiceEnvironmentResourceId": {
+                            "value": "[parameters('appServiceEnvironmentResourceId')]"
+                          },
+                          "clientAffinityEnabled": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityEnabled'), parameters('clientAffinityEnabled'))]"
+                          },
+                          "clientAffinityProxyEnabled": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityProxyEnabled'), parameters('clientAffinityProxyEnabled'))]"
+                          },
+                          "clientAffinityPartitioningEnabled": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityPartitioningEnabled'), parameters('clientAffinityPartitioningEnabled'))]"
+                          },
+                          "managedIdentities": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedIdentities'), parameters('managedIdentities'))]"
+                          },
+                          "keyVaultAccessIdentityResourceId": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'keyVaultAccessIdentityResourceId'), parameters('keyVaultAccessIdentityResourceId'))]"
+                          },
+                          "storageAccountRequired": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountRequired'), parameters('storageAccountRequired'))]"
+                          },
+                          "virtualNetworkSubnetResourceId": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'virtualNetworkSubnetResourceId'), parameters('virtualNetworkSubnetResourceId'))]"
+                          },
+                          "siteConfig": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'siteConfig'), parameters('siteConfig'))]"
+                          },
+                          "functionAppConfig": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'functionAppConfig'), parameters('functionAppConfig'))]"
+                          },
+                          "configs": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'configs'), parameters('configs'))]"
+                          },
+                          "extensions": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'extensions'), parameters('extensions'))]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'diagnosticSettings')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "basicPublishingCredentialsPolicies": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'basicPublishingCredentialsPolicies'), parameters('basicPublishingCredentialsPolicies'))]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateEndpoints": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'), createArray())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "clientCertEnabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertEnabled')]"
+                          },
+                          "clientCertExclusionPaths": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertExclusionPaths')]"
+                          },
+                          "clientCertMode": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertMode')]"
+                          },
+                          "cloningInfo": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'cloningInfo')]"
+                          },
+                          "containerSize": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'containerSize')]"
+                          },
+                          "customDomainVerificationId": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'customDomainVerificationId')]"
+                          },
+                          "dailyMemoryTimeQuota": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dailyMemoryTimeQuota')]"
+                          },
+                          "enabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'enabled')]"
+                          },
+                          "hostNameSslStates": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameSslStates')]"
+                          },
+                          "hyperV": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hyperV')]"
+                          },
+                          "publicNetworkAccess": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'publicNetworkAccess'), if(or(not(empty(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'))), not(empty(parameters('privateEndpoints')))), 'Disabled', 'Enabled'))]"
+                          },
+                          "redundancyMode": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'redundancyMode')]"
+                          },
+                          "hybridConnectionRelays": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hybridConnectionRelays')]"
+                          },
+                          "hostNameBindings": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameBindings')]"
+                          },
+                          "dnsConfiguration": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dnsConfiguration')]"
+                          },
+                          "autoGeneratedDomainNameLabelScope": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'autoGeneratedDomainNameLabelScope')]"
+                          },
+                          "outboundVnetRouting": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'outboundVnetRouting'), parameters('outboundVnetRouting'))]"
+                          },
+                          "sshEnabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'sshEnabled')]"
+                          },
+                          "daprConfig": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'daprConfig')]"
+                          },
+                          "ipMode": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'ipMode')]"
+                          },
+                          "resourceConfig": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'resourceConfig')]"
+                          },
+                          "workloadProfileName": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'workloadProfileName')]"
+                          },
+                          "hostNamesDisabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNamesDisabled')]"
+                          },
+                          "reserved": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'reserved')]"
+                          },
+                          "scmSiteAlsoStopped": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'scmSiteAlsoStopped'), parameters('scmSiteAlsoStopped'))]"
+                          },
+                          "e2eEncryptionEnabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'e2eEncryptionEnabled')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "14501171431519947073"
+                            },
+                            "name": "Web/Function App Deployment Slots",
+                            "description": "This module deploys a Web or Function App Deployment Slot."
+                          },
+                          "definitions": {
+                            "hostNameBindingsOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the host name binding."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the host name binding."
+                                  }
+                                },
+                                "resourceGroupName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the resource group the resource was deployed into."
+                                  }
+                                },
+                                "certificateThumbprint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The thumbprint of the certificate."
+                                  }
+                                },
+                                "certificateResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The resource ID of the certificate."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "privateEndpointOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The group Id for the private endpoint Group."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "FQDN that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses of the private endpoint."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "configType": {
+                              "type": "object",
+                              "discriminator": {
+                                "propertyName": "name",
+                                "mapping": {
+                                  "appsettings": {
+                                    "$ref": "#/definitions/appSettingsConfigType"
+                                  },
+                                  "authsettings": {
+                                    "$ref": "#/definitions/authSettingsConfigType"
+                                  },
+                                  "authsettingsV2": {
+                                    "$ref": "#/definitions/authSettingsV2ConfigType"
+                                  },
+                                  "azurestorageaccounts": {
+                                    "$ref": "#/definitions/azureStorageAccountConfigType"
+                                  },
+                                  "backup": {
+                                    "$ref": "#/definitions/backupConfigType"
+                                  },
+                                  "connectionstrings": {
+                                    "$ref": "#/definitions/connectionStringsConfigType"
+                                  },
+                                  "logs": {
+                                    "$ref": "#/definitions/logsConfigType"
+                                  },
+                                  "metadata": {
+                                    "$ref": "#/definitions/metadataConfigType"
+                                  },
+                                  "pushsettings": {
+                                    "$ref": "#/definitions/pushSettingsConfigType"
+                                  },
+                                  "web": {
+                                    "$ref": "#/definitions/webConfigType"
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a site configuration."
+                              }
+                            },
+                            "appSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "appsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "storageAccountUseIdentityAuthentication": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                  }
+                                },
+                                "applicationInsightResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                  }
+                                },
+                                "retainCurrentAppSettings": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The retain the current app settings. Defaults to true."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. An app settings key-value pair."
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of an app settings configuration."
+                              }
+                            },
+                            "authSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "authsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "aadClaimsAuthorization": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a JSON string containing the Azure AD Acl settings."
+                                      }
+                                    },
+                                    "additionalLoginParams": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                      }
+                                    },
+                                    "allowedAudiences": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting."
+                                      }
+                                    },
+                                    "allowedExternalRedirectUrls": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                      }
+                                    },
+                                    "authFilePath": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The path of the config file containing auth settings. If the path is relative, base will the site's root directory."
+                                      }
+                                    },
+                                    "clientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                      }
+                                    },
+                                    "clientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                      }
+                                    },
+                                    "clientSecretCertificateThumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                      }
+                                    },
+                                    "clientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                      }
+                                    },
+                                    "configVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization."
+                                      }
+                                    },
+                                    "defaultProvider": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AzureActiveDirectory",
+                                        "Facebook",
+                                        "Github",
+                                        "Google",
+                                        "MicrosoftAccount",
+                                        "Twitter"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                      }
+                                    },
+                                    "facebookAppId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "facebookAppSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "facebookAppSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the app secret used for Facebook Login."
+                                      }
+                                    },
+                                    "facebookOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "gitHubClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Id of the GitHub app used for login. This setting is required for enabling Github login."
+                                      }
+                                    },
+                                    "gitHubClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login."
+                                      }
+                                    },
+                                    "gitHubClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret of the Github app used for GitHub Login."
+                                      }
+                                    },
+                                    "gitHubOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication."
+                                      }
+                                    },
+                                    "googleClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "googleClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "googleClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret associated with the Google web application."
+                                      }
+                                    },
+                                    "googleOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, \"openid\", \"profile\", and \"email\" are used as default scopes. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "isAuthFromFile": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "false",
+                                        "true"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. \"true\" if the auth config settings should be read from a file, \"false\" otherwise."
+                                      }
+                                    },
+                                    "issuer": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                      }
+                                    },
+                                    "microsoftAccountClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                      }
+                                    },
+                                    "microsoftAccountClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                      }
+                                    },
+                                    "microsoftAccountClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication."
+                                      }
+                                    },
+                                    "microsoftAccountOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, \"wl.basic\" is used as the default scope. Microsoft Account Scopes and permissions [documentation](https://msdn.microsoft.com/en-us/library/dn631845.aspx)."
+                                      }
+                                    },
+                                    "runtimeVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                      }
+                                    },
+                                    "tokenRefreshExtensionHours": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                      }
+                                    },
+                                    "tokenStoreEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows. The default is `false`."
+                                      }
+                                    },
+                                    "twitterConsumerKey": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                      }
+                                    },
+                                    "twitterConsumerSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                      }
+                                    },
+                                    "twitterConsumerSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                      }
+                                    },
+                                    "unauthenticatedClientAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AllowAnonymous",
+                                        "RedirectToLoginPage"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                      }
+                                    },
+                                    "validateIssuer": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of an auth settings configuration."
+                              }
+                            },
+                            "authSettingsV2ConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "authsettingsV2"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "globalValidation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "excludedPaths": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The paths for which unauthenticated flow would not be redirected to the login page."
+                                          }
+                                        },
+                                        "redirectToProvider": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                          }
+                                        },
+                                        "requireAuthentication": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the authentication flow is required by every request."
+                                          }
+                                        },
+                                        "unauthenticatedClientAction": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AllowAnonymous",
+                                            "RedirectToLoginPage",
+                                            "Return401",
+                                            "Return403"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings that determines the validation flow of users using App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "httpSettings": {
+                                      "type": "object",
+                                      "properties": {
+                                        "forwardProxy": {
+                                          "type": "object",
+                                          "properties": {
+                                            "convention": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Custom",
+                                                "NoProxy",
+                                                "Standard"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The convention used to determine the url of the request made."
+                                              }
+                                            },
+                                            "customHostHeaderName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The name of the header containing the host of the request."
+                                              }
+                                            },
+                                            "customProtoHeaderName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The name of the header containing the scheme of the request."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of a forward proxy used to make the requests."
+                                          }
+                                        },
+                                        "requireHttps": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `false` if the authentication/authorization responses not having the HTTPS scheme are permissible."
+                                          }
+                                        },
+                                        "routes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "apiPrefix": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The prefix that should precede all the authentication/authorization paths."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the paths HTTP requests."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "identityProviders": {
+                                      "type": "object",
+                                      "properties": {
+                                        "apple": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Apple provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Apple registration."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Apple provider."
+                                          }
+                                        },
+                                        "azureActiveDirectory": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "isAutoProvisioned": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "disableWWWAuthenticate": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the www-authenticate provider should be omitted from the request."
+                                                  }
+                                                },
+                                                "loginParameters": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                                  }
+                                                },
+                                                "clientSecretCertificateIssuer": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                  }
+                                                },
+                                                "clientSecretCertificateSubjectAlternativeName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                  }
+                                                },
+                                                "clientSecretCertificateThumbprint": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                                  }
+                                                },
+                                                "openIdIssuer": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory app registration."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The list of audiences that can make successful authentication/authorization requests."
+                                                  }
+                                                },
+                                                "defaultAuthorizationPolicy": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "allowedApplications": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory allowed applications."
+                                                      }
+                                                    },
+                                                    "allowedPrincipals": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "groups": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of the allowed groups."
+                                                          }
+                                                        },
+                                                        "identities": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of the allowed identities."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory allowed principals."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the default authorization policy."
+                                                  }
+                                                },
+                                                "jwtClaimChecks": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "allowedClientApplications": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The list of the allowed client applications."
+                                                      }
+                                                    },
+                                                    "allowedGroups": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The list of the allowed groups."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the checks that should be made while validating the JWT Claims."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Azure Active directory provider."
+                                          }
+                                        },
+                                        "azureStaticWebApps": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Azure Static Web Apps provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Static Web Apps registration."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Azure Static Web Apps provider."
+                                          }
+                                        },
+                                        "customOpenIdConnectProviders": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Set to `false` if the custom Open ID provider provider should not be enabled."
+                                                }
+                                              },
+                                              "login": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "nameClaimType": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of the claim that contains the users name."
+                                                    }
+                                                  },
+                                                  "scopes": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "string"
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The configuration settings of the login flow of the custom Open ID Connect provider."
+                                                }
+                                              },
+                                              "registration": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "clientCredential": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "clientSecretSettingName": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. The app setting that contains the client secret for the custom Open ID Connect provider."
+                                                        }
+                                                      },
+                                                      "method": {
+                                                        "type": "string",
+                                                        "allowedValues": [
+                                                          "ClientSecretPost"
+                                                        ],
+                                                        "metadata": {
+                                                          "description": "Required. The method that should be used to authenticate the user."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The authentication credentials of the custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "clientId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The client id of the custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "openIdConnectConfiguration": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "authorizationEndpoint": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint to be used to make an authorization request."
+                                                        }
+                                                      },
+                                                      "certificationUri": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that provides the keys necessary to validate the token."
+                                                        }
+                                                      },
+                                                      "issuer": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that issues the token."
+                                                        }
+                                                      },
+                                                      "tokenEndpoint": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint to be used to request a token."
+                                                        }
+                                                      },
+                                                      "wellKnownOpenIdConfiguration": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that contains all the configuration endpoints for the provider."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The configuration settings of the endpoints used for the custom Open ID Connect provider."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The configuration settings of the app registration for the custom Open ID Connect provider."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The alias of each custom Open ID Connect provider."
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider."
+                                          }
+                                        },
+                                        "facebook": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Facebook provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "graphApiVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The version of the Facebook api to be used while logging in."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "appId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The App ID of the app used for login."
+                                                  }
+                                                },
+                                                "appSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the app secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Facebook provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Facebook provider."
+                                          }
+                                        },
+                                        "gitHub": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the GitHub provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the GitHub provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the GitHub provider."
+                                          }
+                                        },
+                                        "google": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Google provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Google provider."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Google provider."
+                                          }
+                                        },
+                                        "legacyMicrosoftAccount": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the legacy Microsoft Account provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the legacy Microsoft Account provider."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the legacy Microsoft Account provider token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the legacy Microsoft Account provider."
+                                          }
+                                        },
+                                        "twitter": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Twitter provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "consumerKey": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                                  }
+                                                },
+                                                "consumerSecretSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Twitter provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Twitter provider."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of each of the identity providers used to configure App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedExternalRedirectUrls": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                          }
+                                        },
+                                        "cookieExpiration": {
+                                          "type": "object",
+                                          "properties": {
+                                            "convention": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "FixedTime",
+                                                "IdentityProviderDerived"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The convention used when determining the session cookie's expiration."
+                                              }
+                                            },
+                                            "timeToExpiration": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The time after the request is made when the session cookie should expire."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the session cookie's expiration."
+                                          }
+                                        },
+                                        "nonce": {
+                                          "type": "object",
+                                          "properties": {
+                                            "nonceExpirationInterval": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The time after the request is made when the nonce should expire."
+                                              }
+                                            },
+                                            "validateNonce": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the nonce should not be validated while completing the login flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the nonce used in the login flow."
+                                          }
+                                        },
+                                        "preserveUrlFragmentsForLogins": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the fragments from the request are preserved after the login request is made."
+                                          }
+                                        },
+                                        "routes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "logoutEndpoint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The endpoint at which a logout request should be made."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The routes that specify the endpoints used for login and logout requests."
+                                          }
+                                        },
+                                        "tokenStore": {
+                                          "type": "object",
+                                          "properties": {
+                                            "azureBlobStorage": {
+                                              "type": "object",
+                                              "properties": {
+                                                "sasUrlSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the app setting containing the SAS URL of the blob storage containing the tokens."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the storage of the tokens if blob storage is used."
+                                              }
+                                            },
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows."
+                                              }
+                                            },
+                                            "fileSystem": {
+                                              "type": "object",
+                                              "properties": {
+                                                "directory": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The directory in which the tokens will be stored."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the storage of the tokens if a file system is used."
+                                              }
+                                            },
+                                            "tokenRefreshExtensionHours": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the token store."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow of users using App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "platform": {
+                                      "type": "object",
+                                      "properties": {
+                                        "configFilePath": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The path of the config file containing auth settings if they come from a file. If the path is relative, base will the site's root directory."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                          }
+                                        },
+                                        "runtimeVersion": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the platform of App Service Authentication/Authorization."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of an authSettingsV2 configuration."
+                              }
+                            },
+                            "azureStorageAccountConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "azurestorageaccounts"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "accessKey": {
+                                        "type": "securestring",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Access key for the storage account."
+                                        }
+                                      },
+                                      "accountName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the storage account."
+                                        }
+                                      },
+                                      "mountPath": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                        }
+                                      },
+                                      "protocol": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "Http",
+                                          "Nfs",
+                                          "Smb"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Mounting protocol to use for the storage account."
+                                        }
+                                      },
+                                      "shareName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                        }
+                                      },
+                                      "type": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "AzureBlob",
+                                          "AzureFiles"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Type of storage."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Azure Storage Info configuration."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of an Azure Storage Account configuration."
+                              }
+                            },
+                            "backupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "backup"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "backupName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name of the backup."
+                                      }
+                                    },
+                                    "backupSchedule": {
+                                      "type": "object",
+                                      "properties": {
+                                        "frequencyInterval": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. How often the backup should be executed (e.g. for weekly backup, this should be set to 7 and FrequencyUnit should be set to Day)."
+                                          }
+                                        },
+                                        "frequencyUnit": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Day",
+                                            "Hour"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The unit of time for how often the backup should be executed (e.g. for weekly backup, this should be set to Day and FrequencyInterval should be set to 7)."
+                                          }
+                                        },
+                                        "keepAtLeastOneBackup": {
+                                          "type": "bool",
+                                          "metadata": {
+                                            "description": "Required. Set to `True` if the retention policy should always keep at least one backup in the storage account, regardless how old it is."
+                                          }
+                                        },
+                                        "retentionPeriodInDays": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. After how many days backups should be deleted."
+                                          }
+                                        },
+                                        "startTime": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. When the schedule should start working."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Schedule for the backup if it is executed periodically."
+                                      }
+                                    },
+                                    "databases": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "connectionString": {
+                                            "type": "securestring",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Contains a connection string to a database which is being backed up or restored. If the restore should happen to a new database, the database name inside is the new one."
+                                            }
+                                          },
+                                          "connectionStringName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Contains a connection string name that is linked to the SiteConfig.ConnectionStrings. This is used during restore with overwrite connection strings options."
+                                            }
+                                          },
+                                          "databaseType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "LocalMySql",
+                                              "MySql",
+                                              "PostgreSql",
+                                              "SqlAzure"
+                                            ],
+                                            "metadata": {
+                                              "description": "Required. Database type (e.g. SqlAzure / MySql)."
+                                            }
+                                          },
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of the setting."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Databases included in the backup."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `True` if the backup schedule is enabled (must be included in that case), `false` if the backup schedule should be disabled."
+                                      }
+                                    },
+                                    "storageAccountUrl": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SAS URL to the container."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a backup configuration."
+                              }
+                            },
+                            "connectionStringsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "connectionstrings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "type": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "ApiHub",
+                                          "Custom",
+                                          "DocDb",
+                                          "EventHub",
+                                          "MySql",
+                                          "NotificationHub",
+                                          "PostgreSQL",
+                                          "RedisCache",
+                                          "SQLAzure",
+                                          "SQLServer",
+                                          "ServiceBus"
+                                        ],
+                                        "metadata": {
+                                          "description": "Required. Type of database."
+                                        }
+                                      },
+                                      "value": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Value of pair."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the connection string setting."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a connection string configuration."
+                              }
+                            },
+                            "logsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "logs"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "applicationLogs": {
+                                      "type": "object",
+                                      "properties": {
+                                        "azureBlobStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to blob storage configuration."
+                                          }
+                                        },
+                                        "azureTableStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. SAS URL to an Azure table with add/query/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to azure table storage configuration."
+                                          }
+                                        },
+                                        "fileSystem": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to file system configuration."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application Logs for Azure configuration."
+                                      }
+                                    },
+                                    "detailedErrorMessages": {
+                                      "type": "object",
+                                      "properties": {
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Detailed error messages configuration."
+                                      }
+                                    },
+                                    "failedRequestsTracing": {
+                                      "type": "object",
+                                      "properties": {
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Failed requests tracing configuration."
+                                      }
+                                    },
+                                    "httpLogs": {
+                                      "type": "object",
+                                      "properties": {
+                                        "azureBlobStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Http logs to azure blob storage configuration."
+                                          }
+                                        },
+                                        "fileSystem": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove files older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "retentionInMb": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 25,
+                                              "maxValue": 100,
+                                              "metadata": {
+                                                "description": "Optional. Maximum size in megabytes that http log files can use. When reached old log files will be removed to make space for new ones."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Http logs to file system configuration."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. HTTP logs configuration."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a logs configuration."
+                              }
+                            },
+                            "metadataConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "metadata"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata key value pair."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a metadata configuration."
+                              }
+                            },
+                            "pushSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "pushsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "dynamicTagsJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                      }
+                                    },
+                                    "isPushEnabled": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                      }
+                                    },
+                                    "tagsRequiringAuth": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                      }
+                                    },
+                                    "tagWhitelistJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a pushSettings configuration."
+                              }
+                            },
+                            "webConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "web"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "acrUseManagedIdentityCreds": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Flag to use Managed Identity Creds for ACR pull."
+                                      }
+                                    },
+                                    "acrUserManagedIdentityID": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. If using user managed identity, the user managed identity ClientId."
+                                      }
+                                    },
+                                    "alwaysOn": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if 'Always On' is enabled."
+                                      }
+                                    },
+                                    "apiDefinition": {
+                                      "type": "object",
+                                      "properties": {
+                                        "url": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The URL of the API definition."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Information about the formal API definition for the app."
+                                      }
+                                    },
+                                    "apiManagementConfig": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. APIM-Api Identifier."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure API management settings linked to the app."
+                                      }
+                                    },
+                                    "appCommandLine": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. App command line to launch."
+                                      }
+                                    },
+                                    "appSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Name of the pair."
+                                            }
+                                          },
+                                          "value": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Value of the pair."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application settings."
+                                      }
+                                    },
+                                    "autoHealEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if Auto Heal is enabled."
+                                      }
+                                    },
+                                    "autoHealRules": {
+                                      "type": "object",
+                                      "properties": {
+                                        "actions": {
+                                          "type": "object",
+                                          "properties": {
+                                            "actionType": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "CustomAction",
+                                                "LogEvent",
+                                                "Recycle"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Predefined action to be taken."
+                                              }
+                                            },
+                                            "customAction": {
+                                              "type": "object",
+                                              "properties": {
+                                                "exe": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Executable to be run."
+                                                  }
+                                                },
+                                                "parameters": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Parameters for the executable."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Custom action to be taken."
+                                              }
+                                            },
+                                            "minProcessExecutionTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Minimum time the process must execute before taking the action."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Actions to be executed when a rule is triggered."
+                                          }
+                                        },
+                                        "triggers": {
+                                          "type": "object",
+                                          "properties": {
+                                            "privateBytesInKB": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on private bytes."
+                                              }
+                                            },
+                                            "requests": {
+                                              "type": "object",
+                                              "properties": {
+                                                "count": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Request Count."
+                                                  }
+                                                },
+                                                "timeInterval": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Time interval."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on total requests."
+                                              }
+                                            },
+                                            "slowRequests": {
+                                              "$ref": "#/definitions/slowRequestBasedTriggerType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on request execution time."
+                                              }
+                                            },
+                                            "slowRequestsWithPath": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/slowRequestBasedTriggerType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on multiple Slow Requests Rule with path."
+                                              }
+                                            },
+                                            "statusCodes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "count": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Count."
+                                                    }
+                                                  },
+                                                  "path": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Path."
+                                                    }
+                                                  },
+                                                  "status": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. HTTP status code."
+                                                    }
+                                                  },
+                                                  "subStatus": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Sub Status."
+                                                    }
+                                                  },
+                                                  "timeInterval": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Time interval."
+                                                    }
+                                                  },
+                                                  "win32Status": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Win32 error code."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on status codes."
+                                              }
+                                            },
+                                            "statusCodesRange": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "count": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Count."
+                                                    }
+                                                  },
+                                                  "path": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Path."
+                                                    }
+                                                  },
+                                                  "statusCodes": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. HTTP status code."
+                                                    }
+                                                  },
+                                                  "timeInterval": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Time interval."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on status codes ranges."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Conditions that describe when to execute the auto-heal actions."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Auto Heal rules."
+                                      }
+                                    },
+                                    "autoSwapSlotName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Auto-swap slot name."
+                                      }
+                                    },
+                                    "azureStorageAccounts": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "type": "object",
+                                        "properties": {
+                                          "accessKey": {
+                                            "type": "securestring",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Access key for the storage account."
+                                            }
+                                          },
+                                          "accountName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the storage account."
+                                            }
+                                          },
+                                          "mountPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                            }
+                                          },
+                                          "protocol": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Http",
+                                              "Nfs",
+                                              "Smb"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Mounting protocol to use for the storage account."
+                                            }
+                                          },
+                                          "shareName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                            }
+                                          },
+                                          "type": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "AzureBlob",
+                                              "AzureFiles"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Type of storage."
+                                            }
+                                          }
+                                        },
+                                        "metadata": {
+                                          "description": "Required. A storage account configuration."
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of Azure Storage Accounts."
+                                      }
+                                    },
+                                    "connectionStrings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "connectionString": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Connection string value."
+                                            }
+                                          },
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of connection string."
+                                            }
+                                          },
+                                          "type": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "ApiHub",
+                                              "Custom",
+                                              "DocDb",
+                                              "EventHub",
+                                              "MySql",
+                                              "NotificationHub",
+                                              "PostgreSQL",
+                                              "RedisCache",
+                                              "SQLAzure",
+                                              "SQLServer",
+                                              "ServiceBus"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Type of database."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Connection strings."
+                                      }
+                                    },
+                                    "cors": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedOrigins": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Gets or sets the list of origins that should be allowed to make cross-origin calls (for example: http://example.com:12345). Use \"*\" to allow all."
+                                          }
+                                        },
+                                        "supportCredentials": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Gets or sets whether CORS requests with credentials are allowed. See [ref](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Requests_with_credentials) for more details."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Cross-Origin Resource Sharing (CORS) settings."
+                                      }
+                                    },
+                                    "defaultDocuments": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default documents."
+                                      }
+                                    },
+                                    "detailedErrorLoggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if detailed error logging is enabled."
+                                      }
+                                    },
+                                    "documentRoot": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Document root."
+                                      }
+                                    },
+                                    "elasticWebAppScaleLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to apps in plans where ElasticScaleEnabled is `true`."
+                                      }
+                                    },
+                                    "experiments": {
+                                      "type": "object",
+                                      "properties": {
+                                        "rampUpRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "actionHostName": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Hostname of a slot to which the traffic will be redirected if decided to. E.g. myapp-stage.azurewebsites.net."
+                                                }
+                                              },
+                                              "changeDecisionCallbackUrl": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified."
+                                                }
+                                              },
+                                              "changeIntervalInMinutes": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies interval in minutes to reevaluate ReroutePercentage."
+                                                }
+                                              },
+                                              "changeStep": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. In auto ramp up scenario this is the step to add/remove from `ReroutePercentage` until it reaches `MinReroutePercentage` or `MaxReroutePercentage`. Site metrics are checked every N minutes specified in `ChangeIntervalInMinutes`. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified in `ChangeDecisionCallbackUrl`."
+                                                }
+                                              },
+                                              "maxReroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies upper boundary below which ReroutePercentage will stay."
+                                                }
+                                              },
+                                              "minReroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies lower boundary above which ReroutePercentage will stay."
+                                                }
+                                              },
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of the routing rule. The recommended name would be to point to the slot which will receive the traffic in the experiment."
+                                                }
+                                              },
+                                              "reroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Percentage of the traffic which will be redirected to `ActionHostName`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. List of ramp-up rules."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. This is work around for polymorphic types."
+                                      }
+                                    },
+                                    "ftpsState": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AllAllowed",
+                                        "Disabled",
+                                        "FtpsOnly"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. State of FTP / FTPS service."
+                                      }
+                                    },
+                                    "functionAppScaleLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to the Consumption and Elastic Premium Plans."
+                                      }
+                                    },
+                                    "functionsRuntimeScaleMonitoringEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a value indicating whether functions runtime scale monitoring is enabled. When enabled, the ScaleController will not monitor event sources directly, but will instead call to the runtime to get scale status."
+                                      }
+                                    },
+                                    "handlerMappings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "arguments": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Command-line arguments to be passed to the script processor."
+                                            }
+                                          },
+                                          "extension": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Requests with this extension will be handled using the specified FastCGI application."
+                                            }
+                                          },
+                                          "scriptProcessor": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The absolute path to the FastCGI application."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Handler mappings."
+                                      }
+                                    },
+                                    "healthCheckPath": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Health check path."
+                                      }
+                                    },
+                                    "http20Enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allow clients to connect over http2.0."
+                                      }
+                                    },
+                                    "httpLoggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if HTTP logging is enabled."
+                                      }
+                                    },
+                                    "ipSecurityRestrictions": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/scmIpSecurityRestrictionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for main."
+                                      }
+                                    },
+                                    "ipSecurityRestrictionsDefaultAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default action for main access restriction if no rules are matched."
+                                      }
+                                    },
+                                    "javaContainer": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java container."
+                                      }
+                                    },
+                                    "javaContainerVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java container version."
+                                      }
+                                    },
+                                    "javaVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java version."
+                                      }
+                                    },
+                                    "keyVaultReferenceIdentity": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Identity to use for Key Vault Reference authentication."
+                                      }
+                                    },
+                                    "limits": {
+                                      "type": "object",
+                                      "properties": {
+                                        "maxDiskSizeInMb": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed disk size usage in MB."
+                                          }
+                                        },
+                                        "maxMemoryInMb": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed memory usage in MB."
+                                          }
+                                        },
+                                        "maxPercentageCpu": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed CPU usage percentage."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Site limits."
+                                      }
+                                    },
+                                    "linuxFxVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Linux App Framework and version."
+                                      }
+                                    },
+                                    "loadBalancing": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "LeastRequests",
+                                        "LeastRequestsWithTieBreaker",
+                                        "LeastResponseTime",
+                                        "PerSiteRoundRobin",
+                                        "RequestHash",
+                                        "WeightedRoundRobin",
+                                        "WeightedTotalTraffic"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Site load balancing."
+                                      }
+                                    },
+                                    "localMySqlEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to enable local MySQL."
+                                      }
+                                    },
+                                    "logsDirectorySizeLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. HTTP logs directory size limit."
+                                      }
+                                    },
+                                    "managedPipelineMode": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Classic",
+                                        "Integrated"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Managed pipeline mode."
+                                      }
+                                    },
+                                    "managedServiceIdentityId": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Managed Service Identity Id."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Pair name."
+                                            }
+                                          },
+                                          "value": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Pair Value."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application metadata. This property cannot be retrieved, since it may contain secrets."
+                                      }
+                                    },
+                                    "minimumElasticInstanceCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 20,
+                                      "metadata": {
+                                        "description": "Optional. Number of minimum instance count for a site. This setting only applies to the Elastic Plans."
+                                      }
+                                    },
+                                    "minTlsCipherSuite": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "TLS_AES_128_GCM_SHA256",
+                                        "TLS_AES_256_GCM_SHA384",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                                        "TLS_RSA_WITH_AES_128_CBC_SHA",
+                                        "TLS_RSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_RSA_WITH_AES_256_CBC_SHA",
+                                        "TLS_RSA_WITH_AES_256_CBC_SHA256",
+                                        "TLS_RSA_WITH_AES_256_GCM_SHA384"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The minimum strength TLS cipher suite allowed for an application."
+                                      }
+                                    },
+                                    "minTlsVersion": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "1.0",
+                                        "1.1",
+                                        "1.2",
+                                        "1.3"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. MinTlsVersion: configures the minimum version of TLS required for SSL requests."
+                                      }
+                                    },
+                                    "netFrameworkVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. .NET Framework version."
+                                      }
+                                    },
+                                    "nodeVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of Node.js."
+                                      }
+                                    },
+                                    "numberOfWorkers": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Number of workers."
+                                      }
+                                    },
+                                    "phpVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of PHP."
+                                      }
+                                    },
+                                    "powerShellVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of PowerShell."
+                                      }
+                                    },
+                                    "preWarmedInstanceCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 10,
+                                      "metadata": {
+                                        "description": "Optional. Number of preWarmed instances. This setting only applies to the Consumption and Elastic Plans."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Property to allow or block all public traffic."
+                                      }
+                                    },
+                                    "publishingUsername": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Publishing user name."
+                                      }
+                                    },
+                                    "push": {
+                                      "type": "object",
+                                      "properties": {
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "dynamicTagsJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                              }
+                                            },
+                                            "isPushEnabled": {
+                                              "type": "bool",
+                                              "metadata": {
+                                                "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                              }
+                                            },
+                                            "tagsRequiringAuth": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                              }
+                                            },
+                                            "tagWhitelistJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. PushSettings resource specific properties."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Push endpoint settings."
+                                      }
+                                    },
+                                    "pythonVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of Python."
+                                      }
+                                    },
+                                    "remoteDebuggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if remote debugging is enabled."
+                                      }
+                                    },
+                                    "remoteDebuggingVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Remote debugging version."
+                                      }
+                                    },
+                                    "requestTracingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if request tracing is enabled."
+                                      }
+                                    },
+                                    "requestTracingExpirationTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request tracing expiration time."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictions": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/scmIpSecurityRestrictionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for scm."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionsDefaultAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default action for scm access restriction if no rules are matched."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionsUseMain": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for scm to use main."
+                                      }
+                                    },
+                                    "scmMinTlsVersion": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "1.0",
+                                        "1.1",
+                                        "1.2",
+                                        "1.3"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. ScmMinTlsVersion: configures the minimum version of TLS required for SSL requests for SCM site."
+                                      }
+                                    },
+                                    "scmType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "BitbucketGit",
+                                        "BitbucketHg",
+                                        "CodePlexGit",
+                                        "CodePlexHg",
+                                        "Dropbox",
+                                        "ExternalGit",
+                                        "ExternalHg",
+                                        "GitHub",
+                                        "LocalGit",
+                                        "None",
+                                        "OneDrive",
+                                        "Tfs",
+                                        "VSO",
+                                        "VSTSRM"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SCM type."
+                                      }
+                                    },
+                                    "tracingOptions": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tracing options."
+                                      }
+                                    },
+                                    "use32BitWorkerProcess": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to use 32-bit worker process."
+                                      }
+                                    },
+                                    "virtualApplications": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "physicalPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Physical path."
+                                            }
+                                          },
+                                          "preloadEnabled": {
+                                            "type": "bool",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Set to `true` if preloading is enabled."
+                                            }
+                                          },
+                                          "virtualDirectories": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "object",
+                                              "properties": {
+                                                "physicalPath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Physical path."
+                                                  }
+                                                },
+                                                "virtualPath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Path to virtual application."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Virtual directories for virtual application."
+                                            }
+                                          },
+                                          "virtualPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Virtual path."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual applications."
+                                      }
+                                    },
+                                    "vnetName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual Network name."
+                                      }
+                                    },
+                                    "vnetPrivatePortsCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of private ports assigned to this app. These will be assigned dynamically on runtime."
+                                      }
+                                    },
+                                    "vnetRouteAllEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+                                      }
+                                    },
+                                    "websiteTimeZone": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Sets the time zone a site uses for generating timestamps. Compatible with Linux and Windows App Service. Setting the WEBSITE_TIME_ZONE app setting takes precedence over this config. For Linux, expects tz database values https://www.iana.org/time-zones (for a quick reference see [ref](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)). For Windows, expects one of the time zones listed under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones."
+                                      }
+                                    },
+                                    "webSocketsEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if WebSocket is enabled."
+                                      }
+                                    },
+                                    "windowsFxVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Xenon App Framework and version."
+                                      }
+                                    },
+                                    "xManagedServiceIdentityId": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Explicit Managed Service Identity Id."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a web configuration."
+                              }
+                            },
+                            "slowRequestBasedTriggerType": {
+                              "type": "object",
+                              "properties": {
+                                "count": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Count."
+                                  }
+                                },
+                                "path": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Path."
+                                  }
+                                },
+                                "timeInterval": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time interval."
+                                  }
+                                },
+                                "timeTaken": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time taken."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of aslow request based trigger."
+                              }
+                            },
+                            "scmIpSecurityRestrictionType": {
+                              "type": "object",
+                              "properties": {
+                                "action": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Allow",
+                                    "Deny"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Allow or Deny access for this IP range."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule description."
+                                  }
+                                },
+                                "headers": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "metadata": {
+                                      "description": "Required. A header."
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule headers.\nX-Forwarded-Host (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), all hosts(or lack of) are allowed.\n- A value is compared using ordinal-ignore-case (excluding port number).\n- Subdomain wildcards are permitted but don't match the root domain. For example, *.contoso.com matches the subdomain foo.contoso.com\nbut not the root domain contoso.com or multi-level foo.bar.contoso.com\n- Unicode host names are allowed but are converted to Punycode for matching.\n\nX-Forwarded-For (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), any forwarded-for chains (or lack of) are allowed.\n- If any address (excluding port number) in the chain (comma separated) matches the CIDR defined by the property.\n\nX-Azure-FDID and X-FD-HealthProbe.\nThe matching logic is exact match."
+                                  }
+                                },
+                                "ipAddress": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP address the security restriction is valid for. It can be in form of pure ipv4 address (required SubnetMask property) or CIDR notation such as ipv4/mask (leading bit match). For CIDR, SubnetMask property must not be specified."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule name."
+                                  }
+                                },
+                                "priority": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Priority of IP restriction rule."
+                                  }
+                                },
+                                "subnetMask": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Subnet mask for the range of IP addresses the restriction is valid for."
+                                  }
+                                },
+                                "subnetTrafficTag": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. (internal) Subnet traffic tag."
+                                  }
+                                },
+                                "tag": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Default",
+                                    "ServiceTag",
+                                    "XffProxy"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Defines what this IP filter will be used for. This is to support IP filtering on proxies."
+                                  }
+                                },
+                                "vnetSubnetResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Virtual network resource id."
+                                  }
+                                },
+                                "vnetTrafficTag": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. (internal) Vnet traffic tag."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a IP security restriction."
+                              }
+                            },
+                            "basicPublishingCredentialsPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "ftp",
+                                    "scm"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The name of the resource."
+                                  }
+                                },
+                                "allow": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location for all Resources."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a basic publishing credential policy."
+                              }
+                            },
+                            "hybridConnectionRelayType": {
+                              "type": "object",
+                              "properties": {
+                                "hybridConnectionResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                  }
+                                },
+                                "sendKeyName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the authorization rule send key to use."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a hybrid connection relay."
+                              }
+                            },
+                            "hostNameBindingType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hostname in the hostname binding. Defaults to the host name of the app/slot if not specified."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "azureResourceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure resource name."
+                                  }
+                                },
+                                "azureResourceType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "TrafficManager",
+                                    "Website"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                  }
+                                },
+                                "customHostNameDnsRecordType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "A",
+                                    "CName"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                  }
+                                },
+                                "domainResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Fully qualified ARM domain resource URI."
+                                  }
+                                },
+                                "hostNameType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Managed",
+                                    "Verified"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                  }
+                                },
+                                "siteName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. App Service app name."
+                                  }
+                                },
+                                "sslState": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "IpBasedEnabled",
+                                    "SniEnabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                  }
+                                },
+                                "thumbprint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. SSL certificate thumbprint."
+                                  }
+                                },
+                                "certificate": {
+                                  "$ref": "#/definitions/certificateType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate creation properties. If specified, a certificate will be created and used for this hostname binding."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a host name binding."
+                              }
+                            },
+                            "_1.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "certificateType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Certificate name."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource location."
+                                  }
+                                },
+                                "hostNames": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate host names."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault resource ID."
+                                  }
+                                },
+                                "keyVaultSecretName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault secret name."
+                                  }
+                                },
+                                "serverFarmResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Server farm resource ID."
+                                  }
+                                },
+                                "canonicalName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                  }
+                                },
+                                "password": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate password."
+                                  }
+                                },
+                                "pfxBlob": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate data in PFX format."
+                                  }
+                                },
+                                "domainValidationMethod": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Method of domain validation for free certificate."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a certificate.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "../modules/certificate.bicep"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "privateEndpointSingleServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private Endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the Private Endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the slot."
+                              }
+                            },
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "allowedValues": [
+                                "functionapp",
+                                "functionapp,linux",
+                                "functionapp,workflowapp",
+                                "functionapp,workflowapp,linux",
+                                "functionapp,linux,container",
+                                "functionapp,linux,container,azurecontainerapps",
+                                "app,linux",
+                                "app",
+                                "linux,api",
+                                "api",
+                                "app,linux,container",
+                                "app,container,windows"
+                              ],
+                              "metadata": {
+                                "description": "Required. Type of site to deploy."
+                              }
+                            },
+                            "serverFarmResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the app service plan to use for the slot."
+                              }
+                            },
+                            "managedEnvironmentResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                              }
+                            },
+                            "httpsOnly": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
+                              }
+                            },
+                            "clientAffinityEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. If client affinity is enabled."
+                              }
+                            },
+                            "clientAffinityProxyEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance. Default is true."
+                              }
+                            },
+                            "clientAffinityPartitioningEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. To enable client affinity partitioning using CHIPS cookies, this will add the partitioned property to the affinity cookies; false to stop sending partitioned affinity cookies. Default is false."
+                              }
+                            },
+                            "appServiceEnvironmentResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the app service environment to use for this resource."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "keyVaultAccessIdentityResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                              }
+                            },
+                            "storageAccountRequired": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Checks if Customer provided storage account is required."
+                              }
+                            },
+                            "virtualNetworkSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                              }
+                            },
+                            "siteConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/siteConfig"
+                                },
+                                "description": "Optional. The site config object."
+                              },
+                              "defaultValue": {
+                                "alwaysOn": true
+                              }
+                            },
+                            "functionAppConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/functionAppConfig"
+                                },
+                                "description": "Optional. The Function App config object."
+                              },
+                              "nullable": true
+                            },
+                            "configs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/configType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The web site config."
+                              }
+                            },
+                            "extensions": {
+                              "type": "array",
+                              "items": {
+                                "type": "object"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The extensions configuration."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointSingleServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "clientCertEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                              }
+                            },
+                            "clientCertExclusionPaths": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                              }
+                            },
+                            "clientCertMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/clientCertMode"
+                                },
+                                "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
+                              },
+                              "defaultValue": "Optional"
+                            },
+                            "cloningInfo": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/cloningInfo"
+                                },
+                                "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                              },
+                              "nullable": true
+                            },
+                            "containerSize": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Size of the function container."
+                              }
+                            },
+                            "customDomainVerificationId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                              }
+                            },
+                            "dailyMemoryTimeQuota": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                              }
+                            },
+                            "enabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                              }
+                            },
+                            "hostNameSslStates": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/hostNameSslStates"
+                                },
+                                "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                              },
+                              "nullable": true
+                            },
+                            "hyperV": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Hyper-V sandbox."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                                },
+                                "description": "Optional. Allow or block all public traffic."
+                              },
+                              "nullable": true
+                            },
+                            "redundancyMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/redundancyMode"
+                                },
+                                "description": "Optional. Site redundancy mode."
+                              },
+                              "defaultValue": "None"
+                            },
+                            "basicPublishingCredentialsPolicies": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The site publishing credential policy names which are associated with the site slot."
+                              }
+                            },
+                            "outboundVnetRouting": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                                },
+                                "description": "Optional. The outbound VNET routing configuration for the site."
+                              },
+                              "nullable": true
+                            },
+                            "hybridConnectionRelays": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hybridConnectionRelayType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Names of hybrid connection relays to connect app with."
+                              }
+                            },
+                            "hostNameBindings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hostNameBindingType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Host Name Bindings for the slot."
+                              }
+                            },
+                            "dnsConfiguration": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/dnsConfiguration"
+                                },
+                                "description": "Optional. Property to configure various DNS related settings for a site."
+                              },
+                              "nullable": true
+                            },
+                            "autoGeneratedDomainNameLabelScope": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                                },
+                                "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                              },
+                              "nullable": true
+                            },
+                            "sshEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Whether to enable SSH access."
+                              }
+                            },
+                            "daprConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/daprConfig"
+                                },
+                                "description": "Optional. Dapr configuration of the app."
+                              },
+                              "nullable": true
+                            },
+                            "ipMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/ipMode"
+                                },
+                                "description": "Optional. Specifies the IP mode of the app."
+                              },
+                              "nullable": true
+                            },
+                            "resourceConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/resourceConfig"
+                                },
+                                "description": "Optional. Function app resource requirements."
+                              },
+                              "nullable": true
+                            },
+                            "workloadProfileName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Workload profile name for function app to execute on."
+                              }
+                            },
+                            "hostNamesDisabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                              }
+                            },
+                            "reserved": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                              }
+                            },
+                            "scmSiteAlsoStopped": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                              }
+                            },
+                            "e2eEncryptionEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. End to End Encryption Setting."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                              "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                              "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                            },
+                            "managedEnvironmentSupportedKinds": [
+                              "functionapp,linux,container,azurecontainerapps"
+                            ]
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-siteslot.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2025-03-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "slot": {
+                              "type": "Microsoft.Web/sites/slots",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "kind": "[parameters('kind')]",
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "properties": {
+                                "managedEnvironmentId": "[if(not(empty(parameters('managedEnvironmentResourceId'))), parameters('managedEnvironmentResourceId'), null())]",
+                                "serverFarmId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), or(not(empty(reference('app').managedEnvironmentId)), not(empty(parameters('managedEnvironmentResourceId'))))), null(), parameters('serverFarmResourceId'))]",
+                                "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
+                                "clientAffinityProxyEnabled": "[parameters('clientAffinityProxyEnabled')]",
+                                "clientAffinityPartitioningEnabled": "[parameters('clientAffinityPartitioningEnabled')]",
+                                "httpsOnly": "[parameters('httpsOnly')]",
+                                "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                                "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                                "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                                "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]",
+                                "siteConfig": "[parameters('siteConfig')]",
+                                "functionAppConfig": "[parameters('functionAppConfig')]",
+                                "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                                "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                                "clientCertMode": "[parameters('clientCertMode')]",
+                                "cloningInfo": "[parameters('cloningInfo')]",
+                                "containerSize": "[parameters('containerSize')]",
+                                "customDomainVerificationId": "[parameters('customDomainVerificationId')]",
+                                "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                                "enabled": "[parameters('enabled')]",
+                                "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                                "hyperV": "[parameters('hyperV')]",
+                                "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                                "redundancyMode": "[parameters('redundancyMode')]",
+                                "dnsConfiguration": "[parameters('dnsConfiguration')]",
+                                "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                                "outboundVnetRouting": "[parameters('outboundVnetRouting')]",
+                                "sshEnabled": "[parameters('sshEnabled')]",
+                                "daprConfig": "[parameters('daprConfig')]",
+                                "ipMode": "[parameters('ipMode')]",
+                                "resourceConfig": "[parameters('resourceConfig')]",
+                                "workloadProfileName": "[parameters('workloadProfileName')]",
+                                "hostNamesDisabled": "[parameters('hostNamesDisabled')]",
+                                "reserved": "[parameters('reserved')]",
+                                "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
+                                "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]"
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "slot_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_diagnosticSettings": {
+                              "copy": {
+                                "name": "slot_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_roleAssignments": {
+                              "copy": {
+                                "name": "slot_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_basicPublishingCredentialsPolicies": {
+                              "copy": {
+                                "name": "slot_basicPublishingCredentialsPolicies",
+                                "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                                  },
+                                  "allow": {
+                                    "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "11365254968018384105"
+                                    },
+                                    "name": "Web Site Slot Basic Publishing Credentials Policies",
+                                    "description": "This module deploys a Web Site Slot Basic Publishing Credentials Policy."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "scm",
+                                        "ftp"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The name of the resource."
+                                      }
+                                    },
+                                    "allow": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                      }
+                                    },
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-slotbasicpubcredpolicy.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "properties": {
+                                        "allow": "[parameters('allow')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the basic publishing credential policy."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the basic publishing credential policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference(resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name')), '2025-03-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_hybridConnectionRelays": {
+                              "copy": {
+                                "name": "slot_hybridConnectionRelays",
+                                "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "hybridConnectionResourceId": {
+                                    "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].hybridConnectionResourceId]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "sendKeyName": {
+                                    "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "8029912709642202991"
+                                    },
+                                    "name": "Web/Function Apps Slot Hybrid Connection Relay",
+                                    "description": "This module deploys a Site Slot Hybrid Connection Namespace Relay."
+                                  },
+                                  "parameters": {
+                                    "hybridConnectionResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "sendKeyName": {
+                                      "type": "string",
+                                      "defaultValue": "defaultSender",
+                                      "metadata": {
+                                        "description": "Optional. Name of the authorization rule send key to use."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-slothybconnnamespacerelay.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                      "properties": {
+                                        "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                                        "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                                        "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                                        "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                        "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[0]]",
+                                        "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[1])]",
+                                        "sendKeyName": "[parameters('sendKeyName')]",
+                                        "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2024-01-01').primaryKey]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the hybrid connection relay.."
+                                      },
+                                      "value": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the hybrid connection relay."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[3])]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the resource was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_hostNameBindings": {
+                              "copy": {
+                                "name": "slot_hostNameBindings",
+                                "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-HostNameBinding-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'name'), reference('slot').defaultHostName)]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "kind": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'kind')]"
+                                  },
+                                  "azureResourceName": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceName')]"
+                                  },
+                                  "azureResourceType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceType')]"
+                                  },
+                                  "customHostNameDnsRecordType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'customHostNameDnsRecordType')]"
+                                  },
+                                  "domainResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'domainResourceId')]"
+                                  },
+                                  "hostNameType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'hostNameType')]"
+                                  },
+                                  "siteName": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'siteName')]"
+                                  },
+                                  "sslState": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'sslState')]"
+                                  },
+                                  "thumbprint": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'thumbprint')]"
+                                  },
+                                  "certificate": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'certificate')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "16648305975161016120"
+                                    },
+                                    "name": "Web/Function Apps Slot Host Name Bindings",
+                                    "description": "This module deploys a Site Slot Host Name Binding."
+                                  },
+                                  "definitions": {
+                                    "certificateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Certificate name."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource location."
+                                          }
+                                        },
+                                        "hostNames": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate host names."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault resource ID."
+                                          }
+                                        },
+                                        "keyVaultSecretName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault secret name."
+                                          }
+                                        },
+                                        "serverFarmResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Server farm resource ID."
+                                          }
+                                        },
+                                        "canonicalName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                          }
+                                        },
+                                        "password": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate password."
+                                          }
+                                        },
+                                        "pfxBlob": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate data in PFX format."
+                                          }
+                                        },
+                                        "domainValidationMethod": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Method of domain validation for free certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a certificate.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "../../modules/certificate.bicep"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Hostname in the hostname binding."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Kind of resource."
+                                      }
+                                    },
+                                    "azureResourceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure resource name."
+                                      }
+                                    },
+                                    "azureResourceType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Website",
+                                        "TrafficManager"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                      }
+                                    },
+                                    "customHostNameDnsRecordType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "CName",
+                                        "A"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                      }
+                                    },
+                                    "domainResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Fully qualified ARM domain resource URI."
+                                      }
+                                    },
+                                    "hostNameType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Verified",
+                                        "Managed"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                      }
+                                    },
+                                    "siteName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. App Service app name."
+                                      }
+                                    },
+                                    "sslState": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "SniEnabled",
+                                        "IpBasedEnabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                      }
+                                    },
+                                    "thumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SSL certificate thumbprint."
+                                      }
+                                    },
+                                    "certificate": {
+                                      "$ref": "#/definitions/certificateType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate object with properties for certificate creation. The expected structure matches the certificateType defined in host-name-binding-type.bicep."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Resource location."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "app::slot": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites/slots",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "hostNameBinding": {
+                                      "type": "Microsoft.Web/sites/slots/hostNameBindings",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                      "kind": "[parameters('kind')]",
+                                      "properties": {
+                                        "azureResourceName": "[parameters('azureResourceName')]",
+                                        "azureResourceType": "[parameters('azureResourceType')]",
+                                        "customHostNameDnsRecordType": "[parameters('customHostNameDnsRecordType')]",
+                                        "domainId": "[parameters('domainResourceId')]",
+                                        "hostNameType": "[parameters('hostNameType')]",
+                                        "siteName": "[parameters('siteName')]",
+                                        "sslState": "[coalesce(parameters('sslState'), if(or(not(empty(parameters('thumbprint'))), not(empty(parameters('certificate')))), 'SniEnabled', null()))]",
+                                        "thumbprint": "[coalesce(parameters('thumbprint'), tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value'))]"
+                                      },
+                                      "dependsOn": [
+                                        "sslCertificate"
+                                      ]
+                                    },
+                                    "sslCertificate": {
+                                      "condition": "[not(empty(parameters('certificate')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Cert', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', replace(parameters('name'), '.', '-')))]"
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "kind": {
+                                            "value": "[parameters('kind')]"
+                                          },
+                                          "hostNames": {
+                                            "value": "[coalesce(tryGet(parameters('certificate'), 'hostNames'), createArray(parameters('name')))]"
+                                          },
+                                          "password": {
+                                            "value": "[tryGet(parameters('certificate'), 'password')]"
+                                          },
+                                          "pfxBlob": {
+                                            "value": "[tryGet(parameters('certificate'), 'pfxBlob')]"
+                                          },
+                                          "serverFarmResourceId": {
+                                            "value": "[tryGet(parameters('certificate'), 'serverFarmResourceId')]"
+                                          },
+                                          "keyVaultResourceId": {
+                                            "value": "[tryGet(parameters('certificate'), 'keyVaultResourceId')]"
+                                          },
+                                          "keyVaultSecretName": {
+                                            "value": "[tryGet(parameters('certificate'), 'keyVaultSecretName')]"
+                                          },
+                                          "canonicalName": {
+                                            "value": "[tryGet(parameters('certificate'), 'canonicalName')]"
+                                          },
+                                          "domainValidationMethod": {
+                                            "value": "[tryGet(parameters('certificate'), 'domainValidationMethod')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "5581960621773069173"
+                                            },
+                                            "name": "Web/Function Apps Certificates",
+                                            "description": "This module deploys a Web/Function App Certificate."
+                                          },
+                                          "definitions": {
+                                            "certificateType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. Certificate name."
+                                                  }
+                                                },
+                                                "location": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource location."
+                                                  }
+                                                },
+                                                "hostNames": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate host names."
+                                                  }
+                                                },
+                                                "tags": {
+                                                  "type": "object",
+                                                  "metadata": {
+                                                    "__bicep_resource_derived_type!": {
+                                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                    },
+                                                    "description": "Optional. Tags of the resource."
+                                                  },
+                                                  "nullable": true
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Kind of resource."
+                                                  }
+                                                },
+                                                "keyVaultResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault resource ID."
+                                                  }
+                                                },
+                                                "keyVaultSecretName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault secret name."
+                                                  }
+                                                },
+                                                "serverFarmResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Server farm resource ID."
+                                                  }
+                                                },
+                                                "canonicalName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                  }
+                                                },
+                                                "password": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate password."
+                                                  }
+                                                },
+                                                "pfxBlob": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate data in PFX format."
+                                                  }
+                                                },
+                                                "domainValidationMethod": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Method of domain validation for free certificate."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a certificate."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Certificate name."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Resource location."
+                                              }
+                                            },
+                                            "hostNames": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate host names."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                },
+                                                "description": "Optional. Tags of the resource."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "kind": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Kind of resource."
+                                              }
+                                            },
+                                            "keyVaultResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key Vault resource ID."
+                                              }
+                                            },
+                                            "keyVaultSecretName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key Vault secret name."
+                                              }
+                                            },
+                                            "serverFarmResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Server farm resource ID."
+                                              }
+                                            },
+                                            "canonicalName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                              }
+                                            },
+                                            "password": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate password."
+                                              }
+                                            },
+                                            "pfxBlob": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate data in PFX format."
+                                              }
+                                            },
+                                            "domainValidationMethod": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Method of domain validation for free certificate."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "certificate": {
+                                              "type": "Microsoft.Web/certificates",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "kind": "[parameters('kind')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "hostNames": "[parameters('hostNames')]",
+                                                "password": "[parameters('password')]",
+                                                "pfxBlob": "[parameters('pfxBlob')]",
+                                                "serverFarmId": "[parameters('serverFarmResourceId')]",
+                                                "keyVaultId": "[parameters('keyVaultResourceId')]",
+                                                "keyVaultSecretName": "[parameters('keyVaultSecretName')]",
+                                                "canonicalName": "[parameters('canonicalName')]",
+                                                "domainValidationMethod": "[parameters('domainValidationMethod')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the certificate."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/certificates', parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the certificate was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the certificate."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "thumbprint": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The thumbprint of the certificate."
+                                              },
+                                              "value": "[reference('certificate').thumbprint]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('certificate', '2024-11-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the host name binding."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the host name binding."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/hostNameBindings', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the resource was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "certificateThumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The thumbprint of the certificate."
+                                      },
+                                      "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value')]"
+                                    },
+                                    "certificateResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The resource ID of the certificate."
+                                      },
+                                      "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'resourceId'), 'value')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_config": {
+                              "copy": {
+                                "name": "slot_config",
+                                "count": "[length(coalesce(parameters('configs'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "applicationInsightResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                                  },
+                                  "properties": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                                  },
+                                  "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]",
+                                  "storageAccountResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountResourceId')]"
+                                  },
+                                  "storageAccountUseIdentityAuthentication": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "12001043390442225147"
+                                    },
+                                    "name": "Site App Settings",
+                                    "description": "This module deploys a Site App Setting."
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "appsettings",
+                                        "authsettings",
+                                        "authsettingsV2",
+                                        "azurestorageaccounts",
+                                        "backup",
+                                        "connectionstrings",
+                                        "logs",
+                                        "metadata",
+                                        "pushsettings",
+                                        "web"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The name of the config."
+                                      }
+                                    },
+                                    "properties": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. The properties of the config. Note: This parameter is highly dependent on the config type, defined by its name."
+                                      }
+                                    },
+                                    "currentAppSettings": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The key-values pairs of the current app settings."
+                                        }
+                                      },
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. The current app settings."
+                                      }
+                                    },
+                                    "storageAccountUseIdentityAuthentication": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                      }
+                                    },
+                                    "storageAccountResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                      }
+                                    },
+                                    "applicationInsightResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "app::slot": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites/slots",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-slotconfig.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "applicationInsights": {
+                                      "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.Insights/components",
+                                      "apiVersion": "2020-02-02",
+                                      "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
+                                      "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
+                                    },
+                                    "storageAccount": {
+                                      "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-01-01",
+                                      "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                                      "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "config": {
+                                      "type": "Microsoft.Web/sites/slots/config",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                      "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys('storageAccount', '2025-01-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/')), 'AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob, 'AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue, 'AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table), createObject())), if(not(empty(parameters('applicationInsightResourceId'))), shallowMerge(createArray(createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), if(not(contains(parameters('properties'), 'ApplicationInsightsAgent_EXTENSION_VERSION')), createObject('ApplicationInsightsAgent_EXTENSION_VERSION', if(contains(createArray('functionapp,linux', 'functionapp,workflowapp,linux', 'functionapp,linux,container', 'functionapp,linux,container,azurecontainerapps', 'app,linux', 'linux,api', 'app,linux,container'), reference('app::slot', '2025-03-01', 'full').kind), '~3', '~2')), createObject()))), createObject()))]",
+                                      "dependsOn": [
+                                        "app::slot",
+                                        "applicationInsights",
+                                        "storageAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the site config."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the site config."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/config', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the site config was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "app_extensions": {
+                              "copy": {
+                                "name": "app_extensions",
+                                "count": "[length(coalesce(parameters('extensions'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-Extension={1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('extensions'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "kind": {
+                                    "value": "[tryGet(coalesce(parameters('extensions'), createArray())[copyIndex()], 'kind')]"
+                                  },
+                                  "properties": {
+                                    "value": "[coalesce(parameters('extensions'), createArray())[copyIndex()].properties]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "8496500083519229596"
+                                    },
+                                    "name": "Site Deployment Extension ",
+                                    "description": "This module deploys a Site extension for MSDeploy."
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "MSDeploy",
+                                      "allowedValues": [
+                                        "MSDeploy"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The name of the extension."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "defaultValue": "MSDeploy",
+                                      "allowedValues": [
+                                        "MSDeploy"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The kind of extension."
+                                      }
+                                    },
+                                    "properties": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/extensions@2024-04-01#properties/properties"
+                                        },
+                                        "description": "Optional. Sets the properties."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "app::slot": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites/slots",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-slotextension.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "msdeploy": {
+                                      "type": "Microsoft.Web/sites/slots/extensions",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                      "kind": "[parameters('kind')]",
+                                      "properties": "[parameters('properties')]"
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/extensions', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the extensino was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_privateEndpoints": {
+                              "copy": {
+                                "name": "slot_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-slot-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "18436885663402767850"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipVersionType": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                        },
+                                        "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                                      },
+                                      "defaultValue": "IPv4"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        },
+                                        "ipVersionType": "[parameters('ipVersionType')]"
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "9935179114830442414"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the slot."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the slot."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the slot was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('slot', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('slot', '2025-03-01', 'full').location]"
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the slot."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            },
+                            "hostNameBindings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hostNameBindingsOutputType"
+                              },
+                              "metadata": {
+                                "description": "The host name bindings of the slot."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "resourceGroupName": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.resourceGroupName.value]",
+                                  "certificateThumbprint": "[tryGet(tryGet(reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateThumbprint'), 'value')]",
+                                  "certificateResourceId": "[tryGet(tryGet(reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateResourceId'), 'value')]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_basicPublishingCredentialsPolicies": {
+                      "copy": {
+                        "name": "app_basicPublishingCredentialsPolicies",
+                        "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Site-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "webAppName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                          },
+                          "allow": {
+                            "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "14948693817081044849"
+                            },
+                            "name": "Web Site Basic Publishing Credentials Policies",
+                            "description": "This module deploys a Web Site Basic Publishing Credentials Policy."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "allowedValues": [
+                                "scm",
+                                "ftp"
+                              ],
+                              "metadata": {
+                                "description": "Required. The name of the resource."
+                              }
+                            },
+                            "allow": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Set to true to enable or false to disable a publishing method."
+                              }
+                            },
+                            "webAppName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-site-basicpublishingcredpolicy.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            {
+                              "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}', parameters('webAppName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "allow": "[parameters('allow')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the basic publishing credential policy."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the basic publishing credential policy."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference(resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name')), '2025-03-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_hybridConnectionRelays": {
+                      "copy": {
+                        "name": "app_hybridConnectionRelays",
+                        "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "hybridConnectionResourceId": {
+                            "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].hybridConnectionResourceId]"
+                          },
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "sendKeyName": {
+                            "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "16409478718621567661"
+                            },
+                            "name": "Web/Function Apps Hybrid Connection Relay",
+                            "description": "This module deploys a Site Hybrid Connection Namespace Relay."
+                          },
+                          "parameters": {
+                            "hybridConnectionResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the relay namespace hybrid connection."
+                              }
+                            },
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "sendKeyName": {
+                              "type": "string",
+                              "defaultValue": "defaultSender",
+                              "metadata": {
+                                "description": "Optional. Name of the authorization rule send key to use."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-site-hybconnnamespacerelay.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            {
+                              "type": "Microsoft.Web/sites/hybridConnectionNamespaces/relays",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                              "properties": {
+                                "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                                "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                                "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                                "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[0]]",
+                                "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[1])]",
+                                "sendKeyName": "[parameters('sendKeyName')]",
+                                "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2024-01-01').primaryKey]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the hybrid connection relay.."
+                              },
+                              "value": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the hybrid connection relay."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2])]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the resource was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_hostNameBindings": {
+                      "copy": {
+                        "name": "app_hostNameBindings",
+                        "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-HostNameBinding-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'name'), reference('app').defaultHostName)]"
+                          },
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "kind": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'kind')]"
+                          },
+                          "azureResourceName": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceName')]"
+                          },
+                          "azureResourceType": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceType')]"
+                          },
+                          "customHostNameDnsRecordType": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'customHostNameDnsRecordType')]"
+                          },
+                          "domainResourceId": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'domainResourceId')]"
+                          },
+                          "hostNameType": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'hostNameType')]"
+                          },
+                          "siteName": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'siteName')]"
+                          },
+                          "sslState": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'sslState')]"
+                          },
+                          "thumbprint": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'thumbprint')]"
+                          },
+                          "certificate": "[if(contains(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'certificate'), createObject('value', union(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()].certificate, createObject('serverFarmResourceId', coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()].certificate, 'serverFarmResourceId'), parameters('serverFarmResourceId'))))), createObject('value', null()))]",
+                          "location": {
+                            "value": "[parameters('location')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "3602988070549748557"
+                            },
+                            "name": "Web/Function Apps Slot Host Name Bindings",
+                            "description": "This module deploys a Site Slot Host Name Binding."
+                          },
+                          "definitions": {
+                            "certificateType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Certificate name."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource location."
+                                  }
+                                },
+                                "hostNames": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate host names."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault resource ID."
+                                  }
+                                },
+                                "keyVaultSecretName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault secret name."
+                                  }
+                                },
+                                "serverFarmResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Server farm resource ID."
+                                  }
+                                },
+                                "canonicalName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                  }
+                                },
+                                "password": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate password."
+                                  }
+                                },
+                                "pfxBlob": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate data in PFX format."
+                                  }
+                                },
+                                "domainValidationMethod": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Method of domain validation for free certificate."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a certificate.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "../modules/certificate.bicep"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Hostname in the hostname binding."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Kind of resource."
+                              }
+                            },
+                            "azureResourceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure resource name."
+                              }
+                            },
+                            "azureResourceType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Website",
+                                "TrafficManager"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                              }
+                            },
+                            "customHostNameDnsRecordType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "CName",
+                                "A"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                              }
+                            },
+                            "domainResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Fully qualified ARM domain resource URI."
+                              }
+                            },
+                            "hostNameType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Verified",
+                                "Managed"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                              }
+                            },
+                            "siteName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. App Service app name."
+                              }
+                            },
+                            "sslState": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Disabled",
+                                "SniEnabled",
+                                "IpBasedEnabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                              }
+                            },
+                            "thumbprint": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. SSL certificate thumbprint."
+                              }
+                            },
+                            "certificate": {
+                              "$ref": "#/definitions/certificateType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Certificate object with properties for certificate creation. The expected structure matches the certificateType defined in host-name-binding-type.bicep."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Resource location."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "hostNameBinding": {
+                              "type": "Microsoft.Web/sites/hostNameBindings",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                              "kind": "[parameters('kind')]",
+                              "properties": {
+                                "azureResourceName": "[parameters('azureResourceName')]",
+                                "azureResourceType": "[parameters('azureResourceType')]",
+                                "customHostNameDnsRecordType": "[parameters('customHostNameDnsRecordType')]",
+                                "domainId": "[parameters('domainResourceId')]",
+                                "hostNameType": "[parameters('hostNameType')]",
+                                "siteName": "[parameters('siteName')]",
+                                "sslState": "[coalesce(parameters('sslState'), if(or(not(empty(parameters('thumbprint'))), not(empty(parameters('certificate')))), 'SniEnabled', null()))]",
+                                "thumbprint": "[coalesce(parameters('thumbprint'), tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value'))]"
+                              },
+                              "dependsOn": [
+                                "sslCertificate"
+                              ]
+                            },
+                            "sslCertificate": {
+                              "condition": "[not(empty(parameters('certificate')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Cert', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', replace(parameters('name'), '.', '-')))]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "kind": {
+                                    "value": "[parameters('kind')]"
+                                  },
+                                  "hostNames": {
+                                    "value": "[coalesce(tryGet(parameters('certificate'), 'hostNames'), createArray(parameters('name')))]"
+                                  },
+                                  "password": {
+                                    "value": "[tryGet(parameters('certificate'), 'password')]"
+                                  },
+                                  "pfxBlob": {
+                                    "value": "[tryGet(parameters('certificate'), 'pfxBlob')]"
+                                  },
+                                  "serverFarmResourceId": {
+                                    "value": "[tryGet(parameters('certificate'), 'serverFarmResourceId')]"
+                                  },
+                                  "keyVaultResourceId": {
+                                    "value": "[tryGet(parameters('certificate'), 'keyVaultResourceId')]"
+                                  },
+                                  "keyVaultSecretName": {
+                                    "value": "[tryGet(parameters('certificate'), 'keyVaultSecretName')]"
+                                  },
+                                  "canonicalName": {
+                                    "value": "[tryGet(parameters('certificate'), 'canonicalName')]"
+                                  },
+                                  "domainValidationMethod": {
+                                    "value": "[tryGet(parameters('certificate'), 'domainValidationMethod')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "5581960621773069173"
+                                    },
+                                    "name": "Web/Function Apps Certificates",
+                                    "description": "This module deploys a Web/Function App Certificate."
+                                  },
+                                  "definitions": {
+                                    "certificateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Certificate name."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource location."
+                                          }
+                                        },
+                                        "hostNames": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate host names."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault resource ID."
+                                          }
+                                        },
+                                        "keyVaultSecretName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault secret name."
+                                          }
+                                        },
+                                        "serverFarmResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Server farm resource ID."
+                                          }
+                                        },
+                                        "canonicalName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                          }
+                                        },
+                                        "password": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate password."
+                                          }
+                                        },
+                                        "pfxBlob": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate data in PFX format."
+                                          }
+                                        },
+                                        "domainValidationMethod": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Method of domain validation for free certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a certificate."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Certificate name."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Resource location."
+                                      }
+                                    },
+                                    "hostNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate host names."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Kind of resource."
+                                      }
+                                    },
+                                    "keyVaultResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Key Vault resource ID."
+                                      }
+                                    },
+                                    "keyVaultSecretName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Key Vault secret name."
+                                      }
+                                    },
+                                    "serverFarmResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Server farm resource ID."
+                                      }
+                                    },
+                                    "canonicalName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                      }
+                                    },
+                                    "password": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate password."
+                                      }
+                                    },
+                                    "pfxBlob": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate data in PFX format."
+                                      }
+                                    },
+                                    "domainValidationMethod": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Method of domain validation for free certificate."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "certificate": {
+                                      "type": "Microsoft.Web/certificates",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "kind": "[parameters('kind')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "hostNames": "[parameters('hostNames')]",
+                                        "password": "[parameters('password')]",
+                                        "pfxBlob": "[parameters('pfxBlob')]",
+                                        "serverFarmId": "[parameters('serverFarmResourceId')]",
+                                        "keyVaultId": "[parameters('keyVaultResourceId')]",
+                                        "keyVaultSecretName": "[parameters('keyVaultSecretName')]",
+                                        "canonicalName": "[parameters('canonicalName')]",
+                                        "domainValidationMethod": "[parameters('domainValidationMethod')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the certificate."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/certificates', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the certificate was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the certificate."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "thumbprint": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The thumbprint of the certificate."
+                                      },
+                                      "value": "[reference('certificate').thumbprint]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('certificate', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the host name binding."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the host name binding."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/hostNameBindings', parameters('appName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the resource was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "certificateThumbprint": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The thumbprint of the certificate."
+                              },
+                              "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value')]"
+                            },
+                            "certificateResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The resource ID of the certificate."
+                              },
+                              "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'resourceId'), 'value')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_privateEndpoints": {
+                      "copy": {
+                        "name": "app_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-app-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "18436885663402767850"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private dns zone group."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a private DNS zone group configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                },
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              },
+                              "nullable": true
+                            },
+                            "ipVersionType": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                },
+                                "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                              },
+                              "defaultValue": "IPv4"
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                },
+                                "description": "Optional. Custom DNS configurations."
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                },
+                                "ipVersionType": "[parameters('ipVersionType')]"
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "9935179114830442414"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private DNS zone group configuration."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "privateDnsZoneConfigs",
+                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "properties": {
+                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                              }
+                                            }
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                  "output": true
+                                },
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the site."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the site."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the site was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('app', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('app', '2025-03-01', 'full').location]"
+                    },
+                    "defaultHostname": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Default hostname of the app."
+                      },
+                      "value": "[reference('app').defaultHostName]"
+                    },
+                    "customDomainVerificationId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                      },
+                      "value": "[reference('app').customDomainVerificationId]"
+                    },
+                    "outboundIpAddresses": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The outbound IP addresses of the app."
+                      },
+                      "value": "[reference('app').outboundIpAddresses]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the site."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    },
+                    "slots": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "The name of the slot."
+                            }
+                          },
+                          "resourceId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "The resource ID of the slot."
+                            }
+                          },
+                          "systemAssignedMIPrincipalId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "The principal ID of the system assigned identity of the slot."
+                            }
+                          },
+                          "privateEndpoints": {
+                            "type": "array",
+                            "items": {
+                              "$ref": "#/definitions/privateEndpointOutputType"
+                            },
+                            "metadata": {
+                              "description": "The private endpoints of the slot."
+                            }
+                          },
+                          "hostNameBindings": {
+                            "type": "array",
+                            "items": {
+                              "$ref": "#/definitions/hostNameBindingsOutputType"
+                            },
+                            "metadata": {
+                              "description": "The host name bindings of the slot."
+                            }
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The slots of the site."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                        "input": {
+                          "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
+                          "resourceId": "[reference(format('app_slots[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "systemAssignedMIPrincipalId": "[coalesce(tryGet(tryGet(reference(format('app_slots[{0}]', copyIndex())).outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]",
+                          "privateEndpoints": "[reference(format('app_slots[{0}]', copyIndex())).outputs.privateEndpoints.value]",
+                          "hostNameBindings": "[reference(format('app_slots[{0}]', copyIndex())).outputs.hostNameBindings.value]"
+                        }
+                      }
+                    },
+                    "hostNameBindings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/hostNameBindingsOutputType"
+                      },
+                      "metadata": {
+                        "description": "The host name bindings of the site."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "resourceGroupName": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.resourceGroupName.value]",
+                          "certificateThumbprint": "[tryGet(tryGet(reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateThumbprint'), 'value')]",
+                          "certificateResourceId": "[tryGet(tryGet(reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateResourceId'), 'value')]"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service."
+              },
+              "value": "[reference('appService').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the App Service."
+              },
+              "value": "[reference('appService').outputs.name.value]"
+            },
+            "defaultHostname": {
+              "type": "string",
+              "metadata": {
+                "description": "Default hostname of the App Service."
+              },
+              "value": "[reference('appService').outputs.defaultHostname.value]"
+            },
+            "appUrl": {
+              "type": "string",
+              "metadata": {
+                "description": "URL of the App Service."
+              },
+              "value": "[format('https://{0}', reference('appService').outputs.defaultHostname.value)]"
+            },
+            "identityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID."
+              },
+              "value": "[coalesce(tryGet(tryGet(reference('appService').outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "ai_foundry_project",
+        "ai_search",
+        "app_insights",
+        "cosmosDBModule",
+        "existing_project_setup",
+        "foundry_search_connection",
+        "hostingplan",
+        "log_analytics",
+        "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').webApp)]",
+        "sqlDBModule",
+        "storage_account",
+        "virtualNetwork"
+      ]
+    },
+    "frontend_docker": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[format('app-{0}', variables('solutionSuffix'))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[union(parameters('tags'), createObject('azd-service-name', 'webapp'))]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "serverFarmResourceId": {
+            "value": "[reference('hostingplan').outputs.resourceId.value]"
+          },
+          "kind": {
+            "value": "[parameters('kind')]"
+          },
+          "linuxFxVersion": {
+            "value": "[variables('placeholderImageName')]"
+          },
+          "vnetRouteAllEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+          "imagePullTraffic": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+          "contentShareTraffic": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+          "virtualNetworkSubnetId": "[if(parameters('enablePrivateNetworking'), createObject('value', reference('virtualNetwork').outputs.webserverfarmSubnetResourceId.value), createObject('value', ''))]",
+          "publicNetworkAccess": {
+            "value": "Enabled"
+          },
+          "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+          "managedIdentities": {
+            "value": {
+              "systemAssigned": true
+            }
+          },
+          "acrUseManagedIdentityCreds": {
+            "value": true
+          },
+          "appSettings": {
+            "value": {
+              "WEBSITES_PORT": "80",
+              "APPLICATIONINSIGHTS_CONNECTION_STRING": "[if(parameters('enableMonitoring'), reference('app_insights').outputs.connectionString.value, '')]",
+              "APP_API_BASE_URL": "[if(parameters('enablePrivateNetworking'), '', format('https://api-{0}.azurewebsites.net', variables('solutionSuffix')))]",
+              "BACKEND_API_HOST": "[if(parameters('enablePrivateNetworking'), format('api-{0}.azurewebsites.net', variables('solutionSuffix')), '')]"
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "7275312158093319855"
+            }
+          },
+          "definitions": {
+            "_1.lockType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the name of lock."
+                  }
+                },
+                "kind": {
+                  "type": "string",
+                  "allowedValues": [
+                    "CanNotDelete",
+                    "None",
+                    "ReadOnly"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a lock.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointCustomDnsConfigType": {
+              "type": "object",
+              "properties": {
+                "fqdn": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                  }
+                },
+                "ipAddresses": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "metadata": {
+                    "description": "Required. A list of private IP addresses of the private endpoint."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointIpConfigurationType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The name of the resource that is unique within a resource group."
+                  }
+                },
+                "properties": {
+                  "type": "object",
+                  "properties": {
+                    "groupId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "memberName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                      }
+                    },
+                    "privateIPAddress": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. Properties of private endpoint IP configurations."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.privateEndpointPrivateDnsZoneGroupType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private DNS Zone Group."
+                  }
+                },
+                "privateDnsZoneGroupConfigs": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "name": {
+                        "type": "string",
+                        "nullable": true,
+                        "metadata": {
+                          "description": "Optional. The name of the private DNS Zone Group config."
+                        }
+                      },
+                      "privateDnsZoneResourceId": {
+                        "type": "string",
+                        "metadata": {
+                          "description": "Required. The resource id of the private DNS zone."
+                        }
+                      }
+                    }
+                  },
+                  "metadata": {
+                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                  }
+                }
+              },
+              "metadata": {
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "_1.roleAssignmentType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                  }
+                },
+                "roleDefinitionIdOrName": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                  }
+                },
+                "principalId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                  }
+                },
+                "principalType": {
+                  "type": "string",
+                  "allowedValues": [
+                    "Device",
+                    "ForeignGroup",
+                    "Group",
+                    "ServicePrincipal",
+                    "User"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The principal type of the assigned principal ID."
+                  }
+                },
+                "description": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The description of the role assignment."
+                  }
+                },
+                "condition": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                  }
+                },
+                "conditionVersion": {
+                  "type": "string",
+                  "allowedValues": [
+                    "2.0"
+                  ],
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Version of the condition."
+                  }
+                },
+                "delegatedManagedIdentityResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a role assignment.",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            },
+            "privateEndpointSingleServiceType": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the Private Endpoint."
+                  }
+                },
+                "location": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The location to deploy the Private Endpoint to."
+                  }
+                },
+                "privateLinkServiceConnectionName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The name of the private link connection to create."
+                  }
+                },
+                "service": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                  }
+                },
+                "subnetResourceId": {
+                  "type": "string",
+                  "metadata": {
+                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                  }
+                },
+                "resourceGroupResourceId": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                  }
+                },
+                "privateDnsZoneGroup": {
+                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                  }
+                },
+                "isManualConnection": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. If Manual Private Link Connection is required."
+                  }
+                },
+                "manualConnectionRequestMessage": {
+                  "type": "string",
+                  "nullable": true,
+                  "maxLength": 140,
+                  "metadata": {
+                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                  }
+                },
+                "customDnsConfigs": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Custom DNS configurations."
+                  }
+                },
+                "ipConfigurations": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                  }
+                },
+                "applicationSecurityGroupResourceIds": {
+                  "type": "array",
+                  "items": {
+                    "type": "string"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                  }
+                },
+                "customNetworkInterfaceName": {
+                  "type": "string",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                  }
+                },
+                "lock": {
+                  "$ref": "#/definitions/_1.lockType",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Specify the type of lock."
+                  }
+                },
+                "roleAssignments": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/definitions/_1.roleAssignmentType"
+                  },
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Array of role assignments to create."
+                  }
+                },
+                "tags": {
+                  "type": "object",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  }
+                },
+                "enableTelemetry": {
+                  "type": "bool",
+                  "nullable": true,
+                  "metadata": {
+                    "description": "Optional. Enable/Disable usage telemetry for module."
+                  }
+                }
+              },
+              "metadata": {
+                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                "__bicep_imported_from!": {
+                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                }
+              }
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[parameters('solutionName')]",
+              "metadata": {
+                "description": "Name of the App Service."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "serverFarmResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service Plan."
+              }
+            },
+            "linuxFxVersion": {
+              "type": "string",
+              "metadata": {
+                "description": "Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag)."
+              }
+            },
+            "appSettings": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Application settings key-value pairs."
+              }
+            },
+            "applicationInsightResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of Application Insights for monitoring integration."
+              }
+            },
+            "alwaysOn": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Whether to enable Always On."
+              }
+            },
+            "healthCheckPath": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Health check path for the app."
+              }
+            },
+            "webSocketsEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to enable WebSockets."
+              }
+            },
+            "appCommandLine": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Command line for the application."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "app,linux",
+              "allowedValues": [
+                "functionapp",
+                "functionapp,linux",
+                "functionapp,workflowapp",
+                "functionapp,workflowapp,linux",
+                "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
+                "app,linux",
+                "app",
+                "linux,api",
+                "api",
+                "app,linux,container",
+                "app,container,windows"
+              ],
+              "metadata": {
+                "description": "Required. Type of site to deploy."
+              }
+            },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Enable/Disable usage telemetry for module."
+              }
+            },
+            "diagnosticSettings": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Diagnostic settings for monitoring."
+              }
+            },
+            "virtualNetworkSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Subnet resource ID for VNet integration."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "acrUseManagedIdentityCreds": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether the app pulls its container image from ACR using its managed identity."
+              }
+            },
+            "acrUserManagedIdentityID": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Client ID of the user-assigned identity used for ACR image pulls (empty = system-assigned)."
+              }
+            },
+            "vnetRouteAllEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to route all outbound traffic through the virtual network."
+              }
+            },
+            "imagePullTraffic": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to route image pull traffic through the virtual network."
+              }
+            },
+            "contentShareTraffic": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to route content share traffic through the virtual network."
+              }
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "items": {
+                "$ref": "#/definitions/privateEndpointSingleServiceType"
+              },
+              "nullable": true,
+              "metadata": {
+                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+              }
+            },
+            "managedIdentities": {
+              "type": "object",
+              "defaultValue": {
+                "systemAssigned": true
+              },
+              "metadata": {
+                "description": "Optional. Managed identities for the resource."
+              }
+            }
+          },
+          "resources": {
+            "site": {
+              "existing": true,
+              "type": "Microsoft.Web/sites",
+              "apiVersion": "2025-03-01",
+              "name": "[parameters('name')]"
+            },
+            "logsConfig": {
+              "type": "Microsoft.Web/sites/config",
+              "apiVersion": "2025-03-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+              "properties": {
+                "applicationLogs": {
+                  "fileSystem": {
+                    "level": "Verbose"
+                  }
+                },
+                "detailedErrorMessages": {
+                  "enabled": true
+                },
+                "failedRequestsTracing": {
+                  "enabled": true
+                },
+                "httpLogs": {
+                  "fileSystem": {
+                    "enabled": true,
+                    "retentionInDays": 1,
+                    "retentionInMb": 35
+                  }
+                }
+              },
+              "dependsOn": [
+                "appService"
+              ]
+            },
+            "appService": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('avm.res.web.site.{0}', parameters('name')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "serverFarmResourceId": {
+                    "value": "[parameters('serverFarmResourceId')]"
+                  },
+                  "managedIdentities": {
+                    "value": "[parameters('managedIdentities')]"
+                  },
+                  "siteConfig": {
+                    "value": {
+                      "alwaysOn": "[parameters('alwaysOn')]",
+                      "ftpsState": "Disabled",
+                      "linuxFxVersion": "[parameters('linuxFxVersion')]",
+                      "minTlsVersion": "1.2",
+                      "healthCheckPath": "[if(not(empty(parameters('healthCheckPath'))), parameters('healthCheckPath'), null())]",
+                      "webSocketsEnabled": "[parameters('webSocketsEnabled')]",
+                      "appCommandLine": "[parameters('appCommandLine')]",
+                      "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]",
+                      "acrUseManagedIdentityCreds": "[parameters('acrUseManagedIdentityCreds')]",
+                      "acrUserManagedIdentityID": "[if(not(empty(parameters('acrUserManagedIdentityID'))), parameters('acrUserManagedIdentityID'), null())]"
+                    }
+                  },
+                  "e2eEncryptionEnabled": {
+                    "value": true
+                  },
+                  "configs": {
+                    "value": [
+                      {
+                        "name": "appsettings",
+                        "properties": "[parameters('appSettings')]",
+                        "applicationInsightResourceId": "[if(not(empty(parameters('applicationInsightResourceId'))), parameters('applicationInsightResourceId'), null())]"
+                      }
+                    ]
+                  },
+                  "outboundVnetRouting": {
+                    "value": {
+                      "contentShareTraffic": "[parameters('contentShareTraffic')]",
+                      "imagePullTraffic": "[parameters('imagePullTraffic')]"
+                    }
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "privateEndpoints": {
+                    "value": "[parameters('privateEndpoints')]"
+                  },
+                  "virtualNetworkSubnetResourceId": "[if(not(empty(parameters('virtualNetworkSubnetId'))), createObject('value', parameters('virtualNetworkSubnetId')), createObject('value', null()))]",
+                  "basicPublishingCredentialsPolicies": {
+                    "value": [
+                      {
+                        "name": "ftp",
+                        "allow": false
+                      },
+                      {
+                        "name": "scm",
+                        "allow": false
+                      }
+                    ]
+                  },
+                  "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.43.8.12551",
+                      "templateHash": "15230222474470713470"
+                    },
+                    "name": "Web/Function Apps",
+                    "description": "This module deploys a Web or Function App."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "configType": {
+                      "type": "object",
+                      "discriminator": {
+                        "propertyName": "name",
+                        "mapping": {
+                          "appsettings": {
+                            "$ref": "#/definitions/appSettingsConfigType"
+                          },
+                          "authsettings": {
+                            "$ref": "#/definitions/authSettingsConfigType"
+                          },
+                          "authsettingsV2": {
+                            "$ref": "#/definitions/authSettingsV2ConfigType"
+                          },
+                          "azurestorageaccounts": {
+                            "$ref": "#/definitions/azureStorageAccountConfigType"
+                          },
+                          "backup": {
+                            "$ref": "#/definitions/backupConfigType"
+                          },
+                          "connectionstrings": {
+                            "$ref": "#/definitions/connectionStringsConfigType"
+                          },
+                          "logs": {
+                            "$ref": "#/definitions/logsConfigType"
+                          },
+                          "metadata": {
+                            "$ref": "#/definitions/metadataConfigType"
+                          },
+                          "pushsettings": {
+                            "$ref": "#/definitions/pushSettingsConfigType"
+                          },
+                          "slotConfigNames": {
+                            "$ref": "#/definitions/slotConfigNamesConfigType"
+                          },
+                          "web": {
+                            "$ref": "#/definitions/webConfigType"
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a site configuration."
+                      }
+                    },
+                    "slotConfigNamesConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "slotConfigNames"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "appSettingNames": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of application settings names."
+                              }
+                            },
+                            "azureStorageConfigNames": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of external Azure storage account identifiers."
+                              }
+                            },
+                            "connectionStringNames": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of connection string names."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a slotConfigNames configuration."
+                      }
+                    },
+                    "slotType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the slot."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for all Resources."
+                          }
+                        },
+                        "serverFarmResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the app service plan to use for the slot."
+                          }
+                        },
+                        "managedEnvironmentResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                          }
+                        },
+                        "httpsOnly": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
+                          }
+                        },
+                        "clientAffinityEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If client affinity is enabled."
+                          }
+                        },
+                        "clientAffinityProxyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance."
+                          }
+                        },
+                        "clientAffinityPartitioningEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. To enable client affinity partitioning using CHIPS cookies."
+                          }
+                        },
+                        "appServiceEnvironmentResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the app service environment to use for this resource."
+                          }
+                        },
+                        "managedIdentities": {
+                          "$ref": "#/definitions/managedIdentityAllType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The managed identity definition for this resource."
+                          }
+                        },
+                        "keyVaultAccessIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                          }
+                        },
+                        "storageAccountRequired": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Checks if Customer provided storage account is required."
+                          }
+                        },
+                        "virtualNetworkSubnetResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                          }
+                        },
+                        "siteConfig": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/siteConfig"
+                            },
+                            "description": "Optional. The site config object."
+                          },
+                          "nullable": true
+                        },
+                        "functionAppConfig": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/functionAppConfig"
+                            },
+                            "description": "Optional. The Function App config object."
+                          },
+                          "nullable": true
+                        },
+                        "configs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/configType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The web site config."
+                          }
+                        },
+                        "extensions": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "metadata": {
+                              "__bicep_resource_derived_type!": {
+                                "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The extensions configuration."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The lock settings of the service."
+                          }
+                        },
+                        "privateEndpoints": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/privateEndpointSingleServiceType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Configuration details for private endpoints."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the service."
+                          }
+                        },
+                        "clientCertEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                          }
+                        },
+                        "clientCertExclusionPaths": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                          }
+                        },
+                        "clientCertMode": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/clientCertMode"
+                            },
+                            "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
+                          },
+                          "nullable": true
+                        },
+                        "cloningInfo": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/cloningInfo"
+                            },
+                            "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                          },
+                          "nullable": true
+                        },
+                        "containerSize": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Size of the function container."
+                          }
+                        },
+                        "customDomainVerificationId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                          }
+                        },
+                        "dailyMemoryTimeQuota": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                          }
+                        },
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                          }
+                        },
+                        "hostNameSslStates": {
+                          "type": "array",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/hostNameSslStates"
+                            },
+                            "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                          },
+                          "nullable": true
+                        },
+                        "hyperV": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Hyper-V sandbox."
+                          }
+                        },
+                        "publicNetworkAccess": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                            },
+                            "description": "Optional. Allow or block all public traffic."
+                          },
+                          "nullable": true
+                        },
+                        "redundancyMode": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/redundancyMode"
+                            },
+                            "description": "Optional. Site redundancy mode."
+                          },
+                          "nullable": true
+                        },
+                        "basicPublishingCredentialsPolicies": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The site publishing credential policy names which are associated with the site slot."
+                          }
+                        },
+                        "outboundVnetRouting": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                            },
+                            "description": "Optional. The outbound VNET routing configuration for the slot."
+                          },
+                          "nullable": true
+                        },
+                        "hybridConnectionRelays": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/hybridConnectionRelayType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Names of hybrid connection relays to connect app with."
+                          }
+                        },
+                        "hostNameBindings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/hostNameBindingType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host Name Bindings for the slot."
+                          }
+                        },
+                        "dnsConfiguration": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/dnsConfiguration"
+                            },
+                            "description": "Optional. Property to configure various DNS related settings for a site."
+                          },
+                          "nullable": true
+                        },
+                        "autoGeneratedDomainNameLabelScope": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                            },
+                            "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                          },
+                          "nullable": true
+                        },
+                        "sshEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether to enable SSH access."
+                          }
+                        },
+                        "daprConfig": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/daprConfig"
+                            },
+                            "description": "Optional. Dapr configuration of the app."
+                          },
+                          "nullable": true
+                        },
+                        "ipMode": {
+                          "type": "string",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/ipMode"
+                            },
+                            "description": "Optional. Specifies the IP mode of the app."
+                          },
+                          "nullable": true
+                        },
+                        "resourceConfig": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/resourceConfig"
+                            },
+                            "description": "Optional. Function app resource requirements."
+                          },
+                          "nullable": true
+                        },
+                        "workloadProfileName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Workload profile name for function app to execute on."
+                          }
+                        },
+                        "hostNamesDisabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                          }
+                        },
+                        "reserved": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                          }
+                        },
+                        "scmSiteAlsoStopped": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                          }
+                        },
+                        "e2eEncryptionEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. End to End Encryption Setting."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a slot."
+                      }
+                    },
+                    "extensionType": {
+                      "type": "object",
+                      "properties": {
+                        "properties": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                            },
+                            "description": "Optional. Sets the properties."
+                          },
+                          "nullable": true
+                        }
+                      }
+                    },
+                    "basicPublishingCredentialsPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "ftp",
+                            "scm"
+                          ],
+                          "metadata": {
+                            "description": "Required. The name of the resource."
+                          }
+                        },
+                        "allow": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Set to true to enable or false to disable a publishing method."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for all Resources."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a basic publishing credential policy."
+                      }
+                    },
+                    "hybridConnectionRelayType": {
+                      "type": "object",
+                      "properties": {
+                        "hybridConnectionResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the relay namespace hybrid connection."
+                          }
+                        },
+                        "sendKeyName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the authorization rule send key to use."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a hybrid connection relay."
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_2.certificateType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Certificate name."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource location."
+                          }
+                        },
+                        "hostNames": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Certificate host names."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                            },
+                            "description": "Optional. Tags of the resource."
+                          },
+                          "nullable": true
+                        },
+                        "kind": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Kind of resource."
+                          }
+                        },
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Key Vault resource ID."
+                          }
+                        },
+                        "keyVaultSecretName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Key Vault secret name."
+                          }
+                        },
+                        "serverFarmResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Server farm resource ID."
+                          }
+                        },
+                        "canonicalName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                          }
+                        },
+                        "password": {
+                          "type": "securestring",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Certificate password."
+                          }
+                        },
+                        "pfxBlob": {
+                          "type": "securestring",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Certificate data in PFX format."
+                          }
+                        },
+                        "domainValidationMethod": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Method of domain validation for free certificate."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a certificate.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "modules/certificate.bicep"
+                        }
+                      }
+                    },
+                    "_3.scmIpSecurityRestrictionType": {
+                      "type": "object",
+                      "properties": {
+                        "action": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Allow",
+                            "Deny"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Allow or Deny access for this IP range."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. IP restriction rule description."
+                          }
+                        },
+                        "headers": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "array",
+                            "items": {
+                              "type": "string"
+                            },
+                            "metadata": {
+                              "description": "Required. A header."
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. IP restriction rule headers.\nX-Forwarded-Host (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), all hosts(or lack of) are allowed.\n- A value is compared using ordinal-ignore-case (excluding port number).\n- Subdomain wildcards are permitted but don't match the root domain. For example, *.contoso.com matches the subdomain foo.contoso.com\nbut not the root domain contoso.com or multi-level foo.bar.contoso.com\n- Unicode host names are allowed but are converted to Punycode for matching.\n\nX-Forwarded-For (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), any forwarded-for chains (or lack of) are allowed.\n- If any address (excluding port number) in the chain (comma separated) matches the CIDR defined by the property.\n\nX-Azure-FDID and X-FD-HealthProbe.\nThe matching logic is exact match."
+                          }
+                        },
+                        "ipAddress": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. IP address the security restriction is valid for. It can be in form of pure ipv4 address (required SubnetMask property) or CIDR notation such as ipv4/mask (leading bit match). For CIDR, SubnetMask property must not be specified."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. IP restriction rule name."
+                          }
+                        },
+                        "priority": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Priority of IP restriction rule."
+                          }
+                        },
+                        "subnetMask": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Subnet mask for the range of IP addresses the restriction is valid for."
+                          }
+                        },
+                        "subnetTrafficTag": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. (internal) Subnet traffic tag."
+                          }
+                        },
+                        "tag": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Default",
+                            "ServiceTag",
+                            "XffProxy"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Defines what this IP filter will be used for. This is to support IP filtering on proxies."
+                          }
+                        },
+                        "vnetSubnetResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Virtual network resource id."
+                          }
+                        },
+                        "vnetTrafficTag": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. (internal) Vnet traffic tag."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a IP security restriction.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "_3.slowRequestBasedTriggerType": {
+                      "type": "object",
+                      "properties": {
+                        "count": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request Count."
+                          }
+                        },
+                        "path": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request Path."
+                          }
+                        },
+                        "timeInterval": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Time interval."
+                          }
+                        },
+                        "timeTaken": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Time taken."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of aslow request based trigger.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "appSettingsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "appsettings"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "storageAccountUseIdentityAuthentication": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                          }
+                        },
+                        "applicationInsightResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                          }
+                        },
+                        "retainCurrentAppSettings": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The retain the current app settings. Defaults to true."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "Required. An app settings key-value pair."
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of an app settings configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "authSettingsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "authsettings"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "aadClaimsAuthorization": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets a JSON string containing the Azure AD Acl settings."
+                              }
+                            },
+                            "additionalLoginParams": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                              }
+                            },
+                            "allowedAudiences": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting."
+                              }
+                            },
+                            "allowedExternalRedirectUrls": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                              }
+                            },
+                            "authFilePath": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The path of the config file containing auth settings. If the path is relative, base will the site's root directory."
+                              }
+                            },
+                            "clientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                              }
+                            },
+                            "clientSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                              }
+                            },
+                            "clientSecretCertificateThumbprint": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                              }
+                            },
+                            "clientSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                              }
+                            },
+                            "configVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization."
+                              }
+                            },
+                            "defaultProvider": {
+                              "type": "string",
+                              "allowedValues": [
+                                "AzureActiveDirectory",
+                                "Facebook",
+                                "Github",
+                                "Google",
+                                "MicrosoftAccount",
+                                "Twitter"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                              }
+                            },
+                            "enabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                              }
+                            },
+                            "facebookAppId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                              }
+                            },
+                            "facebookAppSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                              }
+                            },
+                            "facebookAppSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the app secret used for Facebook Login."
+                              }
+                            },
+                            "facebookOAuthScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                              }
+                            },
+                            "gitHubClientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Client Id of the GitHub app used for login. This setting is required for enabling Github login."
+                              }
+                            },
+                            "gitHubClientSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login."
+                              }
+                            },
+                            "gitHubClientSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the client secret of the Github app used for GitHub Login."
+                              }
+                            },
+                            "gitHubOAuthScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication."
+                              }
+                            },
+                            "googleClientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                              }
+                            },
+                            "googleClientSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                              }
+                            },
+                            "googleClientSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the client secret associated with the Google web application."
+                              }
+                            },
+                            "googleOAuthScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, \"openid\", \"profile\", and \"email\" are used as default scopes. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                              }
+                            },
+                            "isAuthFromFile": {
+                              "type": "string",
+                              "allowedValues": [
+                                "false",
+                                "true"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. \"true\" if the auth config settings should be read from a file, \"false\" otherwise."
+                              }
+                            },
+                            "issuer": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                              }
+                            },
+                            "microsoftAccountClientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                              }
+                            },
+                            "microsoftAccountClientSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                              }
+                            },
+                            "microsoftAccountClientSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication."
+                              }
+                            },
+                            "microsoftAccountOAuthScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, \"wl.basic\" is used as the default scope. Microsoft Account Scopes and permissions [documentation](https://msdn.microsoft.com/en-us/library/dn631845.aspx)."
+                              }
+                            },
+                            "runtimeVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                              }
+                            },
+                            "tokenRefreshExtensionHours": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                              }
+                            },
+                            "tokenStoreEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows. The default is `false`."
+                              }
+                            },
+                            "twitterConsumerKey": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                              }
+                            },
+                            "twitterConsumerSecret": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                              }
+                            },
+                            "twitterConsumerSecretSettingName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                              }
+                            },
+                            "unauthenticatedClientAction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "AllowAnonymous",
+                                "RedirectToLoginPage"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                              }
+                            },
+                            "validateIssuer": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of an auth settings configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "authSettingsV2ConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "authsettingsV2"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "globalValidation": {
+                              "type": "object",
+                              "properties": {
+                                "excludedPaths": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The paths for which unauthenticated flow would not be redirected to the login page."
+                                  }
+                                },
+                                "redirectToProvider": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                  }
+                                },
+                                "requireAuthentication": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `true` if the authentication flow is required by every request."
+                                  }
+                                },
+                                "unauthenticatedClientAction": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AllowAnonymous",
+                                    "RedirectToLoginPage",
+                                    "Return401",
+                                    "Return403"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings that determines the validation flow of users using App Service Authentication/Authorization."
+                              }
+                            },
+                            "httpSettings": {
+                              "type": "object",
+                              "properties": {
+                                "forwardProxy": {
+                                  "type": "object",
+                                  "properties": {
+                                    "convention": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Custom",
+                                        "NoProxy",
+                                        "Standard"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The convention used to determine the url of the request made."
+                                      }
+                                    },
+                                    "customHostHeaderName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The name of the header containing the host of the request."
+                                      }
+                                    },
+                                    "customProtoHeaderName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The name of the header containing the scheme of the request."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of a forward proxy used to make the requests."
+                                  }
+                                },
+                                "requireHttps": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `false` if the authentication/authorization responses not having the HTTPS scheme are permissible."
+                                  }
+                                },
+                                "routes": {
+                                  "type": "object",
+                                  "properties": {
+                                    "apiPrefix": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The prefix that should precede all the authentication/authorization paths."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the paths HTTP requests."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against App Service Authentication/Authorization."
+                              }
+                            },
+                            "identityProviders": {
+                              "type": "object",
+                              "properties": {
+                                "apple": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Apple provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the client secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Apple registration."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Apple provider."
+                                  }
+                                },
+                                "azureActiveDirectory": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "isAutoProvisioned": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "disableWWWAuthenticate": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the www-authenticate provider should be omitted from the request."
+                                          }
+                                        },
+                                        "loginParameters": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Active Directory login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                          }
+                                        },
+                                        "clientSecretCertificateIssuer": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                          }
+                                        },
+                                        "clientSecretCertificateSubjectAlternativeName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                          }
+                                        },
+                                        "clientSecretCertificateThumbprint": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                          }
+                                        },
+                                        "openIdIssuer": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Active Directory app registration."
+                                      }
+                                    },
+                                    "validation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedAudiences": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The list of audiences that can make successful authentication/authorization requests."
+                                          }
+                                        },
+                                        "defaultAuthorizationPolicy": {
+                                          "type": "object",
+                                          "properties": {
+                                            "allowedApplications": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory allowed applications."
+                                              }
+                                            },
+                                            "allowedPrincipals": {
+                                              "type": "object",
+                                              "properties": {
+                                                "groups": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The list of the allowed groups."
+                                                  }
+                                                },
+                                                "identities": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The list of the allowed identities."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory allowed principals."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the default authorization policy."
+                                          }
+                                        },
+                                        "jwtClaimChecks": {
+                                          "type": "object",
+                                          "properties": {
+                                            "allowedClientApplications": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The list of the allowed client applications."
+                                              }
+                                            },
+                                            "allowedGroups": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The list of the allowed groups."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the checks that should be made while validating the JWT Claims."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Azure Active directory provider."
+                                  }
+                                },
+                                "azureStaticWebApps": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Azure Static Web Apps provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Static Web Apps registration."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Azure Static Web Apps provider."
+                                  }
+                                },
+                                "customOpenIdConnectProviders": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Set to `false` if the custom Open ID provider provider should not be enabled."
+                                        }
+                                      },
+                                      "login": {
+                                        "type": "object",
+                                        "properties": {
+                                          "nameClaimType": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of the claim that contains the users name."
+                                            }
+                                          },
+                                          "scopes": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "string"
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                            }
+                                          }
+                                        },
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The configuration settings of the login flow of the custom Open ID Connect provider."
+                                        }
+                                      },
+                                      "registration": {
+                                        "type": "object",
+                                        "properties": {
+                                          "clientCredential": {
+                                            "type": "object",
+                                            "properties": {
+                                              "clientSecretSettingName": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The app setting that contains the client secret for the custom Open ID Connect provider."
+                                                }
+                                              },
+                                              "method": {
+                                                "type": "string",
+                                                "allowedValues": [
+                                                  "ClientSecretPost"
+                                                ],
+                                                "metadata": {
+                                                  "description": "Required. The method that should be used to authenticate the user."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The authentication credentials of the custom Open ID Connect provider."
+                                            }
+                                          },
+                                          "clientId": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The client id of the custom Open ID Connect provider."
+                                            }
+                                          },
+                                          "openIdConnectConfiguration": {
+                                            "type": "object",
+                                            "properties": {
+                                              "authorizationEndpoint": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint to be used to make an authorization request."
+                                                }
+                                              },
+                                              "certificationUri": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint that provides the keys necessary to validate the token."
+                                                }
+                                              },
+                                              "issuer": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint that issues the token."
+                                                }
+                                              },
+                                              "tokenEndpoint": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint to be used to request a token."
+                                                }
+                                              },
+                                              "wellKnownOpenIdConfiguration": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The endpoint that contains all the configuration endpoints for the provider."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The configuration settings of the endpoints used for the custom Open ID Connect provider."
+                                            }
+                                          }
+                                        },
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The configuration settings of the app registration for the custom Open ID Connect provider."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The alias of each custom Open ID Connect provider."
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider."
+                                  }
+                                },
+                                "facebook": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Facebook provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "graphApiVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The version of the Facebook api to be used while logging in."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "appId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The App ID of the app used for login."
+                                          }
+                                        },
+                                        "appSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the app secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the Facebook provider."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Facebook provider."
+                                  }
+                                },
+                                "gitHub": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the GitHub provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the client secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the GitHub provider."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the GitHub provider."
+                                  }
+                                },
+                                "google": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Google provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the client secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the Google provider."
+                                      }
+                                    },
+                                    "validation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedAudiences": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Google provider."
+                                  }
+                                },
+                                "legacyMicrosoftAccount": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the legacy Microsoft Account provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "clientId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Client ID of the app used for login."
+                                          }
+                                        },
+                                        "clientSecretSettingName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The app setting name that contains the client secret."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the legacy Microsoft Account provider."
+                                      }
+                                    },
+                                    "validation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedAudiences": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the legacy Microsoft Account provider token validation flow."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the legacy Microsoft Account provider."
+                                  }
+                                },
+                                "twitter": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the Twitter provider should not be enabled despite the set registration."
+                                      }
+                                    },
+                                    "registration": {
+                                      "type": "object",
+                                      "properties": {
+                                        "consumerKey": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                          }
+                                        },
+                                        "consumerSecretSettingName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the app registration for the Twitter provider."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the Twitter provider."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings of each of the identity providers used to configure App Service Authentication/Authorization."
+                              }
+                            },
+                            "login": {
+                              "type": "object",
+                              "properties": {
+                                "allowedExternalRedirectUrls": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                  }
+                                },
+                                "cookieExpiration": {
+                                  "type": "object",
+                                  "properties": {
+                                    "convention": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "FixedTime",
+                                        "IdentityProviderDerived"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The convention used when determining the session cookie's expiration."
+                                      }
+                                    },
+                                    "timeToExpiration": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The time after the request is made when the session cookie should expire."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the session cookie's expiration."
+                                  }
+                                },
+                                "nonce": {
+                                  "type": "object",
+                                  "properties": {
+                                    "nonceExpirationInterval": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The time after the request is made when the nonce should expire."
+                                      }
+                                    },
+                                    "validateNonce": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `false` if the nonce should not be validated while completing the login flow."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the nonce used in the login flow."
+                                  }
+                                },
+                                "preserveUrlFragmentsForLogins": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `true` if the fragments from the request are preserved after the login request is made."
+                                  }
+                                },
+                                "routes": {
+                                  "type": "object",
+                                  "properties": {
+                                    "logoutEndpoint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The endpoint at which a logout request should be made."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The routes that specify the endpoints used for login and logout requests."
+                                  }
+                                },
+                                "tokenStore": {
+                                  "type": "object",
+                                  "properties": {
+                                    "azureBlobStorage": {
+                                      "type": "object",
+                                      "properties": {
+                                        "sasUrlSettingName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the app setting containing the SAS URL of the blob storage containing the tokens."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the storage of the tokens if blob storage is used."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows."
+                                      }
+                                    },
+                                    "fileSystem": {
+                                      "type": "object",
+                                      "properties": {
+                                        "directory": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The directory in which the tokens will be stored."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the storage of the tokens if a file system is used."
+                                      }
+                                    },
+                                    "tokenRefreshExtensionHours": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration settings of the token store."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings of the login flow of users using App Service Authentication/Authorization."
+                              }
+                            },
+                            "platform": {
+                              "type": "object",
+                              "properties": {
+                                "configFilePath": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The path of the config file containing auth settings if they come from a file. If the path is relative, base will the site's root directory."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                  }
+                                },
+                                "runtimeVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration settings of the platform of App Service Authentication/Authorization."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of an authSettingsV2 configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "azureStorageAccountConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "azurestorageaccounts"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "object",
+                            "properties": {
+                              "accessKey": {
+                                "type": "securestring",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Access key for the storage account."
+                                }
+                              },
+                              "accountName": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of the storage account."
+                                }
+                              },
+                              "mountPath": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                }
+                              },
+                              "protocol": {
+                                "type": "string",
+                                "allowedValues": [
+                                  "Http",
+                                  "Nfs",
+                                  "Smb"
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Mounting protocol to use for the storage account."
+                                }
+                              },
+                              "shareName": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                }
+                              },
+                              "type": {
+                                "type": "string",
+                                "allowedValues": [
+                                  "AzureBlob",
+                                  "AzureFiles"
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Type of storage."
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The Azure Storage Info configuration."
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of an Azure Storage Account configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "backupConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "backup"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "backupName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Name of the backup."
+                              }
+                            },
+                            "backupSchedule": {
+                              "type": "object",
+                              "properties": {
+                                "frequencyInterval": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. How often the backup should be executed (e.g. for weekly backup, this should be set to 7 and FrequencyUnit should be set to Day)."
+                                  }
+                                },
+                                "frequencyUnit": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Day",
+                                    "Hour"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The unit of time for how often the backup should be executed (e.g. for weekly backup, this should be set to Day and FrequencyInterval should be set to 7)."
+                                  }
+                                },
+                                "keepAtLeastOneBackup": {
+                                  "type": "bool",
+                                  "metadata": {
+                                    "description": "Required. Set to `True` if the retention policy should always keep at least one backup in the storage account, regardless how old it is."
+                                  }
+                                },
+                                "retentionPeriodInDays": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. After how many days backups should be deleted."
+                                  }
+                                },
+                                "startTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. When the schedule should start working."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Schedule for the backup if it is executed periodically."
+                              }
+                            },
+                            "databases": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "connectionString": {
+                                    "type": "securestring",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Contains a connection string to a database which is being backed up or restored. If the restore should happen to a new database, the database name inside is the new one."
+                                    }
+                                  },
+                                  "connectionStringName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Contains a connection string name that is linked to the SiteConfig.ConnectionStrings. This is used during restore with overwrite connection strings options."
+                                    }
+                                  },
+                                  "databaseType": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "LocalMySql",
+                                      "MySql",
+                                      "PostgreSql",
+                                      "SqlAzure"
+                                    ],
+                                    "metadata": {
+                                      "description": "Required. Database type (e.g. SqlAzure / MySql)."
+                                    }
+                                  },
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the setting."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Databases included in the backup."
+                              }
+                            },
+                            "enabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `True` if the backup schedule is enabled (must be included in that case), `false` if the backup schedule should be disabled."
+                              }
+                            },
+                            "storageAccountUrl": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. SAS URL to the container."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a backup configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "connectionStringsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "connectionstrings"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "object",
+                            "properties": {
+                              "type": {
+                                "type": "string",
+                                "allowedValues": [
+                                  "ApiHub",
+                                  "Custom",
+                                  "DocDb",
+                                  "EventHub",
+                                  "MySql",
+                                  "NotificationHub",
+                                  "PostgreSQL",
+                                  "RedisCache",
+                                  "SQLAzure",
+                                  "SQLServer",
+                                  "ServiceBus"
+                                ],
+                                "metadata": {
+                                  "description": "Required. Type of database."
+                                }
+                              },
+                              "value": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Value of pair."
+                                }
+                              }
+                            },
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The name of the connection string setting."
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a connection string configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "hostNameBindingsOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the host name binding."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the host name binding."
+                          }
+                        },
+                        "resourceGroupName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the resource group the resource was deployed into."
+                          }
+                        },
+                        "certificateThumbprint": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The thumbprint of the certificate."
+                          }
+                        },
+                        "certificateResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The resource ID of the certificate."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "hostNameBindingType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Hostname in the hostname binding. Defaults to the host name of the app/slot if not specified."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Kind of resource."
+                          }
+                        },
+                        "azureResourceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Azure resource name."
+                          }
+                        },
+                        "azureResourceType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "TrafficManager",
+                            "Website"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                          }
+                        },
+                        "customHostNameDnsRecordType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "A",
+                            "CName"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                          }
+                        },
+                        "domainResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Fully qualified ARM domain resource URI."
+                          }
+                        },
+                        "hostNameType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Managed",
+                            "Verified"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                          }
+                        },
+                        "siteName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. App Service app name."
+                          }
+                        },
+                        "sslState": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "IpBasedEnabled",
+                            "SniEnabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                          }
+                        },
+                        "thumbprint": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. SSL certificate thumbprint."
+                          }
+                        },
+                        "certificate": {
+                          "$ref": "#/definitions/_2.certificateType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Certificate creation properties. If specified, a certificate will be created and used for this hostname binding."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a host name binding.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "logsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "logs"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "applicationLogs": {
+                              "type": "object",
+                              "properties": {
+                                "azureBlobStorage": {
+                                  "type": "object",
+                                  "properties": {
+                                    "level": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Error",
+                                        "Information",
+                                        "Off",
+                                        "Verbose",
+                                        "Warning"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Log level."
+                                      }
+                                    },
+                                    "retentionInDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                      }
+                                    },
+                                    "sasUrl": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application logs to blob storage configuration."
+                                  }
+                                },
+                                "azureTableStorage": {
+                                  "type": "object",
+                                  "properties": {
+                                    "level": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Error",
+                                        "Information",
+                                        "Off",
+                                        "Verbose",
+                                        "Warning"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Log level."
+                                      }
+                                    },
+                                    "sasUrl": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. SAS URL to an Azure table with add/query/delete permissions."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application logs to azure table storage configuration."
+                                  }
+                                },
+                                "fileSystem": {
+                                  "type": "object",
+                                  "properties": {
+                                    "level": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Error",
+                                        "Information",
+                                        "Off",
+                                        "Verbose",
+                                        "Warning"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Log level."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application logs to file system configuration."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application Logs for Azure configuration."
+                              }
+                            },
+                            "detailedErrorMessages": {
+                              "type": "object",
+                              "properties": {
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Detailed error messages configuration."
+                              }
+                            },
+                            "failedRequestsTracing": {
+                              "type": "object",
+                              "properties": {
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Failed requests tracing configuration."
+                              }
+                            },
+                            "httpLogs": {
+                              "type": "object",
+                              "properties": {
+                                "azureBlobStorage": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                      }
+                                    },
+                                    "retentionInDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                      }
+                                    },
+                                    "sasUrl": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Http logs to azure blob storage configuration."
+                                  }
+                                },
+                                "fileSystem": {
+                                  "type": "object",
+                                  "properties": {
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                      }
+                                    },
+                                    "retentionInDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Retention in days. Remove files older than X days. 0 or lower means no retention."
+                                      }
+                                    },
+                                    "retentionInMb": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 25,
+                                      "maxValue": 100,
+                                      "metadata": {
+                                        "description": "Optional. Maximum size in megabytes that http log files can use. When reached old log files will be removed to make space for new ones."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Http logs to file system configuration."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. HTTP logs configuration."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a logs configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "metadataConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "metadata"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {},
+                          "additionalProperties": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "Optional. The metadata key value pair."
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a metadata configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "pushSettingsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "pushsettings"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "dynamicTagsJson": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                              }
+                            },
+                            "isPushEnabled": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                              }
+                            },
+                            "tagsRequiringAuth": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                              }
+                            },
+                            "tagWhitelistJson": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a pushSettings configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "webConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "allowedValues": [
+                            "web"
+                          ],
+                          "metadata": {
+                            "description": "Required. The type of config."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "acrUseManagedIdentityCreds": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Flag to use Managed Identity Creds for ACR pull."
+                              }
+                            },
+                            "acrUserManagedIdentityID": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. If using user managed identity, the user managed identity ClientId."
+                              }
+                            },
+                            "alwaysOn": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if 'Always On' is enabled."
+                              }
+                            },
+                            "apiDefinition": {
+                              "type": "object",
+                              "properties": {
+                                "url": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The URL of the API definition."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Information about the formal API definition for the app."
+                              }
+                            },
+                            "apiManagementConfig": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. APIM-Api Identifier."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure API management settings linked to the app."
+                              }
+                            },
+                            "appCommandLine": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. App command line to launch."
+                              }
+                            },
+                            "appSettings": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Name of the pair."
+                                    }
+                                  },
+                                  "value": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Value of the pair."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application settings."
+                              }
+                            },
+                            "autoHealEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if Auto Heal is enabled."
+                              }
+                            },
+                            "autoHealRules": {
+                              "type": "object",
+                              "properties": {
+                                "actions": {
+                                  "type": "object",
+                                  "properties": {
+                                    "actionType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "CustomAction",
+                                        "LogEvent",
+                                        "Recycle"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Predefined action to be taken."
+                                      }
+                                    },
+                                    "customAction": {
+                                      "type": "object",
+                                      "properties": {
+                                        "exe": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Executable to be run."
+                                          }
+                                        },
+                                        "parameters": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Parameters for the executable."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Custom action to be taken."
+                                      }
+                                    },
+                                    "minProcessExecutionTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Minimum time the process must execute before taking the action."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Actions to be executed when a rule is triggered."
+                                  }
+                                },
+                                "triggers": {
+                                  "type": "object",
+                                  "properties": {
+                                    "privateBytesInKB": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on private bytes."
+                                      }
+                                    },
+                                    "requests": {
+                                      "type": "object",
+                                      "properties": {
+                                        "count": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request Count."
+                                          }
+                                        },
+                                        "timeInterval": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Time interval."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on total requests."
+                                      }
+                                    },
+                                    "slowRequests": {
+                                      "$ref": "#/definitions/_3.slowRequestBasedTriggerType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on request execution time."
+                                      }
+                                    },
+                                    "slowRequestsWithPath": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/_3.slowRequestBasedTriggerType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on multiple Slow Requests Rule with path."
+                                      }
+                                    },
+                                    "statusCodes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "count": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Request Count."
+                                            }
+                                          },
+                                          "path": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Request Path."
+                                            }
+                                          },
+                                          "status": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. HTTP status code."
+                                            }
+                                          },
+                                          "subStatus": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Request Sub Status."
+                                            }
+                                          },
+                                          "timeInterval": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Time interval."
+                                            }
+                                          },
+                                          "win32Status": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Win32 error code."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on status codes."
+                                      }
+                                    },
+                                    "statusCodesRange": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "count": {
+                                            "type": "int",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Request Count."
+                                            }
+                                          },
+                                          "path": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Path."
+                                            }
+                                          },
+                                          "statusCodes": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. HTTP status code."
+                                            }
+                                          },
+                                          "timeInterval": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Time interval."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A rule based on status codes ranges."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Conditions that describe when to execute the auto-heal actions."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Auto Heal rules."
+                              }
+                            },
+                            "autoSwapSlotName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Auto-swap slot name."
+                              }
+                            },
+                            "azureStorageAccounts": {
+                              "type": "object",
+                              "properties": {},
+                              "additionalProperties": {
+                                "type": "object",
+                                "properties": {
+                                  "accessKey": {
+                                    "type": "securestring",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Access key for the storage account."
+                                    }
+                                  },
+                                  "accountName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the storage account."
+                                    }
+                                  },
+                                  "mountPath": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                    }
+                                  },
+                                  "protocol": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Http",
+                                      "Nfs",
+                                      "Smb"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Mounting protocol to use for the storage account."
+                                    }
+                                  },
+                                  "shareName": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                    }
+                                  },
+                                  "type": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "AzureBlob",
+                                      "AzureFiles"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Type of storage."
+                                    }
+                                  }
+                                },
+                                "metadata": {
+                                  "description": "Required. A storage account configuration."
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of Azure Storage Accounts."
+                              }
+                            },
+                            "connectionStrings": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "connectionString": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Connection string value."
+                                    }
+                                  },
+                                  "name": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Name of connection string."
+                                    }
+                                  },
+                                  "type": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "ApiHub",
+                                      "Custom",
+                                      "DocDb",
+                                      "EventHub",
+                                      "MySql",
+                                      "NotificationHub",
+                                      "PostgreSQL",
+                                      "RedisCache",
+                                      "SQLAzure",
+                                      "SQLServer",
+                                      "ServiceBus"
+                                    ],
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Type of database."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Connection strings."
+                              }
+                            },
+                            "cors": {
+                              "type": "object",
+                              "properties": {
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Gets or sets the list of origins that should be allowed to make cross-origin calls (for example: http://example.com:12345). Use \"*\" to allow all."
+                                  }
+                                },
+                                "supportCredentials": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Gets or sets whether CORS requests with credentials are allowed. See [ref](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Requests_with_credentials) for more details."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Cross-Origin Resource Sharing (CORS) settings."
+                              }
+                            },
+                            "defaultDocuments": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Default documents."
+                              }
+                            },
+                            "detailedErrorLoggingEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if detailed error logging is enabled."
+                              }
+                            },
+                            "documentRoot": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Document root."
+                              }
+                            },
+                            "elasticWebAppScaleLimit": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 0,
+                              "metadata": {
+                                "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to apps in plans where ElasticScaleEnabled is `true`."
+                              }
+                            },
+                            "experiments": {
+                              "type": "object",
+                              "properties": {
+                                "rampUpRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "actionHostName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Hostname of a slot to which the traffic will be redirected if decided to. E.g. myapp-stage.azurewebsites.net."
+                                        }
+                                      },
+                                      "changeDecisionCallbackUrl": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified."
+                                        }
+                                      },
+                                      "changeIntervalInMinutes": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Specifies interval in minutes to reevaluate ReroutePercentage."
+                                        }
+                                      },
+                                      "changeStep": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. In auto ramp up scenario this is the step to add/remove from `ReroutePercentage` until it reaches `MinReroutePercentage` or `MaxReroutePercentage`. Site metrics are checked every N minutes specified in `ChangeIntervalInMinutes`. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified in `ChangeDecisionCallbackUrl`."
+                                        }
+                                      },
+                                      "maxReroutePercentage": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Specifies upper boundary below which ReroutePercentage will stay."
+                                        }
+                                      },
+                                      "minReroutePercentage": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Specifies lower boundary above which ReroutePercentage will stay."
+                                        }
+                                      },
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the routing rule. The recommended name would be to point to the slot which will receive the traffic in the experiment."
+                                        }
+                                      },
+                                      "reroutePercentage": {
+                                        "type": "int",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Percentage of the traffic which will be redirected to `ActionHostName`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. List of ramp-up rules."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. This is work around for polymorphic types."
+                              }
+                            },
+                            "ftpsState": {
+                              "type": "string",
+                              "allowedValues": [
+                                "AllAllowed",
+                                "Disabled",
+                                "FtpsOnly"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. State of FTP / FTPS service."
+                              }
+                            },
+                            "functionAppScaleLimit": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 0,
+                              "metadata": {
+                                "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to the Consumption and Elastic Premium Plans."
+                              }
+                            },
+                            "functionsRuntimeScaleMonitoringEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Gets or sets a value indicating whether functions runtime scale monitoring is enabled. When enabled, the ScaleController will not monitor event sources directly, but will instead call to the runtime to get scale status."
+                              }
+                            },
+                            "handlerMappings": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "arguments": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Command-line arguments to be passed to the script processor."
+                                    }
+                                  },
+                                  "extension": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Requests with this extension will be handled using the specified FastCGI application."
+                                    }
+                                  },
+                                  "scriptProcessor": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The absolute path to the FastCGI application."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Handler mappings."
+                              }
+                            },
+                            "healthCheckPath": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Health check path."
+                              }
+                            },
+                            "http20Enabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Allow clients to connect over http2.0."
+                              }
+                            },
+                            "httpLoggingEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if HTTP logging is enabled."
+                              }
+                            },
+                            "ipSecurityRestrictions": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/_3.scmIpSecurityRestrictionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. IP security restrictions for main."
+                              }
+                            },
+                            "ipSecurityRestrictionsDefaultAction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Default action for main access restriction if no rules are matched."
+                              }
+                            },
+                            "javaContainer": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Java container."
+                              }
+                            },
+                            "javaContainerVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Java container version."
+                              }
+                            },
+                            "javaVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Java version."
+                              }
+                            },
+                            "keyVaultReferenceIdentity": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Identity to use for Key Vault Reference authentication."
+                              }
+                            },
+                            "limits": {
+                              "type": "object",
+                              "properties": {
+                                "maxDiskSizeInMb": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum allowed disk size usage in MB."
+                                  }
+                                },
+                                "maxMemoryInMb": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum allowed memory usage in MB."
+                                  }
+                                },
+                                "maxPercentageCpu": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum allowed CPU usage percentage."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Site limits."
+                              }
+                            },
+                            "linuxFxVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Linux App Framework and version."
+                              }
+                            },
+                            "loadBalancing": {
+                              "type": "string",
+                              "allowedValues": [
+                                "LeastRequests",
+                                "LeastRequestsWithTieBreaker",
+                                "LeastResponseTime",
+                                "PerSiteRoundRobin",
+                                "RequestHash",
+                                "WeightedRoundRobin",
+                                "WeightedTotalTraffic"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Site load balancing."
+                              }
+                            },
+                            "localMySqlEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` to enable local MySQL."
+                              }
+                            },
+                            "logsDirectorySizeLimit": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. HTTP logs directory size limit."
+                              }
+                            },
+                            "managedPipelineMode": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Classic",
+                                "Integrated"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Managed pipeline mode."
+                              }
+                            },
+                            "managedServiceIdentityId": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Managed Service Identity Id."
+                              }
+                            },
+                            "metadata": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Pair name."
+                                    }
+                                  },
+                                  "value": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. Pair Value."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application metadata. This property cannot be retrieved, since it may contain secrets."
+                              }
+                            },
+                            "minimumElasticInstanceCount": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 0,
+                              "maxValue": 20,
+                              "metadata": {
+                                "description": "Optional. Number of minimum instance count for a site. This setting only applies to the Elastic Plans."
+                              }
+                            },
+                            "minTlsCipherSuite": {
+                              "type": "string",
+                              "allowedValues": [
+                                "TLS_AES_128_GCM_SHA256",
+                                "TLS_AES_256_GCM_SHA384",
+                                "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+                                "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                                "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                                "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                                "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+                                "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                                "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                                "TLS_RSA_WITH_AES_128_CBC_SHA",
+                                "TLS_RSA_WITH_AES_128_CBC_SHA256",
+                                "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                                "TLS_RSA_WITH_AES_256_CBC_SHA",
+                                "TLS_RSA_WITH_AES_256_CBC_SHA256",
+                                "TLS_RSA_WITH_AES_256_GCM_SHA384"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The minimum strength TLS cipher suite allowed for an application."
+                              }
+                            },
+                            "minTlsVersion": {
+                              "type": "string",
+                              "allowedValues": [
+                                "1.0",
+                                "1.1",
+                                "1.2",
+                                "1.3"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. MinTlsVersion: configures the minimum version of TLS required for SSL requests."
+                              }
+                            },
+                            "netFrameworkVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. .NET Framework version."
+                              }
+                            },
+                            "nodeVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Version of Node.js."
+                              }
+                            },
+                            "numberOfWorkers": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Number of workers."
+                              }
+                            },
+                            "phpVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Version of PHP."
+                              }
+                            },
+                            "powerShellVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Version of PowerShell."
+                              }
+                            },
+                            "preWarmedInstanceCount": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 0,
+                              "maxValue": 10,
+                              "metadata": {
+                                "description": "Optional. Number of preWarmed instances. This setting only applies to the Consumption and Elastic Plans."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Property to allow or block all public traffic."
+                              }
+                            },
+                            "publishingUsername": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Publishing user name."
+                              }
+                            },
+                            "push": {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "dynamicTagsJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                      }
+                                    },
+                                    "isPushEnabled": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                      }
+                                    },
+                                    "tagsRequiringAuth": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                      }
+                                    },
+                                    "tagWhitelistJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. PushSettings resource specific properties."
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Push endpoint settings."
+                              }
+                            },
+                            "pythonVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Version of Python."
+                              }
+                            },
+                            "remoteDebuggingEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if remote debugging is enabled."
+                              }
+                            },
+                            "remoteDebuggingVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Remote debugging version."
+                              }
+                            },
+                            "requestTracingEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if request tracing is enabled."
+                              }
+                            },
+                            "requestTracingExpirationTime": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Request tracing expiration time."
+                              }
+                            },
+                            "scmIpSecurityRestrictions": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/_3.scmIpSecurityRestrictionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. IP security restrictions for scm."
+                              }
+                            },
+                            "scmIpSecurityRestrictionsDefaultAction": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Default action for scm access restriction if no rules are matched."
+                              }
+                            },
+                            "scmIpSecurityRestrictionsUseMain": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. IP security restrictions for scm to use main."
+                              }
+                            },
+                            "scmMinTlsVersion": {
+                              "type": "string",
+                              "allowedValues": [
+                                "1.0",
+                                "1.1",
+                                "1.2",
+                                "1.3"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. ScmMinTlsVersion: configures the minimum version of TLS required for SSL requests for SCM site."
+                              }
+                            },
+                            "scmType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "BitbucketGit",
+                                "BitbucketHg",
+                                "CodePlexGit",
+                                "CodePlexHg",
+                                "Dropbox",
+                                "ExternalGit",
+                                "ExternalHg",
+                                "GitHub",
+                                "LocalGit",
+                                "None",
+                                "OneDrive",
+                                "Tfs",
+                                "VSO",
+                                "VSTSRM"
+                              ],
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. SCM type."
+                              }
+                            },
+                            "tracingOptions": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tracing options."
+                              }
+                            },
+                            "use32BitWorkerProcess": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` to use 32-bit worker process."
+                              }
+                            },
+                            "virtualApplications": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "physicalPath": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Physical path."
+                                    }
+                                  },
+                                  "preloadEnabled": {
+                                    "type": "bool",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Set to `true` if preloading is enabled."
+                                    }
+                                  },
+                                  "virtualDirectories": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "physicalPath": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Physical path."
+                                          }
+                                        },
+                                        "virtualPath": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Path to virtual application."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Virtual directories for virtual application."
+                                    }
+                                  },
+                                  "virtualPath": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. Virtual path."
+                                    }
+                                  }
+                                }
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Virtual applications."
+                              }
+                            },
+                            "vnetName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Virtual Network name."
+                              }
+                            },
+                            "vnetPrivatePortsCount": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The number of private ports assigned to this app. These will be assigned dynamically on runtime."
+                              }
+                            },
+                            "vnetRouteAllEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+                              }
+                            },
+                            "websiteTimeZone": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Sets the time zone a site uses for generating timestamps. Compatible with Linux and Windows App Service. Setting the WEBSITE_TIME_ZONE app setting takes precedence over this config. For Linux, expects tz database values https://www.iana.org/time-zones (for a quick reference see [ref](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)). For Windows, expects one of the time zones listed under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones."
+                              }
+                            },
+                            "webSocketsEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Set to `true` if WebSocket is enabled."
+                              }
+                            },
+                            "windowsFxVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Xenon App Framework and version."
+                              }
+                            },
+                            "xManagedServiceIdentityId": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Explicit Managed Service Identity Id."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The config settings."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a web configuration.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "slot/main.bicep"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the site."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "allowedValues": [
+                        "functionapp",
+                        "functionapp,linux",
+                        "functionapp,workflowapp",
+                        "functionapp,workflowapp,linux",
+                        "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
+                        "app,linux",
+                        "app",
+                        "linux,api",
+                        "api",
+                        "app,linux,container",
+                        "app,container,windows"
+                      ],
+                      "metadata": {
+                        "description": "Required. Type of site to deploy."
+                      }
+                    },
+                    "serverFarmResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The resource ID of the app service plan to use for the site. Set as empty string when using a managed environment id for container apps."
+                      }
+                    },
+                    "managedEnvironmentResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                      }
+                    },
+                    "httpsOnly": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Configures a site to accept only HTTPS requests. Issues redirect for HTTP requests."
+                      }
+                    },
+                    "clientAffinityEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. If client affinity is enabled."
+                      }
+                    },
+                    "clientAffinityProxyEnabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance. Default is true."
+                      }
+                    },
+                    "clientAffinityPartitioningEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. To enable client affinity partitioning using CHIPS cookies, this will add the partitioned property to the affinity cookies; false to stop sending partitioned affinity cookies. Default is false."
+                      }
+                    },
+                    "appServiceEnvironmentResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the app service environment to use for this resource."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "keyVaultAccessIdentityResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                      }
+                    },
+                    "storageAccountRequired": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Checks if Customer provided storage account is required."
+                      }
+                    },
+                    "virtualNetworkSubnetResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                      }
+                    },
+                    "scmSiteAlsoStopped": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                      }
+                    },
+                    "siteConfig": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/siteConfig"
+                        },
+                        "description": "Optional. The site config object. The defaults are set to the following values: alwaysOn: true, minTlsVersion: '1.2', ftpsState: 'FtpsOnly'."
+                      },
+                      "defaultValue": {
+                        "alwaysOn": true,
+                        "minTlsVersion": "1.2",
+                        "ftpsState": "FtpsOnly"
+                      }
+                    },
+                    "outboundVnetRouting": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                        },
+                        "description": "Optional. The outbound VNET routing configuration for the site."
+                      },
+                      "nullable": true
+                    },
+                    "configs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/configType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The web site config."
+                      }
+                    },
+                    "functionAppConfig": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/functionAppConfig"
+                        },
+                        "description": "Optional. The Function App configuration object."
+                      },
+                      "nullable": true
+                    },
+                    "extensions": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/extensionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The extensions configuration."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "slots": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/slotType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for deployment slots for an app."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "clientCertEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                      }
+                    },
+                    "clientCertExclusionPaths": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                      }
+                    },
+                    "clientCertMode": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/clientCertMode"
+                        },
+                        "description": "Optional. This composes with ClientCertEnabled setting.\n- ClientCertEnabled=false means ClientCert is ignored.\n- ClientCertEnabled=true and ClientCertMode=Required means ClientCert is required.\n- ClientCertEnabled=true and ClientCertMode=Optional means ClientCert is optional or accepted.\n"
+                      },
+                      "defaultValue": "Optional"
+                    },
+                    "cloningInfo": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/cloningInfo"
+                        },
+                        "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                      },
+                      "nullable": true
+                    },
+                    "containerSize": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Size of the function container."
+                      }
+                    },
+                    "dailyMemoryTimeQuota": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                      }
+                    },
+                    "enabled": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                      }
+                    },
+                    "hostNameSslStates": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/hostNameSslStates"
+                        },
+                        "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                      },
+                      "nullable": true
+                    },
+                    "hyperV": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Hyper-V sandbox."
+                      }
+                    },
+                    "redundancyMode": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/redundancyMode"
+                        },
+                        "description": "Optional. Site redundancy mode."
+                      },
+                      "defaultValue": "None"
+                    },
+                    "basicPublishingCredentialsPolicies": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The site publishing credential policy names which are associated with the sites."
+                      }
+                    },
+                    "hybridConnectionRelays": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/hybridConnectionRelayType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Names of hybrid connection relays to connect app with."
+                      }
+                    },
+                    "hostNameBindings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/hostNameBindingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Host Name Bindings for the site."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                        },
+                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set."
+                      },
+                      "nullable": true
+                    },
+                    "e2eEncryptionEnabled": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. End to End Encryption Setting."
+                      }
+                    },
+                    "dnsConfiguration": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/dnsConfiguration"
+                        },
+                        "description": "Optional. Property to configure various DNS related settings for a site."
+                      },
+                      "nullable": true
+                    },
+                    "autoGeneratedDomainNameLabelScope": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                        },
+                        "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                      },
+                      "nullable": true
+                    },
+                    "sshEnabled": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Whether to enable SSH access."
+                      }
+                    },
+                    "daprConfig": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/daprConfig"
+                        },
+                        "description": "Optional. Dapr configuration of the app."
+                      },
+                      "nullable": true
+                    },
+                    "ipMode": {
+                      "type": "string",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/ipMode"
+                        },
+                        "description": "Optional. Specifies the IP mode of the app."
+                      },
+                      "nullable": true
+                    },
+                    "resourceConfig": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/resourceConfig"
+                        },
+                        "description": "Optional. Function app resource requirements."
+                      },
+                      "nullable": true
+                    },
+                    "workloadProfileName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Workload profile name for function app to execute on."
+                      }
+                    },
+                    "hostNamesDisabled": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                      }
+                    },
+                    "reserved": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                      }
+                    },
+                    "extendedLocation": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Web/sites@2025-03-01#properties/extendedLocation"
+                        },
+                        "description": "Optional. Extended location of the resource."
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "managedEnvironmentSupportedKinds": [
+                      "functionapp,linux,container,azurecontainerapps"
+                    ],
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                      "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                      "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('46d3xbcp.res.web-site.{0}.{1}', replace('0.23.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "app": {
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2025-03-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "kind": "[parameters('kind')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "extendedLocation": "[parameters('extendedLocation')]",
+                      "properties": {
+                        "managedEnvironmentId": "[parameters('managedEnvironmentResourceId')]",
+                        "serverFarmId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), not(empty(parameters('managedEnvironmentResourceId')))), null(), parameters('serverFarmResourceId'))]",
+                        "clientAffinityEnabled": "[if(not(empty(parameters('serverFarmResourceId'))), parameters('clientAffinityEnabled'), null())]",
+                        "clientAffinityProxyEnabled": "[parameters('clientAffinityProxyEnabled')]",
+                        "clientAffinityPartitioningEnabled": "[parameters('clientAffinityPartitioningEnabled')]",
+                        "httpsOnly": "[parameters('httpsOnly')]",
+                        "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                        "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                        "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                        "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]",
+                        "siteConfig": "[parameters('siteConfig')]",
+                        "functionAppConfig": "[parameters('functionAppConfig')]",
+                        "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                        "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                        "clientCertMode": "[if(not(empty(parameters('serverFarmResourceId'))), parameters('clientCertMode'), null())]",
+                        "cloningInfo": "[parameters('cloningInfo')]",
+                        "containerSize": "[parameters('containerSize')]",
+                        "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                        "enabled": "[parameters('enabled')]",
+                        "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                        "hyperV": "[parameters('hyperV')]",
+                        "redundancyMode": "[parameters('redundancyMode')]",
+                        "publicNetworkAccess": "[if(not(empty(parameters('serverFarmResourceId'))), if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled')), null())]",
+                        "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
+                        "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]",
+                        "dnsConfiguration": "[parameters('dnsConfiguration')]",
+                        "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                        "outboundVnetRouting": "[parameters('outboundVnetRouting')]",
+                        "sshEnabled": "[parameters('sshEnabled')]",
+                        "daprConfig": "[parameters('daprConfig')]",
+                        "ipMode": "[parameters('ipMode')]",
+                        "resourceConfig": "[parameters('resourceConfig')]",
+                        "workloadProfileName": "[parameters('workloadProfileName')]",
+                        "hostNamesDisabled": "[parameters('hostNamesDisabled')]",
+                        "reserved": "[parameters('reserved')]"
+                      }
+                    },
+                    "app_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_diagnosticSettings": {
+                      "copy": {
+                        "name": "app_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_roleAssignments": {
+                      "copy": {
+                        "name": "app_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_config": {
+                      "copy": {
+                        "name": "app_config",
+                        "count": "[length(coalesce(parameters('configs'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Site-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                          },
+                          "applicationInsightResourceId": {
+                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountResourceId')]"
+                          },
+                          "storageAccountUseIdentityAuthentication": {
+                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication')]"
+                          },
+                          "properties": {
+                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                          },
+                          "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites', parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]",
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "8196639045793921819"
+                            },
+                            "name": "Site App Settings",
+                            "description": "This module deploys a Site App Setting."
+                          },
+                          "parameters": {
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "allowedValues": [
+                                "appsettings",
+                                "authsettings",
+                                "authsettingsV2",
+                                "azurestorageaccounts",
+                                "backup",
+                                "connectionstrings",
+                                "logs",
+                                "metadata",
+                                "pushsettings",
+                                "slotConfigNames",
+                                "web"
+                              ],
+                              "metadata": {
+                                "description": "Required. The name of the config."
+                              }
+                            },
+                            "properties": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The properties of the config. Note: This parameter is highly dependent on the config type, defined by its name."
+                              }
+                            },
+                            "storageAccountUseIdentityAuthentication": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                              }
+                            },
+                            "applicationInsightResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "currentAppSettings": {
+                              "type": "object",
+                              "properties": {},
+                              "additionalProperties": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The key-values pairs of the current app settings."
+                                }
+                              },
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The current app settings."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-siteconfig.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "applicationInsights": {
+                              "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.Insights/components",
+                              "apiVersion": "2020-02-02",
+                              "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
+                              "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
+                            },
+                            "storageAccount": {
+                              "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-06-01",
+                              "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                            },
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2025-03-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "config": {
+                              "type": "Microsoft.Web/sites/config",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                              "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys('storageAccount', '2025-06-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/')), 'AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob, 'AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue, 'AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table), createObject())), if(not(empty(parameters('applicationInsightResourceId'))), shallowMerge(createArray(createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), if(not(contains(parameters('properties'), 'ApplicationInsightsAgent_EXTENSION_VERSION')), createObject('ApplicationInsightsAgent_EXTENSION_VERSION', if(contains(createArray('functionapp,linux', 'functionapp,workflowapp,linux', 'functionapp,linux,container', 'functionapp,linux,container,azurecontainerapps', 'app,linux', 'linux,api', 'app,linux,container'), reference('app', '2025-03-01', 'full').kind), '~3', '~2')), createObject()))), createObject()))]",
+                              "dependsOn": [
+                                "app",
+                                "applicationInsights",
+                                "storageAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the site config."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the site config."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the site config was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_extensions": {
+                      "copy": {
+                        "name": "app_extensions",
+                        "count": "[length(coalesce(parameters('extensions'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Site-Extension-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "properties": {
+                            "value": "[coalesce(parameters('extensions'), createArray())[copyIndex()].properties]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "13172204291630325256"
+                            },
+                            "name": "Site Deployment Extension ",
+                            "description": "This module deploys a Site extension for MSDeploy."
+                          },
+                          "parameters": {
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the parent site resource."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "MSDeploy",
+                              "allowedValues": [
+                                "MSDeploy"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The name of the extension."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "defaultValue": "MSDeploy",
+                              "allowedValues": [
+                                "MSDeploy"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The kind of extension."
+                              }
+                            },
+                            "properties": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                                },
+                                "description": "Optional. Sets the properties."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-site-extension.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2025-03-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "msdeploy": {
+                              "type": "Microsoft.Web/sites/extensions",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                              "kind": "[parameters('kind')]",
+                              "properties": "[parameters('properties')]"
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the extension."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the extension."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the extension was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_slots": {
+                      "copy": {
+                        "name": "app_slots",
+                        "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('slots'), createArray())[copyIndex()].name]"
+                          },
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "kind": {
+                            "value": "[parameters('kind')]"
+                          },
+                          "serverFarmResourceId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), not(empty(parameters('managedEnvironmentResourceId')))), createObject('value', null()), createObject('value', parameters('serverFarmResourceId')))]",
+                          "managedEnvironmentResourceId": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedEnvironmentResourceId'), parameters('managedEnvironmentResourceId'))]"
+                          },
+                          "httpsOnly": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'httpsOnly'), parameters('httpsOnly'))]"
+                          },
+                          "appServiceEnvironmentResourceId": {
+                            "value": "[parameters('appServiceEnvironmentResourceId')]"
+                          },
+                          "clientAffinityEnabled": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityEnabled'), parameters('clientAffinityEnabled'))]"
+                          },
+                          "clientAffinityProxyEnabled": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityProxyEnabled'), parameters('clientAffinityProxyEnabled'))]"
+                          },
+                          "clientAffinityPartitioningEnabled": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityPartitioningEnabled'), parameters('clientAffinityPartitioningEnabled'))]"
+                          },
+                          "managedIdentities": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedIdentities'), parameters('managedIdentities'))]"
+                          },
+                          "keyVaultAccessIdentityResourceId": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'keyVaultAccessIdentityResourceId'), parameters('keyVaultAccessIdentityResourceId'))]"
+                          },
+                          "storageAccountRequired": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountRequired'), parameters('storageAccountRequired'))]"
+                          },
+                          "virtualNetworkSubnetResourceId": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'virtualNetworkSubnetResourceId'), parameters('virtualNetworkSubnetResourceId'))]"
+                          },
+                          "siteConfig": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'siteConfig'), parameters('siteConfig'))]"
+                          },
+                          "functionAppConfig": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'functionAppConfig'), parameters('functionAppConfig'))]"
+                          },
+                          "configs": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'configs'), parameters('configs'))]"
+                          },
+                          "extensions": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'extensions'), parameters('extensions'))]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'diagnosticSettings')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "basicPublishingCredentialsPolicies": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'basicPublishingCredentialsPolicies'), parameters('basicPublishingCredentialsPolicies'))]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateEndpoints": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'), createArray())]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "clientCertEnabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertEnabled')]"
+                          },
+                          "clientCertExclusionPaths": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertExclusionPaths')]"
+                          },
+                          "clientCertMode": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertMode')]"
+                          },
+                          "cloningInfo": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'cloningInfo')]"
+                          },
+                          "containerSize": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'containerSize')]"
+                          },
+                          "customDomainVerificationId": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'customDomainVerificationId')]"
+                          },
+                          "dailyMemoryTimeQuota": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dailyMemoryTimeQuota')]"
+                          },
+                          "enabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'enabled')]"
+                          },
+                          "hostNameSslStates": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameSslStates')]"
+                          },
+                          "hyperV": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hyperV')]"
+                          },
+                          "publicNetworkAccess": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'publicNetworkAccess'), if(or(not(empty(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'))), not(empty(parameters('privateEndpoints')))), 'Disabled', 'Enabled'))]"
+                          },
+                          "redundancyMode": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'redundancyMode')]"
+                          },
+                          "hybridConnectionRelays": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hybridConnectionRelays')]"
+                          },
+                          "hostNameBindings": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameBindings')]"
+                          },
+                          "dnsConfiguration": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dnsConfiguration')]"
+                          },
+                          "autoGeneratedDomainNameLabelScope": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'autoGeneratedDomainNameLabelScope')]"
+                          },
+                          "outboundVnetRouting": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'outboundVnetRouting'), parameters('outboundVnetRouting'))]"
+                          },
+                          "sshEnabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'sshEnabled')]"
+                          },
+                          "daprConfig": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'daprConfig')]"
+                          },
+                          "ipMode": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'ipMode')]"
+                          },
+                          "resourceConfig": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'resourceConfig')]"
+                          },
+                          "workloadProfileName": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'workloadProfileName')]"
+                          },
+                          "hostNamesDisabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNamesDisabled')]"
+                          },
+                          "reserved": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'reserved')]"
+                          },
+                          "scmSiteAlsoStopped": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'scmSiteAlsoStopped'), parameters('scmSiteAlsoStopped'))]"
+                          },
+                          "e2eEncryptionEnabled": {
+                            "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'e2eEncryptionEnabled')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "14501171431519947073"
+                            },
+                            "name": "Web/Function App Deployment Slots",
+                            "description": "This module deploys a Web or Function App Deployment Slot."
+                          },
+                          "definitions": {
+                            "hostNameBindingsOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the host name binding."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the host name binding."
+                                  }
+                                },
+                                "resourceGroupName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the resource group the resource was deployed into."
+                                  }
+                                },
+                                "certificateThumbprint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The thumbprint of the certificate."
+                                  }
+                                },
+                                "certificateResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The resource ID of the certificate."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "privateEndpointOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The group Id for the private endpoint Group."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "FQDN that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses of the private endpoint."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "configType": {
+                              "type": "object",
+                              "discriminator": {
+                                "propertyName": "name",
+                                "mapping": {
+                                  "appsettings": {
+                                    "$ref": "#/definitions/appSettingsConfigType"
+                                  },
+                                  "authsettings": {
+                                    "$ref": "#/definitions/authSettingsConfigType"
+                                  },
+                                  "authsettingsV2": {
+                                    "$ref": "#/definitions/authSettingsV2ConfigType"
+                                  },
+                                  "azurestorageaccounts": {
+                                    "$ref": "#/definitions/azureStorageAccountConfigType"
+                                  },
+                                  "backup": {
+                                    "$ref": "#/definitions/backupConfigType"
+                                  },
+                                  "connectionstrings": {
+                                    "$ref": "#/definitions/connectionStringsConfigType"
+                                  },
+                                  "logs": {
+                                    "$ref": "#/definitions/logsConfigType"
+                                  },
+                                  "metadata": {
+                                    "$ref": "#/definitions/metadataConfigType"
+                                  },
+                                  "pushsettings": {
+                                    "$ref": "#/definitions/pushSettingsConfigType"
+                                  },
+                                  "web": {
+                                    "$ref": "#/definitions/webConfigType"
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a site configuration."
+                              }
+                            },
+                            "appSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "appsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "storageAccountUseIdentityAuthentication": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                  }
+                                },
+                                "applicationInsightResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                  }
+                                },
+                                "retainCurrentAppSettings": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The retain the current app settings. Defaults to true."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. An app settings key-value pair."
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of an app settings configuration."
+                              }
+                            },
+                            "authSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "authsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "aadClaimsAuthorization": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a JSON string containing the Azure AD Acl settings."
+                                      }
+                                    },
+                                    "additionalLoginParams": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                      }
+                                    },
+                                    "allowedAudiences": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting."
+                                      }
+                                    },
+                                    "allowedExternalRedirectUrls": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                      }
+                                    },
+                                    "authFilePath": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The path of the config file containing auth settings. If the path is relative, base will the site's root directory."
+                                      }
+                                    },
+                                    "clientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                      }
+                                    },
+                                    "clientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                      }
+                                    },
+                                    "clientSecretCertificateThumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                      }
+                                    },
+                                    "clientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                      }
+                                    },
+                                    "configVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization."
+                                      }
+                                    },
+                                    "defaultProvider": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AzureActiveDirectory",
+                                        "Facebook",
+                                        "Github",
+                                        "Google",
+                                        "MicrosoftAccount",
+                                        "Twitter"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                      }
+                                    },
+                                    "facebookAppId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "facebookAppSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "facebookAppSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the app secret used for Facebook Login."
+                                      }
+                                    },
+                                    "facebookOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "gitHubClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Id of the GitHub app used for login. This setting is required for enabling Github login."
+                                      }
+                                    },
+                                    "gitHubClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login."
+                                      }
+                                    },
+                                    "gitHubClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret of the Github app used for GitHub Login."
+                                      }
+                                    },
+                                    "gitHubOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication."
+                                      }
+                                    },
+                                    "googleClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "googleClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "googleClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret associated with the Google web application."
+                                      }
+                                    },
+                                    "googleOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, \"openid\", \"profile\", and \"email\" are used as default scopes. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "isAuthFromFile": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "false",
+                                        "true"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. \"true\" if the auth config settings should be read from a file, \"false\" otherwise."
+                                      }
+                                    },
+                                    "issuer": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                      }
+                                    },
+                                    "microsoftAccountClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                      }
+                                    },
+                                    "microsoftAccountClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                      }
+                                    },
+                                    "microsoftAccountClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication."
+                                      }
+                                    },
+                                    "microsoftAccountOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, \"wl.basic\" is used as the default scope. Microsoft Account Scopes and permissions [documentation](https://msdn.microsoft.com/en-us/library/dn631845.aspx)."
+                                      }
+                                    },
+                                    "runtimeVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                      }
+                                    },
+                                    "tokenRefreshExtensionHours": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                      }
+                                    },
+                                    "tokenStoreEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows. The default is `false`."
+                                      }
+                                    },
+                                    "twitterConsumerKey": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                      }
+                                    },
+                                    "twitterConsumerSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                      }
+                                    },
+                                    "twitterConsumerSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                      }
+                                    },
+                                    "unauthenticatedClientAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AllowAnonymous",
+                                        "RedirectToLoginPage"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                      }
+                                    },
+                                    "validateIssuer": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of an auth settings configuration."
+                              }
+                            },
+                            "authSettingsV2ConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "authsettingsV2"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "globalValidation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "excludedPaths": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The paths for which unauthenticated flow would not be redirected to the login page."
+                                          }
+                                        },
+                                        "redirectToProvider": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                          }
+                                        },
+                                        "requireAuthentication": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the authentication flow is required by every request."
+                                          }
+                                        },
+                                        "unauthenticatedClientAction": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AllowAnonymous",
+                                            "RedirectToLoginPage",
+                                            "Return401",
+                                            "Return403"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings that determines the validation flow of users using App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "httpSettings": {
+                                      "type": "object",
+                                      "properties": {
+                                        "forwardProxy": {
+                                          "type": "object",
+                                          "properties": {
+                                            "convention": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Custom",
+                                                "NoProxy",
+                                                "Standard"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The convention used to determine the url of the request made."
+                                              }
+                                            },
+                                            "customHostHeaderName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The name of the header containing the host of the request."
+                                              }
+                                            },
+                                            "customProtoHeaderName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The name of the header containing the scheme of the request."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of a forward proxy used to make the requests."
+                                          }
+                                        },
+                                        "requireHttps": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `false` if the authentication/authorization responses not having the HTTPS scheme are permissible."
+                                          }
+                                        },
+                                        "routes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "apiPrefix": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The prefix that should precede all the authentication/authorization paths."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the paths HTTP requests."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "identityProviders": {
+                                      "type": "object",
+                                      "properties": {
+                                        "apple": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Apple provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Apple registration."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Apple provider."
+                                          }
+                                        },
+                                        "azureActiveDirectory": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "isAutoProvisioned": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "disableWWWAuthenticate": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the www-authenticate provider should be omitted from the request."
+                                                  }
+                                                },
+                                                "loginParameters": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                                  }
+                                                },
+                                                "clientSecretCertificateIssuer": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                  }
+                                                },
+                                                "clientSecretCertificateSubjectAlternativeName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                  }
+                                                },
+                                                "clientSecretCertificateThumbprint": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                                  }
+                                                },
+                                                "openIdIssuer": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory app registration."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The list of audiences that can make successful authentication/authorization requests."
+                                                  }
+                                                },
+                                                "defaultAuthorizationPolicy": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "allowedApplications": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory allowed applications."
+                                                      }
+                                                    },
+                                                    "allowedPrincipals": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "groups": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of the allowed groups."
+                                                          }
+                                                        },
+                                                        "identities": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of the allowed identities."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory allowed principals."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the default authorization policy."
+                                                  }
+                                                },
+                                                "jwtClaimChecks": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "allowedClientApplications": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The list of the allowed client applications."
+                                                      }
+                                                    },
+                                                    "allowedGroups": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The list of the allowed groups."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the checks that should be made while validating the JWT Claims."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Azure Active directory provider."
+                                          }
+                                        },
+                                        "azureStaticWebApps": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Azure Static Web Apps provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Static Web Apps registration."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Azure Static Web Apps provider."
+                                          }
+                                        },
+                                        "customOpenIdConnectProviders": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Set to `false` if the custom Open ID provider provider should not be enabled."
+                                                }
+                                              },
+                                              "login": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "nameClaimType": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of the claim that contains the users name."
+                                                    }
+                                                  },
+                                                  "scopes": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "string"
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The configuration settings of the login flow of the custom Open ID Connect provider."
+                                                }
+                                              },
+                                              "registration": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "clientCredential": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "clientSecretSettingName": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. The app setting that contains the client secret for the custom Open ID Connect provider."
+                                                        }
+                                                      },
+                                                      "method": {
+                                                        "type": "string",
+                                                        "allowedValues": [
+                                                          "ClientSecretPost"
+                                                        ],
+                                                        "metadata": {
+                                                          "description": "Required. The method that should be used to authenticate the user."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The authentication credentials of the custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "clientId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The client id of the custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "openIdConnectConfiguration": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "authorizationEndpoint": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint to be used to make an authorization request."
+                                                        }
+                                                      },
+                                                      "certificationUri": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that provides the keys necessary to validate the token."
+                                                        }
+                                                      },
+                                                      "issuer": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that issues the token."
+                                                        }
+                                                      },
+                                                      "tokenEndpoint": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint to be used to request a token."
+                                                        }
+                                                      },
+                                                      "wellKnownOpenIdConfiguration": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that contains all the configuration endpoints for the provider."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The configuration settings of the endpoints used for the custom Open ID Connect provider."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The configuration settings of the app registration for the custom Open ID Connect provider."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The alias of each custom Open ID Connect provider."
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider."
+                                          }
+                                        },
+                                        "facebook": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Facebook provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "graphApiVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The version of the Facebook api to be used while logging in."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "appId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The App ID of the app used for login."
+                                                  }
+                                                },
+                                                "appSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the app secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Facebook provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Facebook provider."
+                                          }
+                                        },
+                                        "gitHub": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the GitHub provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the GitHub provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the GitHub provider."
+                                          }
+                                        },
+                                        "google": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Google provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Google provider."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Google provider."
+                                          }
+                                        },
+                                        "legacyMicrosoftAccount": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the legacy Microsoft Account provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the legacy Microsoft Account provider."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the legacy Microsoft Account provider token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the legacy Microsoft Account provider."
+                                          }
+                                        },
+                                        "twitter": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Twitter provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "consumerKey": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                                  }
+                                                },
+                                                "consumerSecretSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Twitter provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Twitter provider."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of each of the identity providers used to configure App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedExternalRedirectUrls": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                          }
+                                        },
+                                        "cookieExpiration": {
+                                          "type": "object",
+                                          "properties": {
+                                            "convention": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "FixedTime",
+                                                "IdentityProviderDerived"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The convention used when determining the session cookie's expiration."
+                                              }
+                                            },
+                                            "timeToExpiration": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The time after the request is made when the session cookie should expire."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the session cookie's expiration."
+                                          }
+                                        },
+                                        "nonce": {
+                                          "type": "object",
+                                          "properties": {
+                                            "nonceExpirationInterval": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The time after the request is made when the nonce should expire."
+                                              }
+                                            },
+                                            "validateNonce": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the nonce should not be validated while completing the login flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the nonce used in the login flow."
+                                          }
+                                        },
+                                        "preserveUrlFragmentsForLogins": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the fragments from the request are preserved after the login request is made."
+                                          }
+                                        },
+                                        "routes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "logoutEndpoint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The endpoint at which a logout request should be made."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The routes that specify the endpoints used for login and logout requests."
+                                          }
+                                        },
+                                        "tokenStore": {
+                                          "type": "object",
+                                          "properties": {
+                                            "azureBlobStorage": {
+                                              "type": "object",
+                                              "properties": {
+                                                "sasUrlSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the app setting containing the SAS URL of the blob storage containing the tokens."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the storage of the tokens if blob storage is used."
+                                              }
+                                            },
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows."
+                                              }
+                                            },
+                                            "fileSystem": {
+                                              "type": "object",
+                                              "properties": {
+                                                "directory": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The directory in which the tokens will be stored."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the storage of the tokens if a file system is used."
+                                              }
+                                            },
+                                            "tokenRefreshExtensionHours": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the token store."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow of users using App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "platform": {
+                                      "type": "object",
+                                      "properties": {
+                                        "configFilePath": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The path of the config file containing auth settings if they come from a file. If the path is relative, base will the site's root directory."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                          }
+                                        },
+                                        "runtimeVersion": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the platform of App Service Authentication/Authorization."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of an authSettingsV2 configuration."
+                              }
+                            },
+                            "azureStorageAccountConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "azurestorageaccounts"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "accessKey": {
+                                        "type": "securestring",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Access key for the storage account."
+                                        }
+                                      },
+                                      "accountName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the storage account."
+                                        }
+                                      },
+                                      "mountPath": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                        }
+                                      },
+                                      "protocol": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "Http",
+                                          "Nfs",
+                                          "Smb"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Mounting protocol to use for the storage account."
+                                        }
+                                      },
+                                      "shareName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                        }
+                                      },
+                                      "type": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "AzureBlob",
+                                          "AzureFiles"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Type of storage."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Azure Storage Info configuration."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of an Azure Storage Account configuration."
+                              }
+                            },
+                            "backupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "backup"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "backupName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name of the backup."
+                                      }
+                                    },
+                                    "backupSchedule": {
+                                      "type": "object",
+                                      "properties": {
+                                        "frequencyInterval": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. How often the backup should be executed (e.g. for weekly backup, this should be set to 7 and FrequencyUnit should be set to Day)."
+                                          }
+                                        },
+                                        "frequencyUnit": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Day",
+                                            "Hour"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The unit of time for how often the backup should be executed (e.g. for weekly backup, this should be set to Day and FrequencyInterval should be set to 7)."
+                                          }
+                                        },
+                                        "keepAtLeastOneBackup": {
+                                          "type": "bool",
+                                          "metadata": {
+                                            "description": "Required. Set to `True` if the retention policy should always keep at least one backup in the storage account, regardless how old it is."
+                                          }
+                                        },
+                                        "retentionPeriodInDays": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. After how many days backups should be deleted."
+                                          }
+                                        },
+                                        "startTime": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. When the schedule should start working."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Schedule for the backup if it is executed periodically."
+                                      }
+                                    },
+                                    "databases": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "connectionString": {
+                                            "type": "securestring",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Contains a connection string to a database which is being backed up or restored. If the restore should happen to a new database, the database name inside is the new one."
+                                            }
+                                          },
+                                          "connectionStringName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Contains a connection string name that is linked to the SiteConfig.ConnectionStrings. This is used during restore with overwrite connection strings options."
+                                            }
+                                          },
+                                          "databaseType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "LocalMySql",
+                                              "MySql",
+                                              "PostgreSql",
+                                              "SqlAzure"
+                                            ],
+                                            "metadata": {
+                                              "description": "Required. Database type (e.g. SqlAzure / MySql)."
+                                            }
+                                          },
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of the setting."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Databases included in the backup."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `True` if the backup schedule is enabled (must be included in that case), `false` if the backup schedule should be disabled."
+                                      }
+                                    },
+                                    "storageAccountUrl": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SAS URL to the container."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a backup configuration."
+                              }
+                            },
+                            "connectionStringsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "connectionstrings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "type": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "ApiHub",
+                                          "Custom",
+                                          "DocDb",
+                                          "EventHub",
+                                          "MySql",
+                                          "NotificationHub",
+                                          "PostgreSQL",
+                                          "RedisCache",
+                                          "SQLAzure",
+                                          "SQLServer",
+                                          "ServiceBus"
+                                        ],
+                                        "metadata": {
+                                          "description": "Required. Type of database."
+                                        }
+                                      },
+                                      "value": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Value of pair."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the connection string setting."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a connection string configuration."
+                              }
+                            },
+                            "logsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "logs"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "applicationLogs": {
+                                      "type": "object",
+                                      "properties": {
+                                        "azureBlobStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to blob storage configuration."
+                                          }
+                                        },
+                                        "azureTableStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. SAS URL to an Azure table with add/query/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to azure table storage configuration."
+                                          }
+                                        },
+                                        "fileSystem": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to file system configuration."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application Logs for Azure configuration."
+                                      }
+                                    },
+                                    "detailedErrorMessages": {
+                                      "type": "object",
+                                      "properties": {
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Detailed error messages configuration."
+                                      }
+                                    },
+                                    "failedRequestsTracing": {
+                                      "type": "object",
+                                      "properties": {
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Failed requests tracing configuration."
+                                      }
+                                    },
+                                    "httpLogs": {
+                                      "type": "object",
+                                      "properties": {
+                                        "azureBlobStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Http logs to azure blob storage configuration."
+                                          }
+                                        },
+                                        "fileSystem": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove files older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "retentionInMb": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 25,
+                                              "maxValue": 100,
+                                              "metadata": {
+                                                "description": "Optional. Maximum size in megabytes that http log files can use. When reached old log files will be removed to make space for new ones."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Http logs to file system configuration."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. HTTP logs configuration."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a logs configuration."
+                              }
+                            },
+                            "metadataConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "metadata"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata key value pair."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a metadata configuration."
+                              }
+                            },
+                            "pushSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "pushsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "dynamicTagsJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                      }
+                                    },
+                                    "isPushEnabled": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                      }
+                                    },
+                                    "tagsRequiringAuth": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                      }
+                                    },
+                                    "tagWhitelistJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a pushSettings configuration."
+                              }
+                            },
+                            "webConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "web"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "acrUseManagedIdentityCreds": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Flag to use Managed Identity Creds for ACR pull."
+                                      }
+                                    },
+                                    "acrUserManagedIdentityID": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. If using user managed identity, the user managed identity ClientId."
+                                      }
+                                    },
+                                    "alwaysOn": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if 'Always On' is enabled."
+                                      }
+                                    },
+                                    "apiDefinition": {
+                                      "type": "object",
+                                      "properties": {
+                                        "url": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The URL of the API definition."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Information about the formal API definition for the app."
+                                      }
+                                    },
+                                    "apiManagementConfig": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. APIM-Api Identifier."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure API management settings linked to the app."
+                                      }
+                                    },
+                                    "appCommandLine": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. App command line to launch."
+                                      }
+                                    },
+                                    "appSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Name of the pair."
+                                            }
+                                          },
+                                          "value": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Value of the pair."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application settings."
+                                      }
+                                    },
+                                    "autoHealEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if Auto Heal is enabled."
+                                      }
+                                    },
+                                    "autoHealRules": {
+                                      "type": "object",
+                                      "properties": {
+                                        "actions": {
+                                          "type": "object",
+                                          "properties": {
+                                            "actionType": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "CustomAction",
+                                                "LogEvent",
+                                                "Recycle"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Predefined action to be taken."
+                                              }
+                                            },
+                                            "customAction": {
+                                              "type": "object",
+                                              "properties": {
+                                                "exe": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Executable to be run."
+                                                  }
+                                                },
+                                                "parameters": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Parameters for the executable."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Custom action to be taken."
+                                              }
+                                            },
+                                            "minProcessExecutionTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Minimum time the process must execute before taking the action."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Actions to be executed when a rule is triggered."
+                                          }
+                                        },
+                                        "triggers": {
+                                          "type": "object",
+                                          "properties": {
+                                            "privateBytesInKB": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on private bytes."
+                                              }
+                                            },
+                                            "requests": {
+                                              "type": "object",
+                                              "properties": {
+                                                "count": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Request Count."
+                                                  }
+                                                },
+                                                "timeInterval": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Time interval."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on total requests."
+                                              }
+                                            },
+                                            "slowRequests": {
+                                              "$ref": "#/definitions/slowRequestBasedTriggerType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on request execution time."
+                                              }
+                                            },
+                                            "slowRequestsWithPath": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/slowRequestBasedTriggerType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on multiple Slow Requests Rule with path."
+                                              }
+                                            },
+                                            "statusCodes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "count": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Count."
+                                                    }
+                                                  },
+                                                  "path": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Path."
+                                                    }
+                                                  },
+                                                  "status": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. HTTP status code."
+                                                    }
+                                                  },
+                                                  "subStatus": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Sub Status."
+                                                    }
+                                                  },
+                                                  "timeInterval": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Time interval."
+                                                    }
+                                                  },
+                                                  "win32Status": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Win32 error code."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on status codes."
+                                              }
+                                            },
+                                            "statusCodesRange": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "count": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Count."
+                                                    }
+                                                  },
+                                                  "path": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Path."
+                                                    }
+                                                  },
+                                                  "statusCodes": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. HTTP status code."
+                                                    }
+                                                  },
+                                                  "timeInterval": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Time interval."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on status codes ranges."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Conditions that describe when to execute the auto-heal actions."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Auto Heal rules."
+                                      }
+                                    },
+                                    "autoSwapSlotName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Auto-swap slot name."
+                                      }
+                                    },
+                                    "azureStorageAccounts": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "type": "object",
+                                        "properties": {
+                                          "accessKey": {
+                                            "type": "securestring",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Access key for the storage account."
+                                            }
+                                          },
+                                          "accountName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the storage account."
+                                            }
+                                          },
+                                          "mountPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                            }
+                                          },
+                                          "protocol": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Http",
+                                              "Nfs",
+                                              "Smb"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Mounting protocol to use for the storage account."
+                                            }
+                                          },
+                                          "shareName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                            }
+                                          },
+                                          "type": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "AzureBlob",
+                                              "AzureFiles"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Type of storage."
+                                            }
+                                          }
+                                        },
+                                        "metadata": {
+                                          "description": "Required. A storage account configuration."
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of Azure Storage Accounts."
+                                      }
+                                    },
+                                    "connectionStrings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "connectionString": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Connection string value."
+                                            }
+                                          },
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of connection string."
+                                            }
+                                          },
+                                          "type": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "ApiHub",
+                                              "Custom",
+                                              "DocDb",
+                                              "EventHub",
+                                              "MySql",
+                                              "NotificationHub",
+                                              "PostgreSQL",
+                                              "RedisCache",
+                                              "SQLAzure",
+                                              "SQLServer",
+                                              "ServiceBus"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Type of database."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Connection strings."
+                                      }
+                                    },
+                                    "cors": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedOrigins": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Gets or sets the list of origins that should be allowed to make cross-origin calls (for example: http://example.com:12345). Use \"*\" to allow all."
+                                          }
+                                        },
+                                        "supportCredentials": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Gets or sets whether CORS requests with credentials are allowed. See [ref](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Requests_with_credentials) for more details."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Cross-Origin Resource Sharing (CORS) settings."
+                                      }
+                                    },
+                                    "defaultDocuments": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default documents."
+                                      }
+                                    },
+                                    "detailedErrorLoggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if detailed error logging is enabled."
+                                      }
+                                    },
+                                    "documentRoot": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Document root."
+                                      }
+                                    },
+                                    "elasticWebAppScaleLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to apps in plans where ElasticScaleEnabled is `true`."
+                                      }
+                                    },
+                                    "experiments": {
+                                      "type": "object",
+                                      "properties": {
+                                        "rampUpRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "actionHostName": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Hostname of a slot to which the traffic will be redirected if decided to. E.g. myapp-stage.azurewebsites.net."
+                                                }
+                                              },
+                                              "changeDecisionCallbackUrl": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified."
+                                                }
+                                              },
+                                              "changeIntervalInMinutes": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies interval in minutes to reevaluate ReroutePercentage."
+                                                }
+                                              },
+                                              "changeStep": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. In auto ramp up scenario this is the step to add/remove from `ReroutePercentage` until it reaches `MinReroutePercentage` or `MaxReroutePercentage`. Site metrics are checked every N minutes specified in `ChangeIntervalInMinutes`. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified in `ChangeDecisionCallbackUrl`."
+                                                }
+                                              },
+                                              "maxReroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies upper boundary below which ReroutePercentage will stay."
+                                                }
+                                              },
+                                              "minReroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies lower boundary above which ReroutePercentage will stay."
+                                                }
+                                              },
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of the routing rule. The recommended name would be to point to the slot which will receive the traffic in the experiment."
+                                                }
+                                              },
+                                              "reroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Percentage of the traffic which will be redirected to `ActionHostName`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. List of ramp-up rules."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. This is work around for polymorphic types."
+                                      }
+                                    },
+                                    "ftpsState": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AllAllowed",
+                                        "Disabled",
+                                        "FtpsOnly"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. State of FTP / FTPS service."
+                                      }
+                                    },
+                                    "functionAppScaleLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to the Consumption and Elastic Premium Plans."
+                                      }
+                                    },
+                                    "functionsRuntimeScaleMonitoringEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a value indicating whether functions runtime scale monitoring is enabled. When enabled, the ScaleController will not monitor event sources directly, but will instead call to the runtime to get scale status."
+                                      }
+                                    },
+                                    "handlerMappings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "arguments": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Command-line arguments to be passed to the script processor."
+                                            }
+                                          },
+                                          "extension": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Requests with this extension will be handled using the specified FastCGI application."
+                                            }
+                                          },
+                                          "scriptProcessor": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The absolute path to the FastCGI application."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Handler mappings."
+                                      }
+                                    },
+                                    "healthCheckPath": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Health check path."
+                                      }
+                                    },
+                                    "http20Enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allow clients to connect over http2.0."
+                                      }
+                                    },
+                                    "httpLoggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if HTTP logging is enabled."
+                                      }
+                                    },
+                                    "ipSecurityRestrictions": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/scmIpSecurityRestrictionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for main."
+                                      }
+                                    },
+                                    "ipSecurityRestrictionsDefaultAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default action for main access restriction if no rules are matched."
+                                      }
+                                    },
+                                    "javaContainer": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java container."
+                                      }
+                                    },
+                                    "javaContainerVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java container version."
+                                      }
+                                    },
+                                    "javaVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java version."
+                                      }
+                                    },
+                                    "keyVaultReferenceIdentity": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Identity to use for Key Vault Reference authentication."
+                                      }
+                                    },
+                                    "limits": {
+                                      "type": "object",
+                                      "properties": {
+                                        "maxDiskSizeInMb": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed disk size usage in MB."
+                                          }
+                                        },
+                                        "maxMemoryInMb": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed memory usage in MB."
+                                          }
+                                        },
+                                        "maxPercentageCpu": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed CPU usage percentage."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Site limits."
+                                      }
+                                    },
+                                    "linuxFxVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Linux App Framework and version."
+                                      }
+                                    },
+                                    "loadBalancing": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "LeastRequests",
+                                        "LeastRequestsWithTieBreaker",
+                                        "LeastResponseTime",
+                                        "PerSiteRoundRobin",
+                                        "RequestHash",
+                                        "WeightedRoundRobin",
+                                        "WeightedTotalTraffic"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Site load balancing."
+                                      }
+                                    },
+                                    "localMySqlEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to enable local MySQL."
+                                      }
+                                    },
+                                    "logsDirectorySizeLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. HTTP logs directory size limit."
+                                      }
+                                    },
+                                    "managedPipelineMode": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Classic",
+                                        "Integrated"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Managed pipeline mode."
+                                      }
+                                    },
+                                    "managedServiceIdentityId": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Managed Service Identity Id."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Pair name."
+                                            }
+                                          },
+                                          "value": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Pair Value."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application metadata. This property cannot be retrieved, since it may contain secrets."
+                                      }
+                                    },
+                                    "minimumElasticInstanceCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 20,
+                                      "metadata": {
+                                        "description": "Optional. Number of minimum instance count for a site. This setting only applies to the Elastic Plans."
+                                      }
+                                    },
+                                    "minTlsCipherSuite": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "TLS_AES_128_GCM_SHA256",
+                                        "TLS_AES_256_GCM_SHA384",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                                        "TLS_RSA_WITH_AES_128_CBC_SHA",
+                                        "TLS_RSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_RSA_WITH_AES_256_CBC_SHA",
+                                        "TLS_RSA_WITH_AES_256_CBC_SHA256",
+                                        "TLS_RSA_WITH_AES_256_GCM_SHA384"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The minimum strength TLS cipher suite allowed for an application."
+                                      }
+                                    },
+                                    "minTlsVersion": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "1.0",
+                                        "1.1",
+                                        "1.2",
+                                        "1.3"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. MinTlsVersion: configures the minimum version of TLS required for SSL requests."
+                                      }
+                                    },
+                                    "netFrameworkVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. .NET Framework version."
+                                      }
+                                    },
+                                    "nodeVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of Node.js."
+                                      }
+                                    },
+                                    "numberOfWorkers": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Number of workers."
+                                      }
+                                    },
+                                    "phpVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of PHP."
+                                      }
+                                    },
+                                    "powerShellVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of PowerShell."
+                                      }
+                                    },
+                                    "preWarmedInstanceCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 10,
+                                      "metadata": {
+                                        "description": "Optional. Number of preWarmed instances. This setting only applies to the Consumption and Elastic Plans."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Property to allow or block all public traffic."
+                                      }
+                                    },
+                                    "publishingUsername": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Publishing user name."
+                                      }
+                                    },
+                                    "push": {
+                                      "type": "object",
+                                      "properties": {
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "dynamicTagsJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                              }
+                                            },
+                                            "isPushEnabled": {
+                                              "type": "bool",
+                                              "metadata": {
+                                                "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                              }
+                                            },
+                                            "tagsRequiringAuth": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                              }
+                                            },
+                                            "tagWhitelistJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. PushSettings resource specific properties."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Push endpoint settings."
+                                      }
+                                    },
+                                    "pythonVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of Python."
+                                      }
+                                    },
+                                    "remoteDebuggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if remote debugging is enabled."
+                                      }
+                                    },
+                                    "remoteDebuggingVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Remote debugging version."
+                                      }
+                                    },
+                                    "requestTracingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if request tracing is enabled."
+                                      }
+                                    },
+                                    "requestTracingExpirationTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request tracing expiration time."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictions": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/scmIpSecurityRestrictionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for scm."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionsDefaultAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default action for scm access restriction if no rules are matched."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionsUseMain": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for scm to use main."
+                                      }
+                                    },
+                                    "scmMinTlsVersion": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "1.0",
+                                        "1.1",
+                                        "1.2",
+                                        "1.3"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. ScmMinTlsVersion: configures the minimum version of TLS required for SSL requests for SCM site."
+                                      }
+                                    },
+                                    "scmType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "BitbucketGit",
+                                        "BitbucketHg",
+                                        "CodePlexGit",
+                                        "CodePlexHg",
+                                        "Dropbox",
+                                        "ExternalGit",
+                                        "ExternalHg",
+                                        "GitHub",
+                                        "LocalGit",
+                                        "None",
+                                        "OneDrive",
+                                        "Tfs",
+                                        "VSO",
+                                        "VSTSRM"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SCM type."
+                                      }
+                                    },
+                                    "tracingOptions": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tracing options."
+                                      }
+                                    },
+                                    "use32BitWorkerProcess": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to use 32-bit worker process."
+                                      }
+                                    },
+                                    "virtualApplications": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "physicalPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Physical path."
+                                            }
+                                          },
+                                          "preloadEnabled": {
+                                            "type": "bool",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Set to `true` if preloading is enabled."
+                                            }
+                                          },
+                                          "virtualDirectories": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "object",
+                                              "properties": {
+                                                "physicalPath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Physical path."
+                                                  }
+                                                },
+                                                "virtualPath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Path to virtual application."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Virtual directories for virtual application."
+                                            }
+                                          },
+                                          "virtualPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Virtual path."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual applications."
+                                      }
+                                    },
+                                    "vnetName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual Network name."
+                                      }
+                                    },
+                                    "vnetPrivatePortsCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of private ports assigned to this app. These will be assigned dynamically on runtime."
+                                      }
+                                    },
+                                    "vnetRouteAllEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+                                      }
+                                    },
+                                    "websiteTimeZone": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Sets the time zone a site uses for generating timestamps. Compatible with Linux and Windows App Service. Setting the WEBSITE_TIME_ZONE app setting takes precedence over this config. For Linux, expects tz database values https://www.iana.org/time-zones (for a quick reference see [ref](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)). For Windows, expects one of the time zones listed under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones."
+                                      }
+                                    },
+                                    "webSocketsEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if WebSocket is enabled."
+                                      }
+                                    },
+                                    "windowsFxVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Xenon App Framework and version."
+                                      }
+                                    },
+                                    "xManagedServiceIdentityId": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Explicit Managed Service Identity Id."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a web configuration."
+                              }
+                            },
+                            "slowRequestBasedTriggerType": {
+                              "type": "object",
+                              "properties": {
+                                "count": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Count."
+                                  }
+                                },
+                                "path": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Path."
+                                  }
+                                },
+                                "timeInterval": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time interval."
+                                  }
+                                },
+                                "timeTaken": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time taken."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of aslow request based trigger."
+                              }
+                            },
+                            "scmIpSecurityRestrictionType": {
+                              "type": "object",
+                              "properties": {
+                                "action": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Allow",
+                                    "Deny"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Allow or Deny access for this IP range."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule description."
+                                  }
+                                },
+                                "headers": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "metadata": {
+                                      "description": "Required. A header."
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule headers.\nX-Forwarded-Host (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), all hosts(or lack of) are allowed.\n- A value is compared using ordinal-ignore-case (excluding port number).\n- Subdomain wildcards are permitted but don't match the root domain. For example, *.contoso.com matches the subdomain foo.contoso.com\nbut not the root domain contoso.com or multi-level foo.bar.contoso.com\n- Unicode host names are allowed but are converted to Punycode for matching.\n\nX-Forwarded-For (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), any forwarded-for chains (or lack of) are allowed.\n- If any address (excluding port number) in the chain (comma separated) matches the CIDR defined by the property.\n\nX-Azure-FDID and X-FD-HealthProbe.\nThe matching logic is exact match."
+                                  }
+                                },
+                                "ipAddress": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP address the security restriction is valid for. It can be in form of pure ipv4 address (required SubnetMask property) or CIDR notation such as ipv4/mask (leading bit match). For CIDR, SubnetMask property must not be specified."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule name."
+                                  }
+                                },
+                                "priority": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Priority of IP restriction rule."
+                                  }
+                                },
+                                "subnetMask": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Subnet mask for the range of IP addresses the restriction is valid for."
+                                  }
+                                },
+                                "subnetTrafficTag": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. (internal) Subnet traffic tag."
+                                  }
+                                },
+                                "tag": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Default",
+                                    "ServiceTag",
+                                    "XffProxy"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Defines what this IP filter will be used for. This is to support IP filtering on proxies."
+                                  }
+                                },
+                                "vnetSubnetResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Virtual network resource id."
+                                  }
+                                },
+                                "vnetTrafficTag": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. (internal) Vnet traffic tag."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a IP security restriction."
+                              }
+                            },
+                            "basicPublishingCredentialsPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "ftp",
+                                    "scm"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The name of the resource."
+                                  }
+                                },
+                                "allow": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location for all Resources."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a basic publishing credential policy."
+                              }
+                            },
+                            "hybridConnectionRelayType": {
+                              "type": "object",
+                              "properties": {
+                                "hybridConnectionResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                  }
+                                },
+                                "sendKeyName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the authorization rule send key to use."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a hybrid connection relay."
+                              }
+                            },
+                            "hostNameBindingType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hostname in the hostname binding. Defaults to the host name of the app/slot if not specified."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "azureResourceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure resource name."
+                                  }
+                                },
+                                "azureResourceType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "TrafficManager",
+                                    "Website"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                  }
+                                },
+                                "customHostNameDnsRecordType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "A",
+                                    "CName"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                  }
+                                },
+                                "domainResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Fully qualified ARM domain resource URI."
+                                  }
+                                },
+                                "hostNameType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Managed",
+                                    "Verified"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                  }
+                                },
+                                "siteName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. App Service app name."
+                                  }
+                                },
+                                "sslState": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "IpBasedEnabled",
+                                    "SniEnabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                  }
+                                },
+                                "thumbprint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. SSL certificate thumbprint."
+                                  }
+                                },
+                                "certificate": {
+                                  "$ref": "#/definitions/certificateType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate creation properties. If specified, a certificate will be created and used for this hostname binding."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a host name binding."
+                              }
+                            },
+                            "_1.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "certificateType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Certificate name."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource location."
+                                  }
+                                },
+                                "hostNames": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate host names."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault resource ID."
+                                  }
+                                },
+                                "keyVaultSecretName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault secret name."
+                                  }
+                                },
+                                "serverFarmResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Server farm resource ID."
+                                  }
+                                },
+                                "canonicalName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                  }
+                                },
+                                "password": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate password."
+                                  }
+                                },
+                                "pfxBlob": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate data in PFX format."
+                                  }
+                                },
+                                "domainValidationMethod": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Method of domain validation for free certificate."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a certificate.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "../modules/certificate.bicep"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "privateEndpointSingleServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private Endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the Private Endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the slot."
+                              }
+                            },
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "allowedValues": [
+                                "functionapp",
+                                "functionapp,linux",
+                                "functionapp,workflowapp",
+                                "functionapp,workflowapp,linux",
+                                "functionapp,linux,container",
+                                "functionapp,linux,container,azurecontainerapps",
+                                "app,linux",
+                                "app",
+                                "linux,api",
+                                "api",
+                                "app,linux,container",
+                                "app,container,windows"
+                              ],
+                              "metadata": {
+                                "description": "Required. Type of site to deploy."
+                              }
+                            },
+                            "serverFarmResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the app service plan to use for the slot."
+                              }
+                            },
+                            "managedEnvironmentResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                              }
+                            },
+                            "httpsOnly": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
+                              }
+                            },
+                            "clientAffinityEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. If client affinity is enabled."
+                              }
+                            },
+                            "clientAffinityProxyEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance. Default is true."
+                              }
+                            },
+                            "clientAffinityPartitioningEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. To enable client affinity partitioning using CHIPS cookies, this will add the partitioned property to the affinity cookies; false to stop sending partitioned affinity cookies. Default is false."
+                              }
+                            },
+                            "appServiceEnvironmentResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the app service environment to use for this resource."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "keyVaultAccessIdentityResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                              }
+                            },
+                            "storageAccountRequired": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Checks if Customer provided storage account is required."
+                              }
+                            },
+                            "virtualNetworkSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                              }
+                            },
+                            "siteConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/siteConfig"
+                                },
+                                "description": "Optional. The site config object."
+                              },
+                              "defaultValue": {
+                                "alwaysOn": true
+                              }
+                            },
+                            "functionAppConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/functionAppConfig"
+                                },
+                                "description": "Optional. The Function App config object."
+                              },
+                              "nullable": true
+                            },
+                            "configs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/configType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The web site config."
+                              }
+                            },
+                            "extensions": {
+                              "type": "array",
+                              "items": {
+                                "type": "object"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The extensions configuration."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointSingleServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "clientCertEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                              }
+                            },
+                            "clientCertExclusionPaths": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                              }
+                            },
+                            "clientCertMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/clientCertMode"
+                                },
+                                "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
+                              },
+                              "defaultValue": "Optional"
+                            },
+                            "cloningInfo": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/cloningInfo"
+                                },
+                                "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                              },
+                              "nullable": true
+                            },
+                            "containerSize": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Size of the function container."
+                              }
+                            },
+                            "customDomainVerificationId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                              }
+                            },
+                            "dailyMemoryTimeQuota": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                              }
+                            },
+                            "enabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                              }
+                            },
+                            "hostNameSslStates": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/hostNameSslStates"
+                                },
+                                "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                              },
+                              "nullable": true
+                            },
+                            "hyperV": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Hyper-V sandbox."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                                },
+                                "description": "Optional. Allow or block all public traffic."
+                              },
+                              "nullable": true
+                            },
+                            "redundancyMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/redundancyMode"
+                                },
+                                "description": "Optional. Site redundancy mode."
+                              },
+                              "defaultValue": "None"
+                            },
+                            "basicPublishingCredentialsPolicies": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The site publishing credential policy names which are associated with the site slot."
+                              }
+                            },
+                            "outboundVnetRouting": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                                },
+                                "description": "Optional. The outbound VNET routing configuration for the site."
+                              },
+                              "nullable": true
+                            },
+                            "hybridConnectionRelays": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hybridConnectionRelayType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Names of hybrid connection relays to connect app with."
+                              }
+                            },
+                            "hostNameBindings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hostNameBindingType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Host Name Bindings for the slot."
+                              }
+                            },
+                            "dnsConfiguration": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/dnsConfiguration"
+                                },
+                                "description": "Optional. Property to configure various DNS related settings for a site."
+                              },
+                              "nullable": true
+                            },
+                            "autoGeneratedDomainNameLabelScope": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                                },
+                                "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                              },
+                              "nullable": true
+                            },
+                            "sshEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Whether to enable SSH access."
+                              }
+                            },
+                            "daprConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/daprConfig"
+                                },
+                                "description": "Optional. Dapr configuration of the app."
+                              },
+                              "nullable": true
+                            },
+                            "ipMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/ipMode"
+                                },
+                                "description": "Optional. Specifies the IP mode of the app."
+                              },
+                              "nullable": true
+                            },
+                            "resourceConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/resourceConfig"
+                                },
+                                "description": "Optional. Function app resource requirements."
+                              },
+                              "nullable": true
+                            },
+                            "workloadProfileName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Workload profile name for function app to execute on."
+                              }
+                            },
+                            "hostNamesDisabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                              }
+                            },
+                            "reserved": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                              }
+                            },
+                            "scmSiteAlsoStopped": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                              }
+                            },
+                            "e2eEncryptionEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. End to End Encryption Setting."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                              "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                              "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                            },
+                            "managedEnvironmentSupportedKinds": [
+                              "functionapp,linux,container,azurecontainerapps"
+                            ]
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-siteslot.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2025-03-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "slot": {
+                              "type": "Microsoft.Web/sites/slots",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "kind": "[parameters('kind')]",
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "properties": {
+                                "managedEnvironmentId": "[if(not(empty(parameters('managedEnvironmentResourceId'))), parameters('managedEnvironmentResourceId'), null())]",
+                                "serverFarmId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), or(not(empty(reference('app').managedEnvironmentId)), not(empty(parameters('managedEnvironmentResourceId'))))), null(), parameters('serverFarmResourceId'))]",
+                                "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
+                                "clientAffinityProxyEnabled": "[parameters('clientAffinityProxyEnabled')]",
+                                "clientAffinityPartitioningEnabled": "[parameters('clientAffinityPartitioningEnabled')]",
+                                "httpsOnly": "[parameters('httpsOnly')]",
+                                "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                                "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                                "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                                "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]",
+                                "siteConfig": "[parameters('siteConfig')]",
+                                "functionAppConfig": "[parameters('functionAppConfig')]",
+                                "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                                "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                                "clientCertMode": "[parameters('clientCertMode')]",
+                                "cloningInfo": "[parameters('cloningInfo')]",
+                                "containerSize": "[parameters('containerSize')]",
+                                "customDomainVerificationId": "[parameters('customDomainVerificationId')]",
+                                "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                                "enabled": "[parameters('enabled')]",
+                                "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                                "hyperV": "[parameters('hyperV')]",
+                                "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                                "redundancyMode": "[parameters('redundancyMode')]",
+                                "dnsConfiguration": "[parameters('dnsConfiguration')]",
+                                "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                                "outboundVnetRouting": "[parameters('outboundVnetRouting')]",
+                                "sshEnabled": "[parameters('sshEnabled')]",
+                                "daprConfig": "[parameters('daprConfig')]",
+                                "ipMode": "[parameters('ipMode')]",
+                                "resourceConfig": "[parameters('resourceConfig')]",
+                                "workloadProfileName": "[parameters('workloadProfileName')]",
+                                "hostNamesDisabled": "[parameters('hostNamesDisabled')]",
+                                "reserved": "[parameters('reserved')]",
+                                "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
+                                "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]"
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "slot_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_diagnosticSettings": {
+                              "copy": {
+                                "name": "slot_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_roleAssignments": {
+                              "copy": {
+                                "name": "slot_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_basicPublishingCredentialsPolicies": {
+                              "copy": {
+                                "name": "slot_basicPublishingCredentialsPolicies",
+                                "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                                  },
+                                  "allow": {
+                                    "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "11365254968018384105"
+                                    },
+                                    "name": "Web Site Slot Basic Publishing Credentials Policies",
+                                    "description": "This module deploys a Web Site Slot Basic Publishing Credentials Policy."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "scm",
+                                        "ftp"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The name of the resource."
+                                      }
+                                    },
+                                    "allow": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                      }
+                                    },
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-slotbasicpubcredpolicy.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "properties": {
+                                        "allow": "[parameters('allow')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the basic publishing credential policy."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the basic publishing credential policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference(resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name')), '2025-03-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_hybridConnectionRelays": {
+                              "copy": {
+                                "name": "slot_hybridConnectionRelays",
+                                "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "hybridConnectionResourceId": {
+                                    "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].hybridConnectionResourceId]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "sendKeyName": {
+                                    "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "8029912709642202991"
+                                    },
+                                    "name": "Web/Function Apps Slot Hybrid Connection Relay",
+                                    "description": "This module deploys a Site Slot Hybrid Connection Namespace Relay."
+                                  },
+                                  "parameters": {
+                                    "hybridConnectionResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "sendKeyName": {
+                                      "type": "string",
+                                      "defaultValue": "defaultSender",
+                                      "metadata": {
+                                        "description": "Optional. Name of the authorization rule send key to use."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-slothybconnnamespacerelay.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                      "properties": {
+                                        "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                                        "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                                        "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                                        "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                        "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[0]]",
+                                        "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[1])]",
+                                        "sendKeyName": "[parameters('sendKeyName')]",
+                                        "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2024-01-01').primaryKey]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the hybrid connection relay.."
+                                      },
+                                      "value": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the hybrid connection relay."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[3])]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the resource was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_hostNameBindings": {
+                              "copy": {
+                                "name": "slot_hostNameBindings",
+                                "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-HostNameBinding-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'name'), reference('slot').defaultHostName)]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "kind": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'kind')]"
+                                  },
+                                  "azureResourceName": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceName')]"
+                                  },
+                                  "azureResourceType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceType')]"
+                                  },
+                                  "customHostNameDnsRecordType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'customHostNameDnsRecordType')]"
+                                  },
+                                  "domainResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'domainResourceId')]"
+                                  },
+                                  "hostNameType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'hostNameType')]"
+                                  },
+                                  "siteName": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'siteName')]"
+                                  },
+                                  "sslState": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'sslState')]"
+                                  },
+                                  "thumbprint": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'thumbprint')]"
+                                  },
+                                  "certificate": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'certificate')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "16648305975161016120"
+                                    },
+                                    "name": "Web/Function Apps Slot Host Name Bindings",
+                                    "description": "This module deploys a Site Slot Host Name Binding."
+                                  },
+                                  "definitions": {
+                                    "certificateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Certificate name."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource location."
+                                          }
+                                        },
+                                        "hostNames": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate host names."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault resource ID."
+                                          }
+                                        },
+                                        "keyVaultSecretName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault secret name."
+                                          }
+                                        },
+                                        "serverFarmResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Server farm resource ID."
+                                          }
+                                        },
+                                        "canonicalName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                          }
+                                        },
+                                        "password": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate password."
+                                          }
+                                        },
+                                        "pfxBlob": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate data in PFX format."
+                                          }
+                                        },
+                                        "domainValidationMethod": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Method of domain validation for free certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a certificate.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "../../modules/certificate.bicep"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Hostname in the hostname binding."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Kind of resource."
+                                      }
+                                    },
+                                    "azureResourceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure resource name."
+                                      }
+                                    },
+                                    "azureResourceType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Website",
+                                        "TrafficManager"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                      }
+                                    },
+                                    "customHostNameDnsRecordType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "CName",
+                                        "A"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                      }
+                                    },
+                                    "domainResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Fully qualified ARM domain resource URI."
+                                      }
+                                    },
+                                    "hostNameType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Verified",
+                                        "Managed"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                      }
+                                    },
+                                    "siteName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. App Service app name."
+                                      }
+                                    },
+                                    "sslState": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "SniEnabled",
+                                        "IpBasedEnabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                      }
+                                    },
+                                    "thumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SSL certificate thumbprint."
+                                      }
+                                    },
+                                    "certificate": {
+                                      "$ref": "#/definitions/certificateType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate object with properties for certificate creation. The expected structure matches the certificateType defined in host-name-binding-type.bicep."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Resource location."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "app::slot": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites/slots",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "hostNameBinding": {
+                                      "type": "Microsoft.Web/sites/slots/hostNameBindings",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                      "kind": "[parameters('kind')]",
+                                      "properties": {
+                                        "azureResourceName": "[parameters('azureResourceName')]",
+                                        "azureResourceType": "[parameters('azureResourceType')]",
+                                        "customHostNameDnsRecordType": "[parameters('customHostNameDnsRecordType')]",
+                                        "domainId": "[parameters('domainResourceId')]",
+                                        "hostNameType": "[parameters('hostNameType')]",
+                                        "siteName": "[parameters('siteName')]",
+                                        "sslState": "[coalesce(parameters('sslState'), if(or(not(empty(parameters('thumbprint'))), not(empty(parameters('certificate')))), 'SniEnabled', null()))]",
+                                        "thumbprint": "[coalesce(parameters('thumbprint'), tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value'))]"
+                                      },
+                                      "dependsOn": [
+                                        "sslCertificate"
+                                      ]
+                                    },
+                                    "sslCertificate": {
+                                      "condition": "[not(empty(parameters('certificate')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Cert', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', replace(parameters('name'), '.', '-')))]"
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "kind": {
+                                            "value": "[parameters('kind')]"
+                                          },
+                                          "hostNames": {
+                                            "value": "[coalesce(tryGet(parameters('certificate'), 'hostNames'), createArray(parameters('name')))]"
+                                          },
+                                          "password": {
+                                            "value": "[tryGet(parameters('certificate'), 'password')]"
+                                          },
+                                          "pfxBlob": {
+                                            "value": "[tryGet(parameters('certificate'), 'pfxBlob')]"
+                                          },
+                                          "serverFarmResourceId": {
+                                            "value": "[tryGet(parameters('certificate'), 'serverFarmResourceId')]"
+                                          },
+                                          "keyVaultResourceId": {
+                                            "value": "[tryGet(parameters('certificate'), 'keyVaultResourceId')]"
+                                          },
+                                          "keyVaultSecretName": {
+                                            "value": "[tryGet(parameters('certificate'), 'keyVaultSecretName')]"
+                                          },
+                                          "canonicalName": {
+                                            "value": "[tryGet(parameters('certificate'), 'canonicalName')]"
+                                          },
+                                          "domainValidationMethod": {
+                                            "value": "[tryGet(parameters('certificate'), 'domainValidationMethod')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "5581960621773069173"
+                                            },
+                                            "name": "Web/Function Apps Certificates",
+                                            "description": "This module deploys a Web/Function App Certificate."
+                                          },
+                                          "definitions": {
+                                            "certificateType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. Certificate name."
+                                                  }
+                                                },
+                                                "location": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource location."
+                                                  }
+                                                },
+                                                "hostNames": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate host names."
+                                                  }
+                                                },
+                                                "tags": {
+                                                  "type": "object",
+                                                  "metadata": {
+                                                    "__bicep_resource_derived_type!": {
+                                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                    },
+                                                    "description": "Optional. Tags of the resource."
+                                                  },
+                                                  "nullable": true
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Kind of resource."
+                                                  }
+                                                },
+                                                "keyVaultResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault resource ID."
+                                                  }
+                                                },
+                                                "keyVaultSecretName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault secret name."
+                                                  }
+                                                },
+                                                "serverFarmResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Server farm resource ID."
+                                                  }
+                                                },
+                                                "canonicalName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                  }
+                                                },
+                                                "password": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate password."
+                                                  }
+                                                },
+                                                "pfxBlob": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate data in PFX format."
+                                                  }
+                                                },
+                                                "domainValidationMethod": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Method of domain validation for free certificate."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a certificate."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Certificate name."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Resource location."
+                                              }
+                                            },
+                                            "hostNames": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate host names."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                },
+                                                "description": "Optional. Tags of the resource."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "kind": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Kind of resource."
+                                              }
+                                            },
+                                            "keyVaultResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key Vault resource ID."
+                                              }
+                                            },
+                                            "keyVaultSecretName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key Vault secret name."
+                                              }
+                                            },
+                                            "serverFarmResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Server farm resource ID."
+                                              }
+                                            },
+                                            "canonicalName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                              }
+                                            },
+                                            "password": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate password."
+                                              }
+                                            },
+                                            "pfxBlob": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate data in PFX format."
+                                              }
+                                            },
+                                            "domainValidationMethod": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Method of domain validation for free certificate."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "certificate": {
+                                              "type": "Microsoft.Web/certificates",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "kind": "[parameters('kind')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "hostNames": "[parameters('hostNames')]",
+                                                "password": "[parameters('password')]",
+                                                "pfxBlob": "[parameters('pfxBlob')]",
+                                                "serverFarmId": "[parameters('serverFarmResourceId')]",
+                                                "keyVaultId": "[parameters('keyVaultResourceId')]",
+                                                "keyVaultSecretName": "[parameters('keyVaultSecretName')]",
+                                                "canonicalName": "[parameters('canonicalName')]",
+                                                "domainValidationMethod": "[parameters('domainValidationMethod')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the certificate."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/certificates', parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the certificate was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the certificate."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "thumbprint": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The thumbprint of the certificate."
+                                              },
+                                              "value": "[reference('certificate').thumbprint]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('certificate', '2024-11-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the host name binding."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the host name binding."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/hostNameBindings', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the resource was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "certificateThumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The thumbprint of the certificate."
+                                      },
+                                      "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value')]"
+                                    },
+                                    "certificateResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The resource ID of the certificate."
+                                      },
+                                      "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'resourceId'), 'value')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_config": {
+                              "copy": {
+                                "name": "slot_config",
+                                "count": "[length(coalesce(parameters('configs'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "applicationInsightResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                                  },
+                                  "properties": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                                  },
+                                  "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]",
+                                  "storageAccountResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountResourceId')]"
+                                  },
+                                  "storageAccountUseIdentityAuthentication": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "12001043390442225147"
+                                    },
+                                    "name": "Site App Settings",
+                                    "description": "This module deploys a Site App Setting."
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "appsettings",
+                                        "authsettings",
+                                        "authsettingsV2",
+                                        "azurestorageaccounts",
+                                        "backup",
+                                        "connectionstrings",
+                                        "logs",
+                                        "metadata",
+                                        "pushsettings",
+                                        "web"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The name of the config."
+                                      }
+                                    },
+                                    "properties": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. The properties of the config. Note: This parameter is highly dependent on the config type, defined by its name."
+                                      }
+                                    },
+                                    "currentAppSettings": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The key-values pairs of the current app settings."
+                                        }
+                                      },
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. The current app settings."
+                                      }
+                                    },
+                                    "storageAccountUseIdentityAuthentication": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                      }
+                                    },
+                                    "storageAccountResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                      }
+                                    },
+                                    "applicationInsightResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "app::slot": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites/slots",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-slotconfig.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "applicationInsights": {
+                                      "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.Insights/components",
+                                      "apiVersion": "2020-02-02",
+                                      "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
+                                      "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
+                                    },
+                                    "storageAccount": {
+                                      "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-01-01",
+                                      "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                                      "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "config": {
+                                      "type": "Microsoft.Web/sites/slots/config",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                      "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys('storageAccount', '2025-01-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/')), 'AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob, 'AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue, 'AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table), createObject())), if(not(empty(parameters('applicationInsightResourceId'))), shallowMerge(createArray(createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), if(not(contains(parameters('properties'), 'ApplicationInsightsAgent_EXTENSION_VERSION')), createObject('ApplicationInsightsAgent_EXTENSION_VERSION', if(contains(createArray('functionapp,linux', 'functionapp,workflowapp,linux', 'functionapp,linux,container', 'functionapp,linux,container,azurecontainerapps', 'app,linux', 'linux,api', 'app,linux,container'), reference('app::slot', '2025-03-01', 'full').kind), '~3', '~2')), createObject()))), createObject()))]",
+                                      "dependsOn": [
+                                        "app::slot",
+                                        "applicationInsights",
+                                        "storageAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the site config."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the site config."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/config', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the site config was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "app_extensions": {
+                              "copy": {
+                                "name": "app_extensions",
+                                "count": "[length(coalesce(parameters('extensions'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-Extension={1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('appName')]"
+                                  },
+                                  "slotName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('extensions'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "kind": {
+                                    "value": "[tryGet(coalesce(parameters('extensions'), createArray())[copyIndex()], 'kind')]"
+                                  },
+                                  "properties": {
+                                    "value": "[coalesce(parameters('extensions'), createArray())[copyIndex()].properties]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "8496500083519229596"
+                                    },
+                                    "name": "Site Deployment Extension ",
+                                    "description": "This module deploys a Site extension for MSDeploy."
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "slotName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "MSDeploy",
+                                      "allowedValues": [
+                                        "MSDeploy"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The name of the extension."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "defaultValue": "MSDeploy",
+                                      "allowedValues": [
+                                        "MSDeploy"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The kind of extension."
+                                      }
+                                    },
+                                    "properties": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/extensions@2024-04-01#properties/properties"
+                                        },
+                                        "description": "Optional. Sets the properties."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "app::slot": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites/slots",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-slotextension.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "msdeploy": {
+                                      "type": "Microsoft.Web/sites/slots/extensions",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                      "kind": "[parameters('kind')]",
+                                      "properties": "[parameters('properties')]"
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots/extensions', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the extensino was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            },
+                            "slot_privateEndpoints": {
+                              "copy": {
+                                "name": "slot_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-slot-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "18436885663402767850"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipVersionType": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                        },
+                                        "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                                      },
+                                      "defaultValue": "IPv4"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        },
+                                        "ipVersionType": "[parameters('ipVersionType')]"
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "9935179114830442414"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "slot"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the slot."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the slot."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the slot was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('slot', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('slot', '2025-03-01', 'full').location]"
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the slot."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            },
+                            "hostNameBindings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hostNameBindingsOutputType"
+                              },
+                              "metadata": {
+                                "description": "The host name bindings of the slot."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "resourceGroupName": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.resourceGroupName.value]",
+                                  "certificateThumbprint": "[tryGet(tryGet(reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateThumbprint'), 'value')]",
+                                  "certificateResourceId": "[tryGet(tryGet(reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateResourceId'), 'value')]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_basicPublishingCredentialsPolicies": {
+                      "copy": {
+                        "name": "app_basicPublishingCredentialsPolicies",
+                        "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-Site-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "webAppName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                          },
+                          "allow": {
+                            "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "14948693817081044849"
+                            },
+                            "name": "Web Site Basic Publishing Credentials Policies",
+                            "description": "This module deploys a Web Site Basic Publishing Credentials Policy."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "allowedValues": [
+                                "scm",
+                                "ftp"
+                              ],
+                              "metadata": {
+                                "description": "Required. The name of the resource."
+                              }
+                            },
+                            "allow": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Set to true to enable or false to disable a publishing method."
+                              }
+                            },
+                            "webAppName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-site-basicpublishingcredpolicy.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            {
+                              "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}', parameters('webAppName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "allow": "[parameters('allow')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the basic publishing credential policy."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the basic publishing credential policy."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference(resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name')), '2025-03-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_hybridConnectionRelays": {
+                      "copy": {
+                        "name": "app_hybridConnectionRelays",
+                        "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "hybridConnectionResourceId": {
+                            "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].hybridConnectionResourceId]"
+                          },
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "sendKeyName": {
+                            "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "16409478718621567661"
+                            },
+                            "name": "Web/Function Apps Hybrid Connection Relay",
+                            "description": "This module deploys a Site Hybrid Connection Namespace Relay."
+                          },
+                          "parameters": {
+                            "hybridConnectionResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the relay namespace hybrid connection."
+                              }
+                            },
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "sendKeyName": {
+                              "type": "string",
+                              "defaultValue": "defaultSender",
+                              "metadata": {
+                                "description": "Optional. Name of the authorization rule send key to use."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-site-hybconnnamespacerelay.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            {
+                              "type": "Microsoft.Web/sites/hybridConnectionNamespaces/relays",
+                              "apiVersion": "2025-03-01",
+                              "name": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                              "properties": {
+                                "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                                "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                                "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                                "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[0]]",
+                                "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[1])]",
+                                "sendKeyName": "[parameters('sendKeyName')]",
+                                "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2024-01-01').primaryKey]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the hybrid connection relay.."
+                              },
+                              "value": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the hybrid connection relay."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2])]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the resource was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_hostNameBindings": {
+                      "copy": {
+                        "name": "app_hostNameBindings",
+                        "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-HostNameBinding-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'name'), reference('app').defaultHostName)]"
+                          },
+                          "appName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "kind": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'kind')]"
+                          },
+                          "azureResourceName": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceName')]"
+                          },
+                          "azureResourceType": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceType')]"
+                          },
+                          "customHostNameDnsRecordType": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'customHostNameDnsRecordType')]"
+                          },
+                          "domainResourceId": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'domainResourceId')]"
+                          },
+                          "hostNameType": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'hostNameType')]"
+                          },
+                          "siteName": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'siteName')]"
+                          },
+                          "sslState": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'sslState')]"
+                          },
+                          "thumbprint": {
+                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'thumbprint')]"
+                          },
+                          "certificate": "[if(contains(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'certificate'), createObject('value', union(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()].certificate, createObject('serverFarmResourceId', coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()].certificate, 'serverFarmResourceId'), parameters('serverFarmResourceId'))))), createObject('value', null()))]",
+                          "location": {
+                            "value": "[parameters('location')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "3602988070549748557"
+                            },
+                            "name": "Web/Function Apps Slot Host Name Bindings",
+                            "description": "This module deploys a Site Slot Host Name Binding."
+                          },
+                          "definitions": {
+                            "certificateType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Certificate name."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource location."
+                                  }
+                                },
+                                "hostNames": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate host names."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault resource ID."
+                                  }
+                                },
+                                "keyVaultSecretName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault secret name."
+                                  }
+                                },
+                                "serverFarmResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Server farm resource ID."
+                                  }
+                                },
+                                "canonicalName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                  }
+                                },
+                                "password": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate password."
+                                  }
+                                },
+                                "pfxBlob": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate data in PFX format."
+                                  }
+                                },
+                                "domainValidationMethod": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Method of domain validation for free certificate."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a certificate.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "../modules/certificate.bicep"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "appName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Hostname in the hostname binding."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Kind of resource."
+                              }
+                            },
+                            "azureResourceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure resource name."
+                              }
+                            },
+                            "azureResourceType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Website",
+                                "TrafficManager"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                              }
+                            },
+                            "customHostNameDnsRecordType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "CName",
+                                "A"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                              }
+                            },
+                            "domainResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Fully qualified ARM domain resource URI."
+                              }
+                            },
+                            "hostNameType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Verified",
+                                "Managed"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                              }
+                            },
+                            "siteName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. App Service app name."
+                              }
+                            },
+                            "sslState": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Disabled",
+                                "SniEnabled",
+                                "IpBasedEnabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                              }
+                            },
+                            "thumbprint": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. SSL certificate thumbprint."
+                              }
+                            },
+                            "certificate": {
+                              "$ref": "#/definitions/certificateType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Certificate object with properties for certificate creation. The expected structure matches the certificateType defined in host-name-binding-type.bicep."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Resource location."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "app": {
+                              "existing": true,
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('appName')]"
+                            },
+                            "hostNameBinding": {
+                              "type": "Microsoft.Web/sites/hostNameBindings",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                              "kind": "[parameters('kind')]",
+                              "properties": {
+                                "azureResourceName": "[parameters('azureResourceName')]",
+                                "azureResourceType": "[parameters('azureResourceType')]",
+                                "customHostNameDnsRecordType": "[parameters('customHostNameDnsRecordType')]",
+                                "domainId": "[parameters('domainResourceId')]",
+                                "hostNameType": "[parameters('hostNameType')]",
+                                "siteName": "[parameters('siteName')]",
+                                "sslState": "[coalesce(parameters('sslState'), if(or(not(empty(parameters('thumbprint'))), not(empty(parameters('certificate')))), 'SniEnabled', null()))]",
+                                "thumbprint": "[coalesce(parameters('thumbprint'), tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value'))]"
+                              },
+                              "dependsOn": [
+                                "sslCertificate"
+                              ]
+                            },
+                            "sslCertificate": {
+                              "condition": "[not(empty(parameters('certificate')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Cert', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', replace(parameters('name'), '.', '-')))]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "kind": {
+                                    "value": "[parameters('kind')]"
+                                  },
+                                  "hostNames": {
+                                    "value": "[coalesce(tryGet(parameters('certificate'), 'hostNames'), createArray(parameters('name')))]"
+                                  },
+                                  "password": {
+                                    "value": "[tryGet(parameters('certificate'), 'password')]"
+                                  },
+                                  "pfxBlob": {
+                                    "value": "[tryGet(parameters('certificate'), 'pfxBlob')]"
+                                  },
+                                  "serverFarmResourceId": {
+                                    "value": "[tryGet(parameters('certificate'), 'serverFarmResourceId')]"
+                                  },
+                                  "keyVaultResourceId": {
+                                    "value": "[tryGet(parameters('certificate'), 'keyVaultResourceId')]"
+                                  },
+                                  "keyVaultSecretName": {
+                                    "value": "[tryGet(parameters('certificate'), 'keyVaultSecretName')]"
+                                  },
+                                  "canonicalName": {
+                                    "value": "[tryGet(parameters('certificate'), 'canonicalName')]"
+                                  },
+                                  "domainValidationMethod": {
+                                    "value": "[tryGet(parameters('certificate'), 'domainValidationMethod')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "5581960621773069173"
+                                    },
+                                    "name": "Web/Function Apps Certificates",
+                                    "description": "This module deploys a Web/Function App Certificate."
+                                  },
+                                  "definitions": {
+                                    "certificateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Certificate name."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource location."
+                                          }
+                                        },
+                                        "hostNames": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate host names."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault resource ID."
+                                          }
+                                        },
+                                        "keyVaultSecretName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault secret name."
+                                          }
+                                        },
+                                        "serverFarmResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Server farm resource ID."
+                                          }
+                                        },
+                                        "canonicalName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                          }
+                                        },
+                                        "password": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate password."
+                                          }
+                                        },
+                                        "pfxBlob": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate data in PFX format."
+                                          }
+                                        },
+                                        "domainValidationMethod": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Method of domain validation for free certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a certificate."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Certificate name."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Resource location."
+                                      }
+                                    },
+                                    "hostNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate host names."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Kind of resource."
+                                      }
+                                    },
+                                    "keyVaultResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Key Vault resource ID."
+                                      }
+                                    },
+                                    "keyVaultSecretName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Key Vault secret name."
+                                      }
+                                    },
+                                    "serverFarmResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Server farm resource ID."
+                                      }
+                                    },
+                                    "canonicalName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                      }
+                                    },
+                                    "password": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate password."
+                                      }
+                                    },
+                                    "pfxBlob": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate data in PFX format."
+                                      }
+                                    },
+                                    "domainValidationMethod": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Method of domain validation for free certificate."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "certificate": {
+                                      "type": "Microsoft.Web/certificates",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "kind": "[parameters('kind')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "hostNames": "[parameters('hostNames')]",
+                                        "password": "[parameters('password')]",
+                                        "pfxBlob": "[parameters('pfxBlob')]",
+                                        "serverFarmId": "[parameters('serverFarmResourceId')]",
+                                        "keyVaultId": "[parameters('keyVaultResourceId')]",
+                                        "keyVaultSecretName": "[parameters('keyVaultSecretName')]",
+                                        "canonicalName": "[parameters('canonicalName')]",
+                                        "domainValidationMethod": "[parameters('domainValidationMethod')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the certificate."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/certificates', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the certificate was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the certificate."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "thumbprint": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The thumbprint of the certificate."
+                                      },
+                                      "value": "[reference('certificate').thumbprint]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('certificate', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the host name binding."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the host name binding."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites/hostNameBindings', parameters('appName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the resource was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "certificateThumbprint": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The thumbprint of the certificate."
+                              },
+                              "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value')]"
+                            },
+                            "certificateResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The resource ID of the certificate."
+                              },
+                              "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'resourceId'), 'value')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    },
+                    "app_privateEndpoints": {
+                      "copy": {
+                        "name": "app_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-app-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "18436885663402767850"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private dns zone group."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a private DNS zone group configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                },
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              },
+                              "nullable": true
+                            },
+                            "ipVersionType": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                },
+                                "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                              },
+                              "defaultValue": "IPv4"
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                },
+                                "description": "Optional. Custom DNS configurations."
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                },
+                                "ipVersionType": "[parameters('ipVersionType')]"
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "9935179114830442414"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private DNS zone group configuration."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "privateDnsZoneConfigs",
+                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "properties": {
+                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                              }
+                                            }
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                  "output": true
+                                },
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "app"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the site."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the site."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the site was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('app', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('app', '2025-03-01', 'full').location]"
+                    },
+                    "defaultHostname": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Default hostname of the app."
+                      },
+                      "value": "[reference('app').defaultHostName]"
+                    },
+                    "customDomainVerificationId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                      },
+                      "value": "[reference('app').customDomainVerificationId]"
+                    },
+                    "outboundIpAddresses": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The outbound IP addresses of the app."
+                      },
+                      "value": "[reference('app').outboundIpAddresses]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the site."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    },
+                    "slots": {
+                      "type": "array",
+                      "items": {
+                        "type": "object",
+                        "properties": {
+                          "name": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "The name of the slot."
+                            }
+                          },
+                          "resourceId": {
+                            "type": "string",
+                            "metadata": {
+                              "description": "The resource ID of the slot."
+                            }
+                          },
+                          "systemAssignedMIPrincipalId": {
+                            "type": "string",
+                            "nullable": true,
+                            "metadata": {
+                              "description": "The principal ID of the system assigned identity of the slot."
+                            }
+                          },
+                          "privateEndpoints": {
+                            "type": "array",
+                            "items": {
+                              "$ref": "#/definitions/privateEndpointOutputType"
+                            },
+                            "metadata": {
+                              "description": "The private endpoints of the slot."
+                            }
+                          },
+                          "hostNameBindings": {
+                            "type": "array",
+                            "items": {
+                              "$ref": "#/definitions/hostNameBindingsOutputType"
+                            },
+                            "metadata": {
+                              "description": "The host name bindings of the slot."
+                            }
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The slots of the site."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                        "input": {
+                          "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
+                          "resourceId": "[reference(format('app_slots[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "systemAssignedMIPrincipalId": "[coalesce(tryGet(tryGet(reference(format('app_slots[{0}]', copyIndex())).outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]",
+                          "privateEndpoints": "[reference(format('app_slots[{0}]', copyIndex())).outputs.privateEndpoints.value]",
+                          "hostNameBindings": "[reference(format('app_slots[{0}]', copyIndex())).outputs.hostNameBindings.value]"
+                        }
+                      }
+                    },
+                    "hostNameBindings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/hostNameBindingsOutputType"
+                      },
+                      "metadata": {
+                        "description": "The host name bindings of the site."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "resourceGroupName": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.resourceGroupName.value]",
+                          "certificateThumbprint": "[tryGet(tryGet(reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateThumbprint'), 'value')]",
+                          "certificateResourceId": "[tryGet(tryGet(reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateResourceId'), 'value')]"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service."
+              },
+              "value": "[reference('appService').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the App Service."
+              },
+              "value": "[reference('appService').outputs.name.value]"
+            },
+            "defaultHostname": {
+              "type": "string",
+              "metadata": {
+                "description": "Default hostname of the App Service."
+              },
+              "value": "[reference('appService').outputs.defaultHostname.value]"
+            },
+            "appUrl": {
+              "type": "string",
+              "metadata": {
+                "description": "URL of the App Service."
+              },
+              "value": "[format('https://{0}', reference('appService').outputs.defaultHostname.value)]"
+            },
+            "identityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID."
+              },
+              "value": "[coalesce(tryGet(tryGet(reference('appService').outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "app_insights",
+        "hostingplan",
+        "log_analytics",
+        "virtualNetwork"
+      ]
+    },
+    "role_assignments": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.role-assignments.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "useExistingAIProject": {
+            "value": "[variables('useExistingAIProject')]"
+          },
+          "existingFoundryProjectResourceId": {
+            "value": "[parameters('existingFoundryProjectResourceId')]"
+          },
+          "aiFoundryResourceId": "[if(not(variables('useExistingAIProject')), if(variables('useExistingAIProject'), createObject('value', reference('existing_project_setup').outputs.resourceId.value), createObject('value', reference('ai_foundry_project').outputs.resourceId.value)), createObject('value', ''))]",
+          "aiSearchResourceId": {
+            "value": "[reference('ai_search').outputs.resourceId.value]"
+          },
+          "storageAccountResourceId": {
+            "value": "[reference('storage_account').outputs.resourceId.value]"
+          },
+          "aiProjectPrincipalId": "[if(variables('useExistingAIProject'), createObject('value', reference('existing_project_setup').outputs.projectIdentityPrincipalId.value), createObject('value', reference('ai_foundry_project').outputs.projectIdentityPrincipalId.value))]",
+          "aiSearchPrincipalId": {
+            "value": "[reference('ai_search').outputs.identityPrincipalId.value]"
+          },
+          "backendAppServicePrincipalId": {
+            "value": "[reference('backend_docker').outputs.identityPrincipalId.value]"
+          },
+          "cosmosDbAccountName": "[if(parameters('deployCosmos'), createObject('value', reference('cosmosDBModule').outputs.name.value), createObject('value', ''))]",
+          "containerRegistryResourceId": {
+            "value": "[reference('container_registry').outputs.resourceId.value]"
+          },
+          "acrPullPrincipals": {
+            "value": [
+              {
+                "principalId": "[reference('backend_docker').outputs.identityPrincipalId.value]",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference('frontend_docker').outputs.identityPrincipalId.value]",
+                "principalType": "ServicePrincipal"
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "8510214222504051328"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Solution name suffix for generating unique role assignment GUIDs."
+              }
+            },
+            "useExistingAIProject": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Whether to use an existing AI project (true) or create new (false)."
+              }
+            },
+            "existingFoundryProjectResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the existing AI project (for deriving AI Services name/sub/RG)."
+              }
+            },
+            "aiProjectPrincipalId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Principal ID of the AI project identity (works for both new and existing projects)."
+              }
+            },
+            "aiSearchPrincipalId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Principal ID of the AI Search identity."
+              }
+            },
+            "backendAppServicePrincipalId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Principal ID of the backend App Service system-assigned identity (empty if not deployed)."
+              }
+            },
+            "aiFoundryResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the AI Foundry account (empty if not deployed — new project path)."
+              }
+            },
+            "aiSearchResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the AI Search service (empty if not deployed)."
+              }
+            },
+            "storageAccountResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the Storage Account (empty if not deployed)."
+              }
+            },
+            "cosmosDbAccountName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Name of the Cosmos DB account (empty if not deployed)."
+              }
+            },
+            "useExistingContainerRegistry": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Whether to use an existing container registry (true) or the one created in this deployment (false)."
+              }
+            },
+            "containerRegistryResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the container registry to grant AcrPull on (for deriving name/sub/RG; empty = skip ACR role assignments)."
+              }
+            },
+            "acrPullPrincipals": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Principals to grant AcrPull on the container registry (array of objects with principalId and principalType)."
+              }
+            }
+          },
+          "variables": {
+            "existingAIFoundryName": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[8], '')]",
+            "existingAIFoundrySubscription": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], subscription().subscriptionId)]",
+            "existingAIFoundryResourceGroup": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], resourceGroup().name)]",
+            "containerRegistryName": "[if(empty(parameters('containerRegistryResourceId')), '', split(parameters('containerRegistryResourceId'), '/')[8])]",
+            "containerRegistrySubscription": "[if(empty(parameters('containerRegistryResourceId')), subscription().subscriptionId, split(parameters('containerRegistryResourceId'), '/')[2])]",
+            "containerRegistryResourceGroup": "[if(empty(parameters('containerRegistryResourceId')), resourceGroup().name, split(parameters('containerRegistryResourceId'), '/')[4])]",
+            "roleDefinitions": {
+              "azureAiUser": "53ca6127-db72-4b80-b1b0-d745d6d5456d",
+              "cognitiveServicesUser": "a97b65f3-24c7-4388-baec-2e87135dc908",
+              "cognitiveServicesOpenAIUser": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",
+              "searchIndexDataReader": "1407120a-92aa-4202-b7e9-c0e197c71c8f",
+              "searchIndexDataContributor": "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
+              "searchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
+              "storageBlobDataContributor": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
+              "storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
+              "storageQueueDataContributor": "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
+              "acrPull": "7f951dda-4ed3-4680-a7ca-43fe172d538d"
+            }
+          },
+          "resources": [
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiSearchPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('aiSearchPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+              "properties": {
+                "principalId": "[parameters('aiSearchPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiFoundryResourceId')))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').azureAiUser)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiFoundryResourceId')))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').searchIndexDataReader)]",
+              "properties": {
+                "principalId": "[parameters('aiProjectPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataReader)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+              "properties": {
+                "principalId": "[parameters('aiProjectPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').searchIndexDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('aiProjectPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').storageBlobDataReader)]",
+              "properties": {
+                "principalId": "[parameters('aiProjectPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataReader)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiSearchPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiSearchPrincipalId'), variables('roleDefinitions').storageBlobDataReader)]",
+              "properties": {
+                "principalId": "[parameters('aiSearchPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataReader)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+              "apiVersion": "2025-10-15",
+              "name": "[format('{0}/{1}', parameters('cosmosDbAccountName'), guid(parameters('solutionName'), resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbAccountName'), '00000000-0000-0000-0000-000000000002'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbAccountName')), parameters('backendAppServicePrincipalId')))]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbAccountName'), '00000000-0000-0000-0000-000000000002')]",
+                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbAccountName'))]"
+              }
+            },
+            {
+              "copy": {
+                "name": "acrPullAssignments",
+                "count": "[length(parameters('acrPullPrincipals'))]"
+              },
+              "condition": "[and(not(parameters('useExistingContainerRegistry')), not(empty(parameters('acrPullPrincipals')[copyIndex()].principalId)))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', variables('containerRegistryName'))]",
+              "name": "[guid(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId, variables('roleDefinitions').acrPull)]",
+              "properties": {
+                "principalId": "[parameters('acrPullPrincipals')[copyIndex()].principalId]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').acrPull)]",
+                "principalType": "[parameters('acrPullPrincipals')[copyIndex()].principalType]"
+              }
+            },
+            {
+              "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('aiSearchPrincipalId'))))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "assignOpenAIRoleToAISearchExisting",
+              "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+              "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "principalId": {
+                    "value": "[parameters('aiSearchPrincipalId')]"
+                  },
+                  "roleDefinitionId": {
+                    "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                  },
+                  "roleAssignmentName": {
+                    "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('aiSearchPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                  },
+                  "aiFoundryName": {
+                    "value": "[variables('existingAIFoundryName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1934953964159824877"
+                    }
+                  },
+                  "parameters": {
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID to assign the role to."
+                      }
+                    },
+                    "roleDefinitionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the role definition to assign."
+                      }
+                    },
+                    "roleAssignmentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "A unique name for the role assignment."
+                      }
+                    },
+                    "principalType": {
+                      "type": "string",
+                      "defaultValue": "ServicePrincipal",
+                      "allowedValues": [
+                        "ServicePrincipal",
+                        "User",
+                        "Group"
+                      ],
+                      "metadata": {
+                        "description": "The principal type of the identity being assigned."
+                      }
+                    },
+                    "targetResourceType": {
+                      "type": "string",
+                      "defaultValue": "AIServices",
+                      "allowedValues": [
+                        "AIServices",
+                        "ContainerRegistry"
+                      ],
+                      "metadata": {
+                        "description": "The type of target resource to scope the role assignment to."
+                      }
+                    },
+                    "aiFoundryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices."
+                      }
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    },
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "assignAiUserRoleToBackendExisting",
+              "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+              "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "principalId": {
+                    "value": "[parameters('backendAppServicePrincipalId')]"
+                  },
+                  "roleDefinitionId": {
+                    "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]"
+                  },
+                  "roleAssignmentName": {
+                    "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').azureAiUser)]"
+                  },
+                  "aiFoundryName": {
+                    "value": "[variables('existingAIFoundryName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1934953964159824877"
+                    }
+                  },
+                  "parameters": {
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID to assign the role to."
+                      }
+                    },
+                    "roleDefinitionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the role definition to assign."
+                      }
+                    },
+                    "roleAssignmentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "A unique name for the role assignment."
+                      }
+                    },
+                    "principalType": {
+                      "type": "string",
+                      "defaultValue": "ServicePrincipal",
+                      "allowedValues": [
+                        "ServicePrincipal",
+                        "User",
+                        "Group"
+                      ],
+                      "metadata": {
+                        "description": "The principal type of the identity being assigned."
+                      }
+                    },
+                    "targetResourceType": {
+                      "type": "string",
+                      "defaultValue": "AIServices",
+                      "allowedValues": [
+                        "AIServices",
+                        "ContainerRegistry"
+                      ],
+                      "metadata": {
+                        "description": "The type of target resource to scope the role assignment to."
+                      }
+                    },
+                    "aiFoundryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices."
+                      }
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    },
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "assignOpenAIUserRoleToBackendExisting",
+              "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+              "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "principalId": {
+                    "value": "[parameters('backendAppServicePrincipalId')]"
+                  },
+                  "roleDefinitionId": {
+                    "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                  },
+                  "roleAssignmentName": {
+                    "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                  },
+                  "aiFoundryName": {
+                    "value": "[variables('existingAIFoundryName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1934953964159824877"
+                    }
+                  },
+                  "parameters": {
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID to assign the role to."
+                      }
+                    },
+                    "roleDefinitionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the role definition to assign."
+                      }
+                    },
+                    "roleAssignmentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "A unique name for the role assignment."
+                      }
+                    },
+                    "principalType": {
+                      "type": "string",
+                      "defaultValue": "ServicePrincipal",
+                      "allowedValues": [
+                        "ServicePrincipal",
+                        "User",
+                        "Group"
+                      ],
+                      "metadata": {
+                        "description": "The principal type of the identity being assigned."
+                      }
+                    },
+                    "targetResourceType": {
+                      "type": "string",
+                      "defaultValue": "AIServices",
+                      "allowedValues": [
+                        "AIServices",
+                        "ContainerRegistry"
+                      ],
+                      "metadata": {
+                        "description": "The type of target resource to scope the role assignment to."
+                      }
+                    },
+                    "aiFoundryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices."
+                      }
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    },
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "copy": {
+                "name": "acrPullAssignmentsExisting",
+                "count": "[length(parameters('acrPullPrincipals'))]"
+              },
+              "condition": "[and(parameters('useExistingContainerRegistry'), not(empty(parameters('acrPullPrincipals')[copyIndex()].principalId)))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('acrPull-{0}', uniqueString(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId)), 64)]",
+              "subscriptionId": "[variables('containerRegistrySubscription')]",
+              "resourceGroup": "[variables('containerRegistryResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "targetResourceType": {
+                    "value": "ContainerRegistry"
+                  },
+                  "containerRegistryName": {
+                    "value": "[variables('containerRegistryName')]"
+                  },
+                  "principalId": {
+                    "value": "[parameters('acrPullPrincipals')[copyIndex()].principalId]"
+                  },
+                  "principalType": {
+                    "value": "[parameters('acrPullPrincipals')[copyIndex()].principalType]"
+                  },
+                  "roleDefinitionId": {
+                    "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').acrPull)]"
+                  },
+                  "roleAssignmentName": {
+                    "value": "[guid(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId, variables('roleDefinitions').acrPull)]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1934953964159824877"
+                    }
+                  },
+                  "parameters": {
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID to assign the role to."
+                      }
+                    },
+                    "roleDefinitionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the role definition to assign."
+                      }
+                    },
+                    "roleAssignmentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "A unique name for the role assignment."
+                      }
+                    },
+                    "principalType": {
+                      "type": "string",
+                      "defaultValue": "ServicePrincipal",
+                      "allowedValues": [
+                        "ServicePrincipal",
+                        "User",
+                        "Group"
+                      ],
+                      "metadata": {
+                        "description": "The principal type of the identity being assigned."
+                      }
+                    },
+                    "targetResourceType": {
+                      "type": "string",
+                      "defaultValue": "AIServices",
+                      "allowedValues": [
+                        "AIServices",
+                        "ContainerRegistry"
+                      ],
+                      "metadata": {
+                        "description": "The type of target resource to scope the role assignment to."
+                      }
+                    },
+                    "aiFoundryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices."
+                      }
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    },
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "ai_foundry_project",
+        "ai_search",
+        "backend_docker",
+        "container_registry",
+        "cosmosDBModule",
+        "existing_project_setup",
+        "frontend_docker",
+        "storage_account"
+      ]
+    }
+  },
+  "outputs": {
+    "AZURE_OPENAI_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure OpenAI endpoint URL."
+      },
+      "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.endpoint.value, reference('ai_foundry_project').outputs.endpoint.value)]"
+    },
+    "AZURE_SEARCH_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure AI Search endpoint URL."
+      },
+      "value": "[reference('ai_search').outputs.endpoint.value]"
+    },
+    "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Content Understanding endpoint URL."
+      },
+      "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.azureOpenAiCuEndpoint.value, reference('ai_foundry_project').outputs.azureOpenAiCuEndpoint.value)]"
+    },
+    "AZURE_STORAGE_ACCOUNT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Storage account name."
+      },
+      "value": "[reference('storage_account').outputs.name.value]"
+    },
+    "AZURE_SQL_SERVER": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure SQL Server FQDN."
+      },
+      "value": "[reference('sqlDBModule').outputs.serverFqdn.value]"
+    },
+    "AZURE_SQL_DATABASE": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure SQL Database name."
+      },
+      "value": "[reference('sqlDBModule').outputs.databaseName.value]"
+    },
+    "API_APP_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend API application (and SQL contained user) name."
+      },
+      "value": "[reference('backend_docker').outputs.name.value]"
+    },
+    "AZURE_API_PRINCIPAL_ID": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend API system-assigned managed identity principal ID."
+      },
+      "value": "[reference('backend_docker').outputs.identityPrincipalId.value]"
+    },
+    "AZURE_COSMOS_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Cosmos DB endpoint."
+      },
+      "value": "[if(parameters('deployCosmos'), reference('cosmosDBModule').outputs.endpoint.value, '')]"
+    },
+    "AZURE_AI_AGENT_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure AI Agent endpoint URL."
+      },
+      "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.projectEndpoint.value, reference('ai_foundry_project').outputs.projectEndpoint.value)]"
+    },
+    "API_APP_URL": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend API application URL."
+      },
+      "value": "[reference('backend_docker').outputs.appUrl.value]"
+    },
+    "WEB_APP_URL": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend web application URL."
+      },
+      "value": "[reference('frontend_docker').outputs.appUrl.value]"
+    },
+    "SERVICE_BACKEND_URI": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend service URI (used by azd)."
+      },
+      "value": "[reference('backend_docker').outputs.appUrl.value]"
+    },
+    "SERVICE_FRONTEND_URI": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend service URI (used by azd)."
+      },
+      "value": "[reference('frontend_docker').outputs.appUrl.value]"
+    },
+    "AZURE_AI_SEARCH_CONNECTION_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "AI Search connection name in AI Foundry."
+      },
+      "value": "[reference('foundry_search_connection').outputs.connectionName.value]"
+    },
+    "ACR_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Container Registry name."
+      },
+      "value": "[reference('container_registry').outputs.name.value]"
+    },
+    "ACR_LOGIN_SERVER": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Container Registry login server URL."
+      },
+      "value": "[reference('container_registry').outputs.loginServer.value]"
+    },
+    "BACKEND_CONTAINER_IMAGE_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend container image repository name to build and push to ACR."
+      },
+      "value": "[parameters('backendContainerImageName')]"
+    },
+    "BACKEND_CONTAINER_IMAGE_TAG": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend container image tag to build and push to ACR."
+      },
+      "value": "[parameters('backendContainerImageTag')]"
+    },
+    "FRONTEND_CONTAINER_IMAGE_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend container image repository name to build and push to ACR."
+      },
+      "value": "[parameters('frontendContainerImageName')]"
+    },
+    "FRONTEND_CONTAINER_IMAGE_TAG": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend container image tag to build and push to ACR."
+      },
+      "value": "[parameters('frontendContainerImageTag')]"
+    },
+    "FRONTEND_APP_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend web application (App Service) name."
+      },
+      "value": "[reference('frontend_docker').outputs.name.value]"
+    },
+    "RESOURCE_GROUP_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Resource group name."
+      },
+      "value": "[resourceGroup().name]"
+    },
+    "SOLUTION_SUFFIX": {
+      "type": "string",
+      "metadata": {
+        "description": "Solution resource token suffix used in resource names."
+      },
+      "value": "[variables('solutionSuffix')]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/infra/avm/modules/ai/ai-foundry-connection.bicep b/infra/avm/modules/ai/ai-foundry-connection.bicep
new file mode 100644
index 000000000..443de377c
--- /dev/null
+++ b/infra/avm/modules/ai/ai-foundry-connection.bicep
@@ -0,0 +1,88 @@
+// ============================================================================
+// Module: AI Foundry Project Connection (Single)
+// Description: Creates a single connection on an AI Foundry project.
+//              Generic, reusable — call once per connection type from main.bicep.
+//              Supports any connection category (CognitiveSearch, AzureBlob,
+//              AppInsights, RemoteTool, etc.) via parameterized properties.
+// ============================================================================
+
+targetScope = 'resourceGroup'
+
+@description('Required. Name of the parent AI Services account.')
+param aiServicesAccountName string
+
+@description('Required. Name of the AI Foundry project.')
+param projectName string
+
+@description('Required. Solution name suffix used to generate the connection name.')
+param solutionName string
+
+@description('Optional. Connection name. Defaults to lowercase category with solution suffix.')
+param connectionName string = toLower('${category}-connection-${solutionName}')
+
+@description('Required. Connection category (e.g., CognitiveSearch, AzureBlob, AppInsights, RemoteTool).')
+param category string
+
+@description('Required. Connection target (URL or resource ID).')
+param target string
+
+@description('Required. Authentication type (e.g., AAD, ApiKey, ProjectManagedIdentity).')
+param authType string
+
+@description('Optional. Whether the connection is shared to all project users.')
+param isSharedToAll bool = true
+
+@description('Optional. Whether this is the default connection for its category.')
+param isDefault bool = false
+
+@description('Optional. Connection metadata object.')
+param metadata object = {}
+
+@description('Optional. Whether to use workspace-managed identity for authentication.')
+param useWorkspaceManagedIdentity bool = false
+
+@secure()
+@description('Optional. Credentials key (for ApiKey auth type).')
+param credentialsKey string = ''
+
+// ============================================================================
+// Existing Resource References
+// ============================================================================
+resource aiServicesAccount 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = {
+  name: aiServicesAccountName
+}
+
+resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-12-01' existing = {
+  parent: aiServicesAccount
+  name: projectName
+}
+
+// ============================================================================
+// Connection
+// ============================================================================
+var baseProperties = {
+  category: category
+  target: target
+  authType: authType
+  isSharedToAll: isSharedToAll
+  metadata: metadata
+  useWorkspaceManagedIdentity: useWorkspaceManagedIdentity
+}
+
+var optionalDefault = isDefault ? { isDefault: true } : {}
+var optionalCredentials = !empty(credentialsKey) ? { credentials: { key: credentialsKey } } : {}
+
+resource connection 'Microsoft.CognitiveServices/accounts/projects/connections@2025-12-01' = {
+  parent: aiProject
+  name: connectionName
+  properties: any(union(baseProperties, optionalDefault, optionalCredentials))
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Connection name.')
+output connectionName string = connection.name
+
+@description('Connection resource ID.')
+output connectionId string = connection.id
diff --git a/infra/avm/modules/ai/ai-foundry-model-deployment.bicep b/infra/avm/modules/ai/ai-foundry-model-deployment.bicep
new file mode 100644
index 000000000..1c534fd88
--- /dev/null
+++ b/infra/avm/modules/ai/ai-foundry-model-deployment.bicep
@@ -0,0 +1,64 @@
+// ============================================================================
+// Module: Model Deployment
+// Description: Deploys a single AI model to an existing AI Services account.
+//              Called repetitively from main.bicep for each model in the array.
+//              Generic, reusable across GSAs.
+// ============================================================================
+
+@description('Required. Name of the parent AI Services account.')
+param aiServicesAccountName string
+
+@description('Required. Name for this model deployment.')
+param deploymentName string
+
+@description('Optional. Model format (e.g., OpenAI).')
+param modelFormat string = 'OpenAI'
+
+@description('Required. Model name (e.g., gpt-4o, text-embedding-ada-002).')
+param modelName string
+
+@description('Optional. Model version. Empty string means latest.')
+param modelVersion string = ''
+
+@description('Optional. RAI policy name.')
+param raiPolicyName string = 'Microsoft.Default'
+
+@description('Required. SKU name (e.g., Standard, GlobalStandard).')
+param skuName string
+
+@description('Required. SKU capacity (tokens per minute in thousands).')
+param skuCapacity int
+
+// ============================================================================
+// Model Deployment
+// ============================================================================
+resource aiServicesAccount 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = {
+  name: aiServicesAccountName
+}
+
+resource modelDeployment 'Microsoft.CognitiveServices/accounts/deployments@2025-12-01' = {
+  parent: aiServicesAccount
+  name: deploymentName
+  properties: {
+    model: {
+      format: modelFormat
+      name: modelName
+      version: !empty(modelVersion) ? modelVersion : null
+    }
+    raiPolicyName: raiPolicyName
+  }
+  sku: {
+    name: skuName
+    capacity: skuCapacity
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+
+@description('Name of the deployed model.')
+output name string = modelDeployment.name
+
+@description('Resource ID of the model deployment.')
+output resourceId string = modelDeployment.id
diff --git a/infra/avm/modules/ai/ai-foundry-project.bicep b/infra/avm/modules/ai/ai-foundry-project.bicep
new file mode 100644
index 000000000..d718244c5
--- /dev/null
+++ b/infra/avm/modules/ai/ai-foundry-project.bicep
@@ -0,0 +1,139 @@
+// ============================================================================
+// Module: AI Foundry Project (Account + Project)
+// Description: AVM wrapper for Azure AI Services account creation and
+//              AI Foundry project provisioning. Generic, reusable across GSAs.
+// AVM Module: avm/res/cognitive-services/account
+// WAF: https://learn.microsoft.com/azure/well-architected/service-guides/azure-openai
+// ============================================================================
+
+@description('Required. Solution name suffix used to generate resource names.')
+param solutionName string
+
+@description('Optional. Override name for the AI Services account. Defaults to aif-{solutionName}.')
+param name string = 'aif-${solutionName}'
+
+@description('Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}.')
+param projectName string = 'proj-${solutionName}'
+
+@description('Required. Azure region for the resources.')
+param location string
+
+@description('Optional. Tags to apply to resources.')
+param tags object = {}
+
+@description('Optional. SKU name for the AI Services account.')
+param skuName string = 'S0'
+
+@description('Optional. Whether to disable local (key-based) authentication.')
+param disableLocalAuth bool = true
+
+@description('Optional. Whether to allow project management (AI Foundry hub).')
+param allowProjectManagement bool = true
+
+@description('Optional. Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+@description('Optional. Managed identity type for the resources.')
+param identity object = { type: 'SystemAssigned' }
+
+@description('Optional. Network ACLs default action.')
+@allowed(['Allow', 'Deny'])
+param networkAclsDefaultAction string = 'Allow'
+
+// --- WAF: Monitoring ---
+@description('Optional. Diagnostic settings for the resource.')
+param diagnosticSettings array?
+
+// --- WAF: Telemetry ---
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+// --- Role Assignments ---
+@description('Optional. Array of role assignments to create on the AI Services account.')
+param roleAssignments array?
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+// ============================================================================
+// AI Services Account (AVM Module)
+// ============================================================================
+module aiServicesAccount 'br/public:avm/res/cognitive-services/account:0.14.2' = {
+  name: take('avm.res.cognitive-services.account.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    sku: skuName
+    kind: 'AIServices'
+    disableLocalAuth: disableLocalAuth
+    allowProjectManagement: allowProjectManagement
+    customSubDomainName: name
+    networkAcls: {
+      defaultAction: networkAclsDefaultAction
+      virtualNetworkRules: []
+      ipRules: []
+    }
+    publicNetworkAccess: publicNetworkAccess
+    managedIdentities: managedIdentities
+    diagnosticSettings: diagnosticSettings
+    deployments: []
+    roleAssignments: roleAssignments
+    // Private endpoints deployed separately to avoid AccountProvisioningStateInvalid
+    privateEndpoints: []
+  }
+}
+
+// ============================================================================
+// AI Foundry Project
+// ============================================================================
+resource aiServices 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = {
+  name: name
+  dependsOn: [aiServicesAccount]
+}
+
+resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-12-01' = {
+  parent: aiServices
+  name: projectName
+  location: location
+  tags: tags
+  kind: 'AIServices'
+  identity: identity
+  properties: {}
+  dependsOn: [aiServicesAccount]
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+
+@description('Resource ID of the AI Services account.')
+output resourceId string = aiServices.id
+
+@description('Name of the AI Services account.')
+output name string = aiServices.name
+
+@description('Endpoint of the AI Services account (OpenAI Language Model Instance API).')
+output endpoint string = aiServices.properties.endpoints['OpenAI Language Model Instance API']
+
+@description('Endpoint of the AI Services account (Cognitive Services).')
+output cognitiveServicesEndpoint string = aiServices.properties.endpoint
+
+@description('Azure OpenAI Content Understanding endpoint URL.')
+output azureOpenAiCuEndpoint string = aiServices.properties.endpoints['Content Understanding']
+
+@description('System-assigned identity principal ID of the AI Services account.')
+output principalId string = aiServices.identity.principalId
+
+@description('Resource ID of the AI Foundry project.')
+output projectResourceId string = aiProject.id
+
+@description('Name of the AI Foundry project.')
+output projectName string = aiProject.name
+
+@description('AI Foundry project endpoint.')
+output projectEndpoint string = aiProject.properties.endpoints['AI Foundry API']
+
+@description('System-assigned identity principal ID of the project.')
+output projectIdentityPrincipalId string = aiProject.identity.principalId
diff --git a/infra/avm/modules/ai/ai-search.bicep b/infra/avm/modules/ai/ai-search.bicep
new file mode 100644
index 000000000..e0ffda10a
--- /dev/null
+++ b/infra/avm/modules/ai/ai-search.bicep
@@ -0,0 +1,128 @@
+// ============================================================================
+// Module: AI Search
+// Description: Deploys Azure AI Search with a two-step pattern:
+//   Step 1: Plain Bicep resource for fast initial creation (name, location, SKU)
+//   Step 2: AVM module update to enable managed identity & full configuration
+// This reduces deployment time by making the resource available immediately
+// while identity enablement proceeds separately.
+// AVM Module: avm/res/search/search-service:0.12.0
+// WAF: https://learn.microsoft.com/azure/well-architected/service-guides/azure-cognitive-search
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+@minLength(3)
+param solutionName string
+
+@description('Optional. Override name for the search service. Defaults to srch-{solutionName}.')
+param name string = 'srch-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('SKU name for the search service.')
+@allowed(['free', 'basic', 'standard', 'standard2', 'standard3', 'storage_optimized_l1', 'storage_optimized_l2'])
+param skuName string = 'basic'
+
+@description('Number of replicas.')
+param replicaCount int = 1
+
+@description('Number of partitions.')
+param partitionCount int = 1
+
+@description('Hosting mode.')
+@allowed(['Default', 'HighDensity'])
+param hostingMode string = 'Default'
+
+@description('Semantic search tier.')
+@allowed(['disabled', 'free', 'standard'])
+param semanticSearch string = 'free'
+
+@description('Whether to disable local authentication.')
+param disableLocalAuth bool = true
+
+@description('Optional. Authentication options for the search service (e.g., aadOrApiKey).')
+param authOptions object = {}
+
+@description('Optional. Network rule set for the search service (e.g., bypass: AzureServices).')
+param networkRuleSet object = {}
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+@description('Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+// --- WAF: Telemetry ---
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+// --- WAF: Monitoring ---
+@description('Diagnostic settings for monitoring.')
+param diagnosticSettings array = []
+
+// --- WAF: Private Networking ---
+import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
+@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
+param privateEndpoints privateEndpointSingleServiceType[]?
+
+// --- Role Assignments ---
+@description('Optional. Array of role assignments to create on the AI Search service.')
+param roleAssignments array = []
+
+// ============================================================================
+// Step 1: Initial resource creation (plain Bicep — fast)
+// ============================================================================
+resource searchService 'Microsoft.Search/searchServices@2025-05-01' = {
+  name: name
+  location: location
+  sku: {
+    name: skuName
+  }
+}
+
+// ============================================================================
+// Step 2: AVM update — enables identity & full configuration
+// ============================================================================
+module searchServiceUpdate 'br/public:avm/res/search/search-service:0.12.0' = {
+  name: take('avm.res.search.update.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    sku: skuName
+    replicaCount: replicaCount
+    partitionCount: partitionCount
+    hostingMode: hostingMode
+    semanticSearch: semanticSearch
+    authOptions: !empty(authOptions) ? authOptions : null
+    disableLocalAuth: disableLocalAuth
+    networkRuleSet: !empty(networkRuleSet) ? networkRuleSet : null
+    publicNetworkAccess: publicNetworkAccess
+    managedIdentities: managedIdentities
+    diagnosticSettings: !empty(diagnosticSettings) ? diagnosticSettings : []
+    privateEndpoints: privateEndpoints
+    roleAssignments: !empty(roleAssignments) ? roleAssignments : []
+  }
+  dependsOn: [
+    searchService
+  ]
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the AI Search service.')
+output resourceId string = searchService.id
+
+@description('Name of the AI Search service.')
+output name string = searchService.name
+
+@description('Endpoint URL of the AI Search service.')
+output endpoint string = 'https://${searchService.name}.search.windows.net'
+
+@description('System-assigned identity principal ID.')
+output identityPrincipalId string = searchServiceUpdate.outputs.?systemAssignedMIPrincipalId ?? ''
diff --git a/infra/avm/modules/ai/existing-project-setup.bicep b/infra/avm/modules/ai/existing-project-setup.bicep
new file mode 100644
index 000000000..cd0fe1f2c
--- /dev/null
+++ b/infra/avm/modules/ai/existing-project-setup.bicep
@@ -0,0 +1,60 @@
+// ============================================================================
+// Module: Existing AI Foundry Project Reference
+// Description: References an existing AI Services account and project to
+//              retrieve their identities. No deployments, no connections.
+//              Use generic ai-foundry-connection and ai-foundry-model-deployment
+//              modules for those concerns.
+// ============================================================================
+
+@description('Required. The name of the existing Cognitive Services account.')
+param name string
+
+@description('Required. The name of the existing AI project.')
+param projectName string
+
+// ============================================================================
+// Existing Resource References
+// ============================================================================
+resource aiServices 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = {
+  name: name
+}
+
+resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-12-01' existing = {
+  parent: aiServices
+  name: projectName
+}
+
+// ============================================================================
+// Outputs (aligned with ai-foundry-project.bicep)
+// ============================================================================
+
+@description('Resource ID of the AI Services account.')
+output resourceId string = aiServices.id
+
+@description('Name of the AI Services account.')
+output name string = aiServices.name
+
+@description('Endpoint of the AI Services account (OpenAI Language Model Instance API).')
+output endpoint string = aiServices.properties.endpoints['OpenAI Language Model Instance API']
+
+@description('Endpoint of the AI Services account (Cognitive Services).')
+output cognitiveServicesEndpoint string = aiServices.properties.endpoint
+
+@description('Azure OpenAI Content Understanding endpoint URL.')
+output azureOpenAiCuEndpoint string = aiServices.properties.endpoints['Content Understanding']
+
+@description('System-assigned identity principal ID of the AI Services account (empty if none).')
+output principalId string = aiServices.identity.?principalId ?? ''
+
+@description('Resource ID of the AI Foundry project.')
+output projectResourceId string = aiProject.id
+
+@description('Name of the AI Foundry project.')
+output projectName string = aiProject.name
+
+@description('AI Foundry project endpoint.')
+output projectEndpoint string = aiProject.properties.endpoints['AI Foundry API']
+
+@description('System-assigned identity principal ID of the project (empty if none).')
+output projectIdentityPrincipalId string = aiProject.identity.?principalId ?? ''
+
diff --git a/infra/avm/modules/compute/app-service-plan.bicep b/infra/avm/modules/compute/app-service-plan.bicep
new file mode 100644
index 000000000..f6ede0517
--- /dev/null
+++ b/infra/avm/modules/compute/app-service-plan.bicep
@@ -0,0 +1,71 @@
+// ============================================================================
+// Module: App Service Plan
+// Description: AVM wrapper for Azure App Service Plan
+// AVM Module: avm/res/web/serverfarm:0.7.0
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the App Service Plan.')
+param name string = 'asp-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('SKU name for the App Service Plan.')
+@allowed(['F1', 'D1', 'B1', 'B2', 'B3', 'S1', 'S2', 'S3', 'P1', 'P2', 'P3', 'P4', 'P0v3', 'P0v4', 'P1v3', 'P1v4', 'P2v3', 'P3v3'])
+param skuName string = 'B2'
+
+@description('Whether the plan is Linux-based.')
+param reserved bool = true
+
+@description('Kind of the App Service Plan.')
+param kind string = 'linux'
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Number of instances (workers).')
+param skuCapacity int = 1
+
+@description('Diagnostic settings for monitoring.')
+param diagnosticSettings array = []
+
+@description('Enable zone redundancy. Requires Premium SKU (P1v3+).')
+param zoneRedundant bool = false
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module appServicePlan 'br/public:avm/res/web/serverfarm:0.7.0' = {
+  name: take('avm.res.web.serverfarm.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    skuName: skuName
+    skuCapacity: skuCapacity
+    reserved: reserved
+    kind: kind
+    diagnosticSettings: !empty(diagnosticSettings) ? diagnosticSettings : []
+    zoneRedundant: zoneRedundant
+    managedIdentities: managedIdentities
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the App Service Plan.')
+output resourceId string = appServicePlan.outputs.resourceId
+
+@description('Name of the App Service Plan.')
+output name string = appServicePlan.outputs.name
diff --git a/infra/avm/modules/compute/app-service.bicep b/infra/avm/modules/compute/app-service.bicep
new file mode 100644
index 000000000..162ed538c
--- /dev/null
+++ b/infra/avm/modules/compute/app-service.bicep
@@ -0,0 +1,186 @@
+// ============================================================================
+// Module: App Service
+// Description: AVM wrapper for Azure App Service (Web App)
+// AVM Module: avm/res/web/site:0.23.1
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the App Service.')
+param name string = solutionName
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Resource ID of the App Service Plan.')
+param serverFarmResourceId string
+
+@description('Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag).')
+param linuxFxVersion string
+
+@description('Application settings key-value pairs.')
+param appSettings object = {}
+
+@description('Optional. Resource ID of Application Insights for monitoring integration.')
+param applicationInsightResourceId string = ''
+
+@description('Whether to enable Always On.')
+param alwaysOn bool = true
+
+@description('Optional. Health check path for the app.')
+param healthCheckPath string = ''
+
+@description('Optional. Whether to enable WebSockets.')
+param webSocketsEnabled bool = false
+
+@description('Optional. Command line for the application.')
+param appCommandLine string = ''
+
+@description('Required. Type of site to deploy.')
+@allowed([
+  'functionapp' // function app windows os
+  'functionapp,linux' // function app linux os
+  'functionapp,workflowapp' // logic app workflow
+  'functionapp,workflowapp,linux' // logic app docker container
+  'functionapp,linux,container' // function app linux container
+  'functionapp,linux,container,azurecontainerapps' // function app linux container azure container apps
+  'app,linux' // linux web app
+  'app' // windows web app
+  'linux,api' // linux api app
+  'api' // windows api app
+  'app,linux,container' // linux container app
+  'app,container,windows' // windows container app
+])
+param kind string = 'app,linux'
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Diagnostic settings for monitoring.')
+param diagnosticSettings array = []
+
+@description('Subnet resource ID for VNet integration.')
+param virtualNetworkSubnetId string = ''
+
+@description('Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+@description('Optional. Whether the app pulls its container image from ACR using its managed identity.')
+param acrUseManagedIdentityCreds bool = false
+
+@description('Optional. Client ID of the user-assigned identity used for ACR image pulls (empty = system-assigned).')
+param acrUserManagedIdentityID string = ''
+
+@description('Optional. Whether to route all outbound traffic through the virtual network.')
+param vnetRouteAllEnabled bool = false
+
+@description('Optional. Whether to route image pull traffic through the virtual network.')
+param imagePullTraffic bool = false
+
+@description('Optional. Whether to route content share traffic through the virtual network.')
+param contentShareTraffic bool = false
+
+import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
+@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
+param privateEndpoints privateEndpointSingleServiceType[]?
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module appService 'br/public:avm/res/web/site:0.23.1' = {
+  name: take('avm.res.web.site.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    kind: kind
+    enableTelemetry: enableTelemetry
+    serverFarmResourceId: serverFarmResourceId
+    managedIdentities: managedIdentities
+    siteConfig: {
+      alwaysOn: alwaysOn
+      ftpsState: 'Disabled'
+      linuxFxVersion: linuxFxVersion
+      minTlsVersion: '1.2'
+      healthCheckPath: !empty(healthCheckPath) ? healthCheckPath : null
+      webSocketsEnabled: webSocketsEnabled
+      appCommandLine: appCommandLine
+      vnetRouteAllEnabled: vnetRouteAllEnabled
+      acrUseManagedIdentityCreds: acrUseManagedIdentityCreds
+      acrUserManagedIdentityID: !empty(acrUserManagedIdentityID) ? acrUserManagedIdentityID : null
+    }
+    e2eEncryptionEnabled: true
+    configs: [
+      {
+        name: 'appsettings'
+        properties: appSettings
+        applicationInsightResourceId: !empty(applicationInsightResourceId) ? applicationInsightResourceId : null
+      }
+    ]
+    outboundVnetRouting: {
+      contentShareTraffic: contentShareTraffic
+      imagePullTraffic: imagePullTraffic
+    }
+    publicNetworkAccess: publicNetworkAccess
+    privateEndpoints: privateEndpoints
+    virtualNetworkSubnetResourceId: !empty(virtualNetworkSubnetId) ? virtualNetworkSubnetId : null
+    basicPublishingCredentialsPolicies: [
+      {
+        name: 'ftp'
+        allow: false
+      }
+      {
+        name: 'scm'
+        allow: false
+      }
+    ]
+    diagnosticSettings: !empty(diagnosticSettings) ? diagnosticSettings : []
+  }
+}
+
+// ============================================================================
+// Logs Configuration (deployed serially after appsettings)
+// Deploy logs after app settings to prevent concurrent config writes.
+// ============================================================================
+resource site 'Microsoft.Web/sites@2025-03-01' existing = {
+  name: name
+}
+
+resource logsConfig 'Microsoft.Web/sites/config@2025-03-01' = {
+  parent: site
+  name: 'logs'
+  properties: {
+    applicationLogs: { fileSystem: { level: 'Verbose' } }
+    detailedErrorMessages: { enabled: true }
+    failedRequestsTracing: { enabled: true }
+    httpLogs: { fileSystem: { enabled: true, retentionInDays: 1, retentionInMb: 35 } }
+  }
+  dependsOn: [
+    appService
+  ]
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the App Service.')
+output resourceId string = appService.outputs.resourceId
+
+@description('Name of the App Service.')
+output name string = appService.outputs.name
+
+@description('Default hostname of the App Service.')
+output defaultHostname string = appService.outputs.defaultHostname
+
+@description('URL of the App Service.')
+output appUrl string = 'https://${appService.outputs.defaultHostname}'
+
+@description('System-assigned identity principal ID.')
+output identityPrincipalId string = appService.outputs.?systemAssignedMIPrincipalId ?? ''
diff --git a/infra/avm/modules/compute/container-registry.bicep b/infra/avm/modules/compute/container-registry.bicep
new file mode 100644
index 000000000..4d27d499a
--- /dev/null
+++ b/infra/avm/modules/compute/container-registry.bicep
@@ -0,0 +1,118 @@
+// ============================================================================
+// Module: Azure Container Registry (AVM)
+// AVM Module: avm/res/container-registry/registry:0.12.1
+// ============================================================================
+
+@description('Solution name used for naming convention.')
+param solutionName string
+
+@description('Name of the container registry.')
+param name string = replace('cr${solutionName}', '-', '')
+
+@description('Azure region for deployment.')
+param location string
+
+@description('Resource tags.')
+param tags object = {}
+
+@description('SKU for the container registry.')
+@allowed(['Basic', 'Standard', 'Premium'])
+param sku string = 'Standard'
+
+@description('Public network access setting.')
+@allowed(['Enabled', 'Disabled'])
+param publicNetworkAccess string = 'Enabled'
+
+@description('Export policy status. Must be "enabled" when publicNetworkAccess is "Enabled".')
+param exportPolicyStatus string = 'enabled'
+
+// Must be 'enabled' for App Service managed-identity image pulls; the AVM module defaults it to
+// 'disabled', which makes ACR token retrieval fail (ACRTokenRetrievalFailure) during container startup.
+@description('ARM-audience AAD token policy status. Keep "enabled" for App Service managed-identity ACR pulls.')
+@allowed(['enabled', 'disabled'])
+param azureADAuthenticationAsArmPolicyStatus string = 'enabled'
+
+@description('Principal IDs to assign AcrPull role.')
+param acrPullPrincipalIds array = []
+
+// Additive: AcrPush for deployer so post-deploy docker push works without manual RBAC.
+@description('Principal IDs to assign AcrPush role (typically the deployer).')
+param acrPushPrincipalIds array = []
+
+@description('Principal type for AcrPush assignments (User for azd user, ServicePrincipal for CI).')
+@allowed(['User', 'ServicePrincipal', 'Group'])
+param acrPushPrincipalType string = 'User'
+
+@description('Enable the ACR admin user (username/password). Used by App Service for reliable image pulls behind a private VNet.')
+param adminUserEnabled bool = false
+
+import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
+@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
+param privateEndpoints privateEndpointSingleServiceType[]?
+
+@description('Default action for the network rule set. Use Allow when no private endpoint is in place; Deny for private-only.')
+@allowed(['Allow', 'Deny'])
+param networkRuleSetDefaultAction string = 'Allow'
+
+@description('Enable Azure telemetry collection.')
+param enableTelemetry bool = true
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+// ============================================================================
+// Role Assignments
+// ============================================================================
+var acrPullRoleId = '7f951dda-4ed3-4680-a7ca-43fe172d538d'
+var acrPushRoleId = '8311e382-0749-4cb8-b61a-304f252e45ec'
+
+var pullRoleAssignments = [for principalId in acrPullPrincipalIds: {
+  principalId: principalId
+  roleDefinitionIdOrName: acrPullRoleId
+  principalType: 'ServicePrincipal'
+}]
+
+var pushRoleAssignments = [for principalId in acrPushPrincipalIds: {
+  principalId: principalId
+  roleDefinitionIdOrName: acrPushRoleId
+  principalType: acrPushPrincipalType
+}]
+
+var roleAssignments = concat(
+  !empty(acrPullPrincipalIds) ? pullRoleAssignments : [],
+  !empty(acrPushPrincipalIds) ? pushRoleAssignments : []
+)
+
+// ============================================================================
+// Container Registry (AVM)
+// ============================================================================
+module containerRegistry 'br/public:avm/res/container-registry/registry:0.12.1' = {
+  name: take('avm.res.containerregistry.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    acrSku: sku
+    acrAdminUserEnabled: adminUserEnabled
+    publicNetworkAccess: publicNetworkAccess
+    exportPolicyStatus: exportPolicyStatus
+    azureADAuthenticationAsArmPolicyStatus: azureADAuthenticationAsArmPolicyStatus
+    roleAssignments: !empty(roleAssignments) ? roleAssignments : []
+    privateEndpoints: privateEndpoints
+    networkRuleSetDefaultAction: networkRuleSetDefaultAction
+    managedIdentities: managedIdentities
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('The name of the container registry.')
+output name string = containerRegistry.outputs.name
+
+@description('The login server URL.')
+output loginServer string = containerRegistry.outputs.loginServer
+
+@description('The resource ID of the container registry.')
+output resourceId string = containerRegistry.outputs.resourceId
diff --git a/infra/avm/modules/compute/maintenance-configuration.bicep b/infra/avm/modules/compute/maintenance-configuration.bicep
new file mode 100644
index 000000000..2683939d1
--- /dev/null
+++ b/infra/avm/modules/compute/maintenance-configuration.bicep
@@ -0,0 +1,84 @@
+// ============================================================================
+// Module: Maintenance Configuration
+// Description: AVM wrapper for Azure Maintenance Configuration
+// AVM Module: avm/res/maintenance/maintenance-configuration
+// WAF: https://learn.microsoft.com/en-us/azure/well-architected/service-guides/virtual-machines
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the maintenance configuration.')
+param name string = 'mc-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Maintenance scope.')
+param maintenanceScope string = 'InGuestPatch'
+
+@description('Visibility of the configuration.')
+param visibility string = 'Custom'
+
+@description('Extension properties.')
+param extensionProperties object = {
+  InGuestPatchMode: 'User'
+}
+
+@description('Maintenance window configuration.')
+param maintenanceWindow object = {
+  startDateTime: '2024-06-16 00:00'
+  duration: '03:55'
+  timeZone: 'W. Europe Standard Time'
+  recurEvery: '1Day'
+}
+
+@description('Install patches configuration.')
+param installPatches object = {
+  rebootSetting: 'IfRequired'
+  windowsParameters: {
+    classificationsToInclude: [
+      'Critical'
+      'Security'
+    ]
+  }
+  linuxParameters: {
+    classificationsToInclude: [
+      'Critical'
+      'Security'
+    ]
+  }
+}
+
+@description('Enable Azure telemetry collection.')
+param enableTelemetry bool = true
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module maintenanceConfiguration 'br/public:avm/res/maintenance/maintenance-configuration:0.4.0' = {
+  name: take('avm.res.maintenance.maintenance-configuration.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    extensionProperties: extensionProperties
+    maintenanceScope: maintenanceScope
+    maintenanceWindow: maintenanceWindow
+    visibility: visibility
+    installPatches: installPatches
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the maintenance configuration.')
+output resourceId string = maintenanceConfiguration.outputs.resourceId
+
+@description('Name of the maintenance configuration.')
+output name string = maintenanceConfiguration.outputs.name
diff --git a/infra/avm/modules/compute/proximity-placement-group.bicep b/infra/avm/modules/compute/proximity-placement-group.bicep
new file mode 100644
index 000000000..f1a3e2796
--- /dev/null
+++ b/infra/avm/modules/compute/proximity-placement-group.bicep
@@ -0,0 +1,51 @@
+// ============================================================================
+// Module: Proximity Placement Group
+// Description: AVM wrapper for Azure Proximity Placement Group
+// AVM Module: avm/res/compute/proximity-placement-group
+// WAF: https://learn.microsoft.com/en-us/azure/well-architected/service-guides/virtual-machines
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the proximity placement group.')
+param name string = 'ppg-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Availability zone for the proximity placement group.')
+param availabilityZone int = 1
+
+@description('VM sizes intent for the proximity placement group.')
+param vmSizes array = []
+
+@description('Enable Azure telemetry collection.')
+param enableTelemetry bool = true
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module proximityPlacementGroup 'br/public:avm/res/compute/proximity-placement-group:0.4.1' = {
+  name: take('avm.res.compute.proximity-placement-group.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    availabilityZone: availabilityZone
+    intent: !empty(vmSizes) ? { vmSizes: vmSizes } : null
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the proximity placement group.')
+output resourceId string = proximityPlacementGroup.outputs.resourceId
+
+@description('Name of the proximity placement group.')
+output name string = proximityPlacementGroup.outputs.name
diff --git a/infra/avm/modules/compute/virtual-machine.bicep b/infra/avm/modules/compute/virtual-machine.bicep
new file mode 100644
index 000000000..cbbcf0d31
--- /dev/null
+++ b/infra/avm/modules/compute/virtual-machine.bicep
@@ -0,0 +1,160 @@
+// ============================================================================
+// Module: Virtual Machine (Jumpbox)
+// Description: AVM wrapper for Azure Virtual Machine with Entra ID authentication
+// AVM Module: avm/res/compute/virtual-machine
+// Ref: https://learn.microsoft.com/azure/bastion/bastion-entra-id-authentication
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the virtual machine.')
+param name string = 'vm-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('VM size.')
+param vmSize string = 'Standard_D2s_v5'
+
+@secure()
+@description('Local admin username. Required by Azure at provisioning time but not used for login when Entra ID is enabled.')
+param adminUsername string
+
+@secure()
+@description('Local admin password. Required by Azure at provisioning time but not used for login when Entra ID is enabled.')
+param adminPassword string
+
+@description('Resource ID of the subnet for the VM NIC.')
+param subnetResourceId string
+
+@description('OS type for the VM.')
+param osType string = 'Windows'
+
+@description('Availability zone for the VM.')
+param availabilityZone int = -1
+
+@description('Image reference for the VM.')
+param imageReference object = {
+  publisher: 'microsoft-dsvm'
+  offer: 'dsvm-win-2022'
+  sku: 'winserver-2022'
+  version: 'latest'
+}
+
+@description('OS disk size in GB.')
+param osDiskSizeGB int = 128
+
+@description('Resource ID of the maintenance configuration.')
+param maintenanceConfigurationResourceId string?
+
+@description('Resource ID of the proximity placement group.')
+param proximityPlacementGroupResourceId string?
+
+@description('Monitoring agent extension configuration (data collection rule associations).')
+param extensionMonitoringAgentConfig object?
+
+@description('Diagnostic settings for the resource.')
+param diagnosticSettings array?
+
+@description('Enable Azure telemetry collection.')
+param enableTelemetry bool = true
+
+@description('Deploying user principal ID. Used for default role assignment to grant the deploying user login access to the VM. This is required because with Entra ID authentication enabled, local accounts cannot be used to access the VM, including the local admin account created at provisioning.')
+param deployingUserPrincipalId string
+
+@description('Deploying user principal type. Used for default role assignment to grant the deploying user login access to the VM. This is required because with Entra ID authentication enabled, local accounts cannot be used to access the VM, including the local admin account created at provisioning.')
+param deployingUserPrincipalType string = 'User'
+
+@description('Role assignments to apply to the virtual machine.')
+param roleAssignments array = [
+  {
+    roleDefinitionIdOrName: '1c0163c0-47e6-4577-8991-ea5c82e286e4' // Virtual Machine Administrator Login
+    principalId: deployingUserPrincipalId
+    principalType: deployingUserPrincipalType
+  }
+]
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module virtualMachine 'br/public:avm/res/compute/virtual-machine:0.22.0' = {
+  name: take('avm.res.compute.virtual-machine.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    computerName: take(name, 15)
+    osType: osType
+    vmSize: vmSize
+    adminUsername: adminUsername
+    adminPassword: adminPassword
+    managedIdentities: managedIdentities
+    patchMode: 'AutomaticByPlatform'
+    bypassPlatformSafetyChecksOnUserSchedule: true
+    maintenanceConfigurationResourceId: maintenanceConfigurationResourceId
+    enableAutomaticUpdates: true
+    encryptionAtHost: true
+    availabilityZone: availabilityZone
+    proximityPlacementGroupResourceId: proximityPlacementGroupResourceId
+    imageReference: imageReference
+    osDisk: {
+      name: 'osdisk-${name}'
+      caching: 'ReadWrite'
+      createOption: 'FromImage'
+      deleteOption: 'Delete'
+      diskSizeGB: osDiskSizeGB
+      managedDisk: { storageAccountType: 'Premium_LRS' }
+    }
+    nicConfigurations: [
+      {
+        name: 'nic-${name}'
+        tags: tags
+        deleteOption: 'Delete'
+        diagnosticSettings: diagnosticSettings
+        ipConfigurations: [
+          {
+            name: '${name}-nic01-ipconfig01'
+            subnetResourceId: subnetResourceId
+            diagnosticSettings: diagnosticSettings
+          }
+        ]
+      }
+    ]
+    roleAssignments: roleAssignments
+    extensionAadJoinConfig: {
+      enabled: true
+      tags: tags
+      typeHandlerVersion: '2.0'
+      settings: { mdmId: '' }
+    }
+    extensionAntiMalwareConfig: {
+      enabled: true
+      settings: {
+        AntimalwareEnabled: 'true'
+        Exclusions: {}
+        RealtimeProtectionEnabled: 'true'
+        ScheduledScanSettings: { day: '7', isEnabled: 'true', scanType: 'Quick', time: '120' }
+      }
+      tags: tags
+    }
+    extensionMonitoringAgentConfig: extensionMonitoringAgentConfig
+    extensionNetworkWatcherAgentConfig: { enabled: true, tags: tags }
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the virtual machine.')
+output resourceId string = virtualMachine.outputs.resourceId
+
+@description('Name of the virtual machine.')
+output name string = virtualMachine.outputs.name
diff --git a/infra/avm/modules/data/cosmos-db-nosql.bicep b/infra/avm/modules/data/cosmos-db-nosql.bicep
new file mode 100644
index 000000000..56d786449
--- /dev/null
+++ b/infra/avm/modules/data/cosmos-db-nosql.bicep
@@ -0,0 +1,130 @@
+// ============================================================================
+// Module: Cosmos DB
+// Description: AVM wrapper for Azure Cosmos DB (NoSQL) with WAF alignment
+// AVM Module: avm/res/document-db/database-account:0.19.0
+// WAF: https://learn.microsoft.com/azure/well-architected/service-guides/cosmos-db
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the Cosmos DB account.')
+param name string = 'cosmos-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Database name.')
+param databaseName string = 'db_conversation_history'
+
+@description('Container definitions.')
+param containers array = [
+  {
+    name: 'conversations'
+    partitionKeyPath: '/userId'
+  }
+]
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+// --- WAF: Monitoring ---
+@description('Diagnostic settings for monitoring.')
+param diagnosticSettings array = []
+
+// --- WAF: Private Networking ---
+@description('Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
+@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
+param privateEndpoints privateEndpointSingleServiceType[]?
+
+// --- WAF: Redundancy ---
+@description('Enable zone redundancy.')
+param zoneRedundant bool = false
+
+@description('Enable automatic failover.')
+param enableAutomaticFailover bool = false
+
+@description('Optional. HA paired region for multi-region failover when redundancy is enabled.')
+param haLocation string = ''
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module cosmosAccount 'br/public:avm/res/document-db/database-account:0.19.0' = {
+  name: take('avm.res.document-db.database-account.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    capabilitiesToAdd: zoneRedundant ? [] : ['EnableServerless']
+    sqlDatabases: [
+      {
+        name: databaseName
+        containers: [for container in containers: {
+          name: container.name
+          paths: [container.partitionKeyPath]
+          kind: 'Hash'
+          version: 2
+        }]
+      }
+    ]
+    sqlRoleAssignments: []
+    diagnosticSettings: !empty(diagnosticSettings) ? diagnosticSettings : []
+    networkRestrictions: {
+      networkAclBypass: 'None'
+      publicNetworkAccess: publicNetworkAccess
+    }
+    privateEndpoints: privateEndpoints
+    zoneRedundant: zoneRedundant
+    enableAutomaticFailover: enableAutomaticFailover
+    managedIdentities: managedIdentities
+    failoverLocations: zoneRedundant
+      ? [
+          {
+            failoverPriority: 0
+            isZoneRedundant: true
+            locationName: location
+          }
+          {
+            failoverPriority: 1
+            isZoneRedundant: true
+            locationName: haLocation
+          }
+        ]
+      : [
+          {
+            locationName: location
+            failoverPriority: 0
+            isZoneRedundant: false
+          }
+        ]
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the Cosmos DB account.')
+output resourceId string = cosmosAccount.outputs.resourceId
+
+@description('Name of the Cosmos DB account.')
+output name string = cosmosAccount.outputs.name
+
+@description('Endpoint of the Cosmos DB account.')
+output endpoint string = 'https://${name}.documents.azure.com:443/'
+
+@description('Database name.')
+output databaseName string = databaseName
+
+@description('Container name (first container).')
+output containerName string = containers[0].name
diff --git a/infra/avm/modules/data/sql-database.bicep b/infra/avm/modules/data/sql-database.bicep
new file mode 100644
index 000000000..a1447bb12
--- /dev/null
+++ b/infra/avm/modules/data/sql-database.bicep
@@ -0,0 +1,127 @@
+// ============================================================================
+// Module: SQL Database
+// Description: AVM wrapper for Azure SQL Server and Database
+// AVM Module: avm/res/sql/server:0.21.1
+// WAF: https://learn.microsoft.com/azure/well-architected/service-guides/azure-sql-database
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the SQL Server.')
+param name string = 'sql-${solutionName}'
+
+@description('Name of the SQL Database.')
+param databaseName string = 'sqldb-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Principal ID of the deployer for admin access.')
+param deployerPrincipalId string
+
+@description('Principal name of the deployer for admin access.')
+param deployerPrincipalName string
+
+@description('SKU name for the database.')
+param skuName string = 'GP_S_Gen5'
+
+@description('SKU tier for the database.')
+param skuTier string = 'GeneralPurpose'
+
+@description('SKU family.')
+param skuFamily string = 'Gen5'
+
+@description('vCore capacity.')
+param skuCapacity int = 2
+
+@description('Auto-pause delay in minutes.')
+param autoPauseDelay int = 60
+
+@description('Minimum capacity (vCores).')
+param minCapacity int = 1
+
+// --- WAF: Private Networking ---
+@description('Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
+@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
+param privateEndpoints privateEndpointSingleServiceType[]?
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module sqlServer 'br/public:avm/res/sql/server:0.21.1' = {
+  name: take('avm.res.sql.server.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    minimalTlsVersion: '1.2'
+    publicNetworkAccess: publicNetworkAccess
+    restrictOutboundNetworkAccess: 'Disabled'
+    managedIdentities: managedIdentities
+    administrators: {
+      azureADOnlyAuthentication: true
+      login: deployerPrincipalName
+      principalType: 'User'
+      sid: deployerPrincipalId
+      tenantId: subscription().tenantId
+    }
+    databases: [
+      {
+        name: databaseName
+        availabilityZone: -1
+        collation: 'SQL_Latin1_General_CP1_CI_AS'
+        autoPauseDelay: autoPauseDelay
+        minCapacity: '${minCapacity}'
+        zoneRedundant: false
+        sku: {
+          name: skuName
+          tier: skuTier
+          family: skuFamily
+          capacity: skuCapacity
+        }
+      }
+    ]
+    firewallRules: publicNetworkAccess == 'Enabled' ? [
+      {
+        name: 'AllowSpecificRange'
+        startIpAddress: '0.0.0.0'
+        endIpAddress: '255.255.255.255'
+      }
+      {
+        name: 'AllowAllAzureServicesAndResourcesWithinAzureIps'
+        startIpAddress: '0.0.0.0'
+        endIpAddress: '0.0.0.0'
+      }
+    ] : []
+    privateEndpoints: privateEndpoints
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Fully qualified domain name of the SQL Server.')
+output serverFqdn string = '${name}.database.windows.net'
+
+@description('Name of the SQL Database.')
+output databaseName string = databaseName
+
+@description('Resource ID of the SQL Server.')
+output serverResourceId string = sqlServer.outputs.resourceId
+
+@description('Name of the SQL Server.')
+output name string = sqlServer.outputs.name
diff --git a/infra/avm/modules/data/storage-account.bicep b/infra/avm/modules/data/storage-account.bicep
new file mode 100644
index 000000000..bf4732ae7
--- /dev/null
+++ b/infra/avm/modules/data/storage-account.bicep
@@ -0,0 +1,123 @@
+// ============================================================================
+// Module: Storage Account
+// Description: AVM wrapper for Azure Storage Account with WAF alignment
+// AVM Module: avm/res/storage/storage-account:0.32.0
+// WAF: https://learn.microsoft.com/azure/well-architected/service-guides/storage-accounts
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the storage account.')
+param name string = take('st${toLower(replace(solutionName, '-', ''))}', 24)
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Storage account SKU.')
+param skuName string = 'Standard_LRS'
+
+@description('Storage account kind.')
+param kind string = 'StorageV2'
+
+@description('Access tier.')
+@allowed(['Hot', 'Cool'])
+param accessTier string = 'Hot'
+
+@description('Allow blob public access.')
+param allowBlobPublicAccess bool = false
+
+@description('Allow shared key access.')
+param allowSharedKeyAccess bool = true
+
+@description('Enable hierarchical namespace (Data Lake Storage Gen2).')
+param enableHierarchicalNamespace bool = false
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Blob containers to create.')
+param containers array = [
+  {
+    name: 'default'
+    publicAccess: 'None'
+  }
+]
+
+// --- WAF: Monitoring ---
+@description('Diagnostic settings for monitoring.')
+param diagnosticSettings array = []
+
+// --- WAF: Private Networking ---
+@description('Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+@description('Network ACLs for the storage account.')
+param networkAcls object = {
+  defaultAction: 'Allow'
+  bypass: 'AzureServices'
+}
+
+import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
+@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
+param privateEndpoints privateEndpointSingleServiceType[]?
+
+// --- Role Assignments ---
+@description('Optional. Array of role assignments to create on the Storage Account.')
+param roleAssignments array = []
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module storage 'br/public:avm/res/storage/storage-account:0.32.0' = {
+  name: take('avm.res.storage.storage-account.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    skuName: skuName
+    kind: kind
+    accessTier: accessTier
+    allowBlobPublicAccess: allowBlobPublicAccess
+    allowSharedKeyAccess: allowSharedKeyAccess
+    enableHierarchicalNamespace: enableHierarchicalNamespace
+    minimumTlsVersion: 'TLS1_2'
+    supportsHttpsTrafficOnly: true
+    requireInfrastructureEncryption: true
+    publicNetworkAccess: publicNetworkAccess
+    networkAcls: networkAcls
+    managedIdentities: managedIdentities
+    blobServices: {
+      containers: [for container in containers: {
+        name: container.name
+        publicAccess: container.publicAccess
+      }]
+      diagnosticSettings: !empty(diagnosticSettings) ? diagnosticSettings : []
+    }
+    diagnosticSettings: !empty(diagnosticSettings) ? diagnosticSettings : []
+    privateEndpoints: privateEndpoints
+    roleAssignments: !empty(roleAssignments) ? roleAssignments : []
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the Storage Account.')
+output resourceId string = storage.outputs.resourceId
+
+@description('Name of the Storage Account.')
+output name string = storage.outputs.name
+
+@description('Primary blob endpoint.')
+output blobEndpoint string = storage.outputs.primaryBlobEndpoint
+
+@description('Service endpoints.')
+output serviceEndpoints object = storage.outputs.serviceEndpoints
diff --git a/infra/avm/modules/identity/cross-scope-role-assignment.bicep b/infra/avm/modules/identity/cross-scope-role-assignment.bicep
new file mode 100644
index 000000000..e0f55cf97
--- /dev/null
+++ b/infra/avm/modules/identity/cross-scope-role-assignment.bicep
@@ -0,0 +1,58 @@
+// ============================================================================
+// cross-scope-role-assignment.bicep
+// Description: Reusable helper that creates a single role assignment scoped
+//              to an existing AI Services resource. Used for cross-resource-
+//              group RBAC where the AI Services lives in a different RG.
+// ============================================================================
+
+@description('The principal ID to assign the role to.')
+param principalId string
+
+@description('The resource ID of the role definition to assign.')
+param roleDefinitionId string
+
+@description('A unique name for the role assignment.')
+param roleAssignmentName string
+
+@description('The principal type of the identity being assigned.')
+@allowed(['ServicePrincipal', 'User', 'Group'])
+param principalType string = 'ServicePrincipal'
+
+@description('The type of target resource to scope the role assignment to.')
+@allowed(['AIServices', 'ContainerRegistry'])
+param targetResourceType string = 'AIServices'
+
+@description('Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices.')
+param aiFoundryName string = ''
+
+@description('Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry.')
+param containerRegistryName string = ''
+
+// Reference the existing target resource in this resource group
+resource aiFoundryAccount 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = if (targetResourceType == 'AIServices') {
+  name: aiFoundryName
+}
+
+resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' existing = if (targetResourceType == 'ContainerRegistry') {
+  name: containerRegistryName
+}
+
+resource aiRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (targetResourceType == 'AIServices') {
+  name: roleAssignmentName
+  scope: aiFoundryAccount
+  properties: {
+    roleDefinitionId: roleDefinitionId
+    principalId: principalId
+    principalType: principalType
+  }
+}
+
+resource acrRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (targetResourceType == 'ContainerRegistry') {
+  name: roleAssignmentName
+  scope: containerRegistry
+  properties: {
+    roleDefinitionId: roleDefinitionId
+    principalId: principalId
+    principalType: principalType
+  }
+}
diff --git a/infra/avm/modules/identity/role-assignments.bicep b/infra/avm/modules/identity/role-assignments.bicep
new file mode 100644
index 000000000..3e4399ae3
--- /dev/null
+++ b/infra/avm/modules/identity/role-assignments.bicep
@@ -0,0 +1,343 @@
+// ============================================================================
+// Module: Role Assignments (centralized — all cross-service + data plane RBAC)
+// Description: RG-level, cross-service, and data-plane role assignments.
+//              One place to audit "who has access to what".
+// ============================================================================
+
+// ============================================================================
+// Parameters
+// ============================================================================
+
+@description('Solution name suffix for generating unique role assignment GUIDs.')
+param solutionName string = ''
+
+@description('Whether to use an existing AI project (true) or create new (false).')
+param useExistingAIProject bool = false
+
+@description('Resource ID of the existing AI project (for deriving AI Services name/sub/RG).')
+param existingFoundryProjectResourceId string = ''
+
+// --- Identity Principal IDs ---
+
+@description('Principal ID of the AI project identity (works for both new and existing projects).')
+param aiProjectPrincipalId string = ''
+
+@description('Principal ID of the AI Search identity.')
+param aiSearchPrincipalId string = ''
+
+@description('Principal ID of the backend App Service system-assigned identity (empty if not deployed).')
+param backendAppServicePrincipalId string = ''
+
+// --- Resource References ---
+
+@description('Resource ID of the AI Foundry account (empty if not deployed — new project path).')
+param aiFoundryResourceId string = ''
+
+@description('Resource ID of the AI Search service (empty if not deployed).')
+param aiSearchResourceId string = ''
+
+@description('Resource ID of the Storage Account (empty if not deployed).')
+param storageAccountResourceId string = ''
+
+@description('Name of the Cosmos DB account (empty if not deployed).')
+param cosmosDbAccountName string = ''
+
+@description('Whether to use an existing container registry (true) or the one created in this deployment (false).')
+param useExistingContainerRegistry bool = false
+
+@description('Resource ID of the container registry to grant AcrPull on (for deriving name/sub/RG; empty = skip ACR role assignments).')
+param containerRegistryResourceId string = ''
+
+@description('Principals to grant AcrPull on the container registry (array of objects with principalId and principalType).')
+param acrPullPrincipals array = []
+
+// ============================================================================
+// Derived Variables
+// ============================================================================
+
+var existingAIFoundryName = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[8] : ''
+var existingAIFoundrySubscription = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[2] : subscription().subscriptionId
+var existingAIFoundryResourceGroup = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[4] : resourceGroup().name
+
+// Container registry — derive name, subscription, and resource group from the resource ID (new or existing).
+var containerRegistryName = empty(containerRegistryResourceId) ? '' : split(containerRegistryResourceId, '/')[8]
+var containerRegistrySubscription = empty(containerRegistryResourceId) ? subscription().subscriptionId : split(containerRegistryResourceId, '/')[2]
+var containerRegistryResourceGroup = empty(containerRegistryResourceId) ? resourceGroup().name : split(containerRegistryResourceId, '/')[4]
+
+// ============================================================================
+// Role Definitions
+// ============================================================================
+
+var roleDefinitions = {
+  azureAiUser: '53ca6127-db72-4b80-b1b0-d745d6d5456d' // Foundry User
+  cognitiveServicesUser: 'a97b65f3-24c7-4388-baec-2e87135dc908'
+  cognitiveServicesOpenAIUser: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
+  searchIndexDataReader: '1407120a-92aa-4202-b7e9-c0e197c71c8f'
+  searchIndexDataContributor: '8ebe5a00-799e-43f5-93ac-243d3dce84a7'
+  searchServiceContributor: '7ca78c08-252a-4471-8644-bb5ff32d4ba0'
+  storageBlobDataContributor: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
+  storageBlobDataReader: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
+  storageQueueDataContributor: '974c5e8b-45b9-4653-ba55-5f855dd0fb88'
+  acrPull: '7f951dda-4ed3-4680-a7ca-43fe172d538d'
+}
+
+// ============================================================================
+// Existing Resource References
+// ============================================================================
+
+resource aiFoundryAccount 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = if (!empty(aiFoundryResourceId)) {
+  name: last(split(aiFoundryResourceId, '/'))
+}
+
+resource aiSearchService 'Microsoft.Search/searchServices@2025-05-01' existing = if (!empty(aiSearchResourceId)) {
+  name: last(split(aiSearchResourceId, '/'))
+}
+
+resource storageAccount 'Microsoft.Storage/storageAccounts@2025-08-01' existing = if (!empty(storageAccountResourceId)) {
+  name: last(split(storageAccountResourceId, '/'))
+}
+
+resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' existing = if (!empty(cosmosDbAccountName)) {
+  name: cosmosDbAccountName
+}
+
+resource cosmosContributorRoleDefinition 'Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions@2025-10-15' existing = if (!empty(cosmosDbAccountName)) {
+  parent: cosmosAccount
+  name: '00000000-0000-0000-0000-000000000002' // Cosmos DB Built-in Data Contributor
+}
+
+// ============================================================================
+// 1. AI SERVICES ROLE ASSIGNMENTS
+//    Cross-service roles scoped to AI Foundry account
+// ============================================================================
+
+// AI Search → Cognitive Services OpenAI User on AI Foundry (new project, same RG)
+resource assignOpenAIRoleToAISearch 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiSearchPrincipalId) && !empty(aiFoundryResourceId)) {
+  name: guid(solutionName, aiFoundryAccount.id, aiSearchPrincipalId, roleDefinitions.cognitiveServicesOpenAIUser)
+  scope: aiFoundryAccount
+  properties: {
+    principalId: aiSearchPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesOpenAIUser)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// AI Search → Cognitive Services OpenAI User on existing AI Foundry (cross-scope)
+module assignOpenAIToSearchExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(aiSearchPrincipalId)) {
+  name: 'assignOpenAIRoleToAISearchExisting'
+  scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup)
+  params: {
+    principalId: aiSearchPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesOpenAIUser)
+    roleAssignmentName: guid(solutionName, existingAIFoundryName, aiSearchPrincipalId, roleDefinitions.cognitiveServicesOpenAIUser)
+    aiFoundryName: existingAIFoundryName
+  }
+}
+
+// Backend App Service → Foundry User on AI Foundry (new project, same RG)
+resource backendAppAiUserAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiFoundryResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, aiFoundryAccount.id, backendAppServicePrincipalId, roleDefinitions.azureAiUser)
+  scope: aiFoundryAccount
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.azureAiUser)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Foundry User on existing AI Foundry (cross-scope)
+module backendAppAiUserExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(backendAppServicePrincipalId)) {
+  name: 'assignAiUserRoleToBackendExisting'
+  scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup)
+  params: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.azureAiUser)
+    roleAssignmentName: guid(solutionName, existingAIFoundryName, backendAppServicePrincipalId, roleDefinitions.azureAiUser)
+    aiFoundryName: existingAIFoundryName
+  }
+}
+
+// Backend App Service → Cognitive Services OpenAI User on AI Foundry (new project, same RG)
+resource backendAppOpenAIUserAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiFoundryResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, aiFoundryAccount.id, backendAppServicePrincipalId, roleDefinitions.cognitiveServicesOpenAIUser)
+  scope: aiFoundryAccount
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesOpenAIUser)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Cognitive Services OpenAI User on existing AI Foundry (cross-scope)
+module backendAppOpenAIUserExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(backendAppServicePrincipalId)) {
+  name: 'assignOpenAIUserRoleToBackendExisting'
+  scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup)
+  params: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesOpenAIUser)
+    roleAssignmentName: guid(solutionName, existingAIFoundryName, backendAppServicePrincipalId, roleDefinitions.cognitiveServicesOpenAIUser)
+    aiFoundryName: existingAIFoundryName
+  }
+}
+
+// ============================================================================
+// 2. SEARCH SERVICE ROLE ASSIGNMENTS
+//    AI Project and Backend identities → AI Search
+// ============================================================================
+
+// AI Project → Search Index Data Reader on AI Search
+resource projectSearchReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(aiProjectPrincipalId)) {
+  name: guid(solutionName, aiSearchService.id, aiProjectPrincipalId, roleDefinitions.searchIndexDataReader)
+  scope: aiSearchService
+  properties: {
+    principalId: aiProjectPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchIndexDataReader)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// AI Project → Search Service Contributor on AI Search
+resource projectSearchContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(aiProjectPrincipalId)) {
+  name: guid(solutionName, aiSearchService.id, aiProjectPrincipalId, roleDefinitions.searchServiceContributor)
+  scope: aiSearchService
+  properties: {
+    principalId: aiProjectPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchServiceContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Search Index Data Contributor on AI Search
+resource backendAppSearchIndexContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, aiSearchService.id, backendAppServicePrincipalId, roleDefinitions.searchIndexDataContributor)
+  scope: aiSearchService
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchIndexDataContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Search Service Contributor on AI Search
+resource backendAppSearchContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, aiSearchService.id, backendAppServicePrincipalId, roleDefinitions.searchServiceContributor)
+  scope: aiSearchService
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchServiceContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// ============================================================================
+// 3. STORAGE ROLE ASSIGNMENTS
+//    AI Project, AI Search, and Existing Project identities → Storage
+// ============================================================================
+
+// AI Project → Storage Blob Data Contributor
+resource projectStorageContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(aiProjectPrincipalId)) {
+  name: guid(solutionName, storageAccount.id, aiProjectPrincipalId, roleDefinitions.storageBlobDataContributor)
+  scope: storageAccount
+  properties: {
+    principalId: aiProjectPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// AI Project → Storage Blob Data Reader
+resource projectStorageReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(aiProjectPrincipalId)) {
+  name: guid(solutionName, storageAccount.id, aiProjectPrincipalId, roleDefinitions.storageBlobDataReader)
+  scope: storageAccount
+  properties: {
+    principalId: aiProjectPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataReader)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// AI Search → Storage Blob Data Reader
+resource searchStorageReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(aiSearchPrincipalId)) {
+  name: guid(solutionName, storageAccount.id, aiSearchPrincipalId, roleDefinitions.storageBlobDataReader)
+  scope: storageAccount
+  properties: {
+    principalId: aiSearchPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataReader)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Storage Blob Data Contributor
+resource backendAppStorageBlobContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, storageAccount.id, backendAppServicePrincipalId, roleDefinitions.storageBlobDataContributor)
+  scope: storageAccount
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Storage Queue Data Contributor
+resource backendAppStorageQueueContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, storageAccount.id, backendAppServicePrincipalId, roleDefinitions.storageQueueDataContributor)
+  scope: storageAccount
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageQueueDataContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// ============================================================================
+// 4. COSMOS DB ROLE ASSIGNMENTS
+//    Backend App Service → Cosmos DB (data-plane, uses sqlRoleAssignments)
+// ============================================================================
+
+resource backendAppCosmosRoleAssignment 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2025-10-15' = if (!empty(cosmosDbAccountName) && !empty(backendAppServicePrincipalId)) {
+  parent: cosmosAccount
+  name: guid(solutionName, cosmosContributorRoleDefinition.id, cosmosAccount.id, backendAppServicePrincipalId)
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: cosmosContributorRoleDefinition.id
+    scope: cosmosAccount.id
+  }
+}
+
+// ============================================================================
+// 5. CONTAINER REGISTRY ROLE ASSIGNMENTS
+//    Grants AcrPull to every principal in acrPullPrincipals (e.g. the deployer,
+//    the backend/frontend app services, or container app identities). Mirrors
+//    the AI Foundry pattern: a newly created (same resource group) registry is
+//    assigned inline; an existing (reused) registry — which may live in another
+//    resource group or subscription — is assigned via the cross-scope helper.
+// ============================================================================
+
+resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' existing = if (!useExistingContainerRegistry) {
+  name: containerRegistryName
+}
+
+// Each principal → AcrPull on a newly created (same resource group) container registry
+resource acrPullAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for principal in acrPullPrincipals: if (!useExistingContainerRegistry && !empty(principal.principalId)) {
+  name: guid(solutionName, containerRegistryName, principal.principalId, roleDefinitions.acrPull)
+  scope: containerRegistry
+  properties: {
+    principalId: principal.principalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.acrPull)
+    principalType: principal.principalType
+  }
+}]
+
+// Each principal → AcrPull on an existing (reused) cross-scope container registry
+module acrPullAssignmentsExisting './cross-scope-role-assignment.bicep' = [for principal in acrPullPrincipals: if (useExistingContainerRegistry && !empty(principal.principalId)) {
+  name: take('acrPull-${uniqueString(solutionName, containerRegistryName, principal.principalId)}', 64)
+  scope: resourceGroup(containerRegistrySubscription, containerRegistryResourceGroup)
+  params: {
+    targetResourceType: 'ContainerRegistry'
+    containerRegistryName: containerRegistryName
+    principalId: principal.principalId
+    principalType: principal.principalType
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.acrPull)
+    roleAssignmentName: guid(solutionName, containerRegistryName, principal.principalId, roleDefinitions.acrPull)
+  }
+}]
diff --git a/infra/avm/modules/monitoring/app-insights.bicep b/infra/avm/modules/monitoring/app-insights.bicep
new file mode 100644
index 000000000..b726ae81d
--- /dev/null
+++ b/infra/avm/modules/monitoring/app-insights.bicep
@@ -0,0 +1,76 @@
+// ============================================================================
+// Module: Application Insights
+// Description: AVM wrapper for Application Insights with WAF alignment
+// AVM Module: avm/res/insights/component:0.7.1
+// WAF: https://learn.microsoft.com/azure/well-architected/service-guides/application-insights
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Optional. Override name for the Application Insights instance. Defaults to appi-{solutionName}.')
+param name string = 'appi-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Resource ID of the Log Analytics workspace to link to.')
+param workspaceResourceId string
+
+@description('Application type.')
+param applicationType string = 'web'
+
+@description('Retention period in days. WAF recommends 365.')
+param retentionInDays int = 365
+
+@description('Disable IP masking for security. WAF recommends false.')
+param disableIpMasking bool = false
+
+@description('Flow type for Application Insights.')
+param flowType string = 'Bluefield'
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Kind of Application Insights resource.')
+param kind string = 'web'
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module appInsights 'br/public:avm/res/insights/component:0.7.1' = {
+  name: take('avm.res.insights.component.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    workspaceResourceId: workspaceResourceId
+    kind: kind
+    applicationType: applicationType
+    enableTelemetry: enableTelemetry
+    retentionInDays: retentionInDays
+    disableIpMasking: disableIpMasking
+    flowType: flowType
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the Application Insights instance.')
+output resourceId string = appInsights.outputs.resourceId
+
+@description('Name of the Application Insights instance.')
+output name string = appInsights.outputs.name
+
+@description('Instrumentation key for the Application Insights instance.')
+output instrumentationKey string = appInsights.outputs.instrumentationKey
+
+@description('Connection string for the Application Insights instance.')
+output connectionString string = appInsights.outputs.connectionString
+
+@description('Application ID of the Application Insights instance.')
+output applicationId string = appInsights.outputs.applicationId
diff --git a/infra/avm/modules/monitoring/data-collection-rule.bicep b/infra/avm/modules/monitoring/data-collection-rule.bicep
new file mode 100644
index 000000000..615c17b3c
--- /dev/null
+++ b/infra/avm/modules/monitoring/data-collection-rule.bicep
@@ -0,0 +1,153 @@
+// ============================================================================
+// Module: Data Collection Rule
+// Description: AVM wrapper for Azure Monitor Data Collection Rule
+// AVM Module: avm/res/insights/data-collection-rule
+// WAF: Monitoring for VM observability
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Optional. Override name for the data collection rule. Defaults to dcr-{solutionName}.')
+param name string = 'dcr-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Resource ID of the Log Analytics workspace destination.')
+param logAnalyticsWorkspaceResourceId string
+
+@description('Name of the Log Analytics workspace (used for destination naming).')
+param logAnalyticsWorkspaceName string = ''
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+var dcrLogAnalyticsDestinationName = !empty(logAnalyticsWorkspaceName) ? 'la-${logAnalyticsWorkspaceName}-destination' : 'la-${name}-destination'
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module dataCollectionRule 'br/public:avm/res/insights/data-collection-rule:0.11.0' = {
+  name: take('avm.res.insights.data-collection-rule.${name}', 64)
+  params: {
+    name: name
+    tags: tags
+    enableTelemetry: enableTelemetry
+    location: location
+    managedIdentities: managedIdentities
+    dataCollectionRuleProperties: {
+      kind: 'Windows'
+      dataSources: {
+        performanceCounters: [
+          {
+            streams: ['Microsoft-Perf']
+            samplingFrequencyInSeconds: 60
+            counterSpecifiers: [
+              '\\Processor Information(_Total)\\% Processor Time'
+              '\\Processor Information(_Total)\\% Privileged Time'
+              '\\Processor Information(_Total)\\% User Time'
+              '\\Processor Information(_Total)\\Processor Frequency'
+              '\\System\\Processes'
+              '\\Process(_Total)\\Thread Count'
+              '\\Process(_Total)\\Handle Count'
+              '\\System\\System Up Time'
+              '\\System\\Context Switches/sec'
+              '\\System\\Processor Queue Length'
+              '\\Memory\\% Committed Bytes In Use'
+              '\\Memory\\Available Bytes'
+              '\\Memory\\Committed Bytes'
+              '\\Memory\\Cache Bytes'
+              '\\Memory\\Pool Paged Bytes'
+              '\\Memory\\Pool Nonpaged Bytes'
+              '\\Memory\\Pages/sec'
+              '\\Memory\\Page Faults/sec'
+              '\\Process(_Total)\\Working Set'
+              '\\Process(_Total)\\Working Set - Private'
+              '\\LogicalDisk(_Total)\\% Disk Time'
+              '\\LogicalDisk(_Total)\\% Disk Read Time'
+              '\\LogicalDisk(_Total)\\% Disk Write Time'
+              '\\LogicalDisk(_Total)\\% Idle Time'
+              '\\LogicalDisk(_Total)\\Disk Bytes/sec'
+              '\\LogicalDisk(_Total)\\Disk Read Bytes/sec'
+              '\\LogicalDisk(_Total)\\Disk Write Bytes/sec'
+              '\\LogicalDisk(_Total)\\Disk Transfers/sec'
+              '\\LogicalDisk(_Total)\\Disk Reads/sec'
+              '\\LogicalDisk(_Total)\\Disk Writes/sec'
+              '\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer'
+              '\\LogicalDisk(_Total)\\Avg. Disk sec/Read'
+              '\\LogicalDisk(_Total)\\Avg. Disk sec/Write'
+              '\\LogicalDisk(_Total)\\Avg. Disk Queue Length'
+              '\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length'
+              '\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length'
+              '\\LogicalDisk(_Total)\\% Free Space'
+              '\\LogicalDisk(_Total)\\Free Megabytes'
+              '\\Network Interface(*)\\Bytes Total/sec'
+              '\\Network Interface(*)\\Bytes Sent/sec'
+              '\\Network Interface(*)\\Bytes Received/sec'
+              '\\Network Interface(*)\\Packets/sec'
+              '\\Network Interface(*)\\Packets Sent/sec'
+              '\\Network Interface(*)\\Packets Received/sec'
+              '\\Network Interface(*)\\Packets Outbound Errors'
+              '\\Network Interface(*)\\Packets Received Errors'
+            ]
+            name: 'perfCounterDataSource60'
+          }
+        ]
+        windowsEventLogs: [
+          {
+            name: 'SecurityAuditEvents'
+            streams: ['Microsoft-WindowsEvent']
+            xPathQueries: [
+              'Security!*[System[(EventID=4624 or EventID=4625)]]'
+            ]
+          }
+          {
+            name: 'AuditSuccessFailure'
+            streams: ['Microsoft-Event']
+            xPathQueries: [
+              'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'
+            ]
+          }
+        ]
+      }
+      destinations: {
+        logAnalytics: [
+          {
+            workspaceResourceId: logAnalyticsWorkspaceResourceId
+            name: dcrLogAnalyticsDestinationName
+          }
+        ]
+      }
+      dataFlows: [
+        {
+          streams: ['Microsoft-Perf']
+          destinations: [dcrLogAnalyticsDestinationName]
+          transformKql: 'source'
+          outputStream: 'Microsoft-Perf'
+        }
+        {
+          streams: ['Microsoft-Event']
+          destinations: [dcrLogAnalyticsDestinationName]
+          transformKql: 'source'
+          outputStream: 'Microsoft-Event'
+        }
+      ]
+    }
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the data collection rule.')
+output resourceId string = dataCollectionRule.outputs.resourceId
+
+@description('Name of the data collection rule.')
+output name string = dataCollectionRule.outputs.name
diff --git a/infra/avm/modules/monitoring/log-analytics.bicep b/infra/avm/modules/monitoring/log-analytics.bicep
new file mode 100644
index 000000000..e594d8b56
--- /dev/null
+++ b/infra/avm/modules/monitoring/log-analytics.bicep
@@ -0,0 +1,94 @@
+// ============================================================================
+// Module: Log Analytics Workspace
+// Description: AVM wrapper for Log Analytics Workspace with WAF alignment
+// AVM Module: avm/res/operational-insights/workspace:0.15.0
+// WAF: https://learn.microsoft.com/azure/well-architected/service-guides/azure-log-analytics
+// Note: This module only handles NEW workspace creation.
+//       Existing workspace logic is handled in main.bicep.
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Optional. Override name for the Log Analytics workspace. Defaults to log-{solutionName}.')
+param name string = 'log-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Retention period in days. WAF recommends 365.')
+param retentionInDays int = 365
+
+@description('SKU name for the workspace.')
+param skuName string = 'PerGB2018'
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+// --- WAF: Private Networking ---
+@description('Public network access for ingestion.')
+param publicNetworkAccessForIngestion string = 'Enabled'
+
+@description('Public network access for query.')
+param publicNetworkAccessForQuery string = 'Enabled'
+
+// --- WAF: Redundancy ---
+@description('Enable workspace replication for redundancy.')
+param enableReplication bool = false
+
+@description('Replication location (paired region).')
+param replicationLocation string = ''
+
+@description('Daily quota in GB. WAF recommends 150 GB/day as starting point.')
+param dailyQuotaGb string = ''
+
+// --- WAF: Monitoring (VM data sources for private networking) ---
+@description('Data sources for VM monitoring (Windows events, perf counters).')
+param dataSources array = []
+
+@description('Optional. Managed identities for the resource.')
+param managedIdentities object = { systemAssigned: true }
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module workspace 'br/public:avm/res/operational-insights/workspace:0.15.0' = {
+  name: take('avm.res.operational-insights.workspace.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    dataRetention: retentionInDays
+    skuName: skuName
+    enableTelemetry: enableTelemetry
+    managedIdentities: managedIdentities
+    features: { enableLogAccessUsingOnlyResourcePermissions: true }
+    diagnosticSettings: [{ useThisWorkspace: true }]
+    publicNetworkAccessForIngestion: publicNetworkAccessForIngestion
+    publicNetworkAccessForQuery: publicNetworkAccessForQuery
+    dailyQuotaGb: !empty(dailyQuotaGb) ? dailyQuotaGb : null
+    replication: enableReplication ? {
+      enabled: true
+      location: replicationLocation
+    } : null
+    dataSources: !empty(dataSources) ? dataSources : null
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the Log Analytics workspace.')
+output resourceId string = workspace.outputs.resourceId
+
+@description('Name of the Log Analytics workspace.')
+output name string = workspace.outputs.name
+
+@description('Location of the workspace.')
+output location string = location
+
+@description('Log Analytics workspace customer ID.')
+output logAnalyticsWorkspaceId string = workspace.outputs.logAnalyticsWorkspaceId
diff --git a/infra/avm/modules/networking/bastion-host.bicep b/infra/avm/modules/networking/bastion-host.bicep
new file mode 100644
index 000000000..bf524087e
--- /dev/null
+++ b/infra/avm/modules/networking/bastion-host.bicep
@@ -0,0 +1,85 @@
+// ============================================================================
+// Module: Bastion Host
+// Description: AVM wrapper for Azure Bastion Host
+// AVM Module: avm/res/network/bastion-host
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+var name = 'bas-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Resource ID of the virtual network.')
+param virtualNetworkResourceId string
+
+@description('Optional. Diagnostic settings for the resource.')
+param diagnosticSettings array?
+
+@description('SKU name for the Bastion Host.')
+param skuName string = 'Standard'
+
+@description('Number of scale units.')
+param scaleUnits int = 4
+
+@description('Disable copy/paste functionality.')
+param disableCopyPaste bool = true
+
+@description('Enable file copy functionality.')
+param enableFileCopy bool = false
+
+@description('Enable IP Connect functionality.')
+param enableIpConnect bool = false
+
+@description('Enable shareable link functionality.')
+param enableShareableLink bool = false
+
+@description('Availability zones for the Bastion Host public IP. Pass empty array to disable zone redundancy.')
+param availabilityZones array = []
+
+@description('Optional. Diagnostic settings for the public IP address.')
+param publicIPDiagnosticSettings array?
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module bastionHost 'br/public:avm/res/network/bastion-host:0.8.2' = {
+  name: take('avm.res.network.bastion-host.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    enableTelemetry: enableTelemetry
+    skuName: skuName
+    virtualNetworkResourceId: virtualNetworkResourceId
+    availabilityZones: availabilityZones
+    publicIPAddressObject: {
+      name: 'pip-${name}'
+      diagnosticSettings: publicIPDiagnosticSettings
+      tags: tags
+    }
+    disableCopyPaste: disableCopyPaste
+    enableFileCopy: enableFileCopy
+    enableIpConnect: enableIpConnect
+    enableShareableLink: enableShareableLink
+    scaleUnits: scaleUnits
+    diagnosticSettings: diagnosticSettings
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the Bastion Host.')
+output resourceId string = bastionHost.outputs.resourceId
+
+@description('Name of the Bastion Host.')
+output name string = bastionHost.outputs.name
diff --git a/infra/avm/modules/networking/private-dns-zone.bicep b/infra/avm/modules/networking/private-dns-zone.bicep
new file mode 100644
index 000000000..be1f69733
--- /dev/null
+++ b/infra/avm/modules/networking/private-dns-zone.bicep
@@ -0,0 +1,44 @@
+// ============================================================================
+// Module: Private DNS Zone
+// Description: AVM wrapper for Azure Private DNS Zone
+// AVM Module: avm/res/network/private-dns-zone
+// Usage: Call once per DNS zone from main.bicep
+// ============================================================================
+
+@description('Name of the private DNS zone (e.g., privatelink.cognitiveservices.azure.com).')
+param name string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Virtual network links to associate with the DNS zone.')
+param virtualNetworkLinks array = []
+
+@description('Optional. Array of A records.')
+param a array = []
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module privateDnsZone 'br/public:avm/res/network/private-dns-zone:0.8.1' = {
+  name: take('avm.res.network.private-dns-zone.${split(name, '.')[1]}', 64)
+  params: {
+    name: name
+    tags: tags
+    enableTelemetry: enableTelemetry
+    virtualNetworkLinks: virtualNetworkLinks
+    a: a
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the private DNS zone.')
+output resourceId string = privateDnsZone.outputs.resourceId
+
+@description('Name of the private DNS zone.')
+output name string = privateDnsZone.outputs.name
diff --git a/infra/avm/modules/networking/private-endpoint.bicep b/infra/avm/modules/networking/private-endpoint.bicep
new file mode 100644
index 000000000..04bfff07c
--- /dev/null
+++ b/infra/avm/modules/networking/private-endpoint.bicep
@@ -0,0 +1,52 @@
+// ============================================================================
+// Module: Private Endpoint
+// Description: AVM wrapper for Azure Private Endpoint
+// AVM Module: avm/res/network/private-endpoint
+// Usage: Call once per private endpoint from main.bicep
+// ============================================================================
+
+@description('Name of the private endpoint.')
+param name string
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Optional. Custom NIC name for the private endpoint.')
+param customNetworkInterfaceName string = ''
+
+@description('Resource ID of the subnet for the private endpoint.')
+param subnetResourceId string
+
+@description('Private link service connections configuration.')
+param privateLinkServiceConnections array
+
+@description('Optional. Private DNS zone group configuration.')
+param privateDnsZoneGroup object?
+
+// ============================================================================
+// AVM Module Deployment
+// ============================================================================
+module privateEndpoint 'br/public:avm/res/network/private-endpoint:0.12.0' = {
+  name: take('avm.res.network.private-endpoint.${name}', 64)
+  params: {
+    name: name
+    location: location
+    tags: tags
+    customNetworkInterfaceName: !empty(customNetworkInterfaceName) ? customNetworkInterfaceName : 'nic-${name}'
+    subnetResourceId: subnetResourceId
+    privateLinkServiceConnections: privateLinkServiceConnections
+    privateDnsZoneGroup: privateDnsZoneGroup
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the private endpoint.')
+output resourceId string = privateEndpoint.outputs.resourceId
+
+@description('Name of the private endpoint.')
+output name string = privateEndpoint.outputs.name
diff --git a/infra/avm/modules/networking/virtual-network.bicep b/infra/avm/modules/networking/virtual-network.bicep
new file mode 100644
index 000000000..ca6f68946
--- /dev/null
+++ b/infra/avm/modules/networking/virtual-network.bicep
@@ -0,0 +1,331 @@
+// ============================================================================
+// Module: Virtual Network
+// Description: VNet, Subnets, and NSGs using AVM modules.
+//              Each subnet gets its own NSG. Subnet config is passed as param.
+// AVM Modules:
+//   - avm/res/network/network-security-group:0.5.3
+//   - avm/res/network/virtual-network:0.8.0
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+var name = 'vnet-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string = resourceGroup().location
+
+@description('Address prefixes for the virtual network.')
+param addressPrefixes array
+
+@description('Subnet configurations.')
+param subnets subnetType[] = [
+  {
+    name: 'backend'
+    addressPrefixes: ['10.0.0.0/27']
+    networkSecurityGroup: {
+      name: 'nsg-backend'
+      securityRules: [
+        {
+          name: 'deny-hop-outbound'
+          properties: {
+            access: 'Deny'
+            destinationAddressPrefix: '*'
+            destinationPortRanges: ['22', '3389']
+            direction: 'Outbound'
+            priority: 200
+            protocol: 'Tcp'
+            sourceAddressPrefix: 'VirtualNetwork'
+            sourcePortRange: '*'
+          }
+        }
+      ]
+    }
+  }
+  {
+    name: 'containers'
+    addressPrefixes: ['10.0.2.0/23']
+    delegation: 'Microsoft.App/environments'
+    privateEndpointNetworkPolicies: 'Enabled'
+    privateLinkServiceNetworkPolicies: 'Enabled'
+    networkSecurityGroup: {
+      name: 'nsg-containers'
+      securityRules: [
+        {
+          name: 'deny-hop-outbound'
+          properties: {
+            access: 'Deny'
+            destinationAddressPrefix: '*'
+            destinationPortRanges: ['22', '3389']
+            direction: 'Outbound'
+            priority: 200
+            protocol: 'Tcp'
+            sourceAddressPrefix: 'VirtualNetwork'
+            sourcePortRange: '*'
+          }
+        }
+      ]
+    }
+  }
+  {
+    name: 'webserverfarm'
+    addressPrefixes: ['10.0.4.0/27']
+    delegation: 'Microsoft.Web/serverfarms'
+    privateEndpointNetworkPolicies: 'Enabled'
+    privateLinkServiceNetworkPolicies: 'Enabled'
+    networkSecurityGroup: {
+      name: 'nsg-webserverfarm'
+      securityRules: [
+        {
+          name: 'deny-hop-outbound'
+          properties: {
+            access: 'Deny'
+            destinationAddressPrefix: '*'
+            destinationPortRanges: ['22', '3389']
+            direction: 'Outbound'
+            priority: 200
+            protocol: 'Tcp'
+            sourceAddressPrefix: 'VirtualNetwork'
+            sourcePortRange: '*'
+          }
+        }
+      ]
+    }
+  }
+  {
+    name: 'administration'
+    addressPrefixes: ['10.0.0.32/27']
+    networkSecurityGroup: {
+      name: 'nsg-administration'
+      securityRules: [
+        {
+          name: 'deny-hop-outbound'
+          properties: {
+            access: 'Deny'
+            destinationAddressPrefix: '*'
+            destinationPortRanges: ['22', '3389']
+            direction: 'Outbound'
+            priority: 200
+            protocol: 'Tcp'
+            sourceAddressPrefix: 'VirtualNetwork'
+            sourcePortRange: '*'
+          }
+        }
+      ]
+    }
+  }
+  {
+    name: 'AzureBastionSubnet'
+    addressPrefixes: ['10.0.0.64/26']
+    networkSecurityGroup: {
+      name: 'nsg-bastion'
+      securityRules: [
+        {
+          name: 'AllowGatewayManager'
+          properties: {
+            access: 'Allow'
+            direction: 'Inbound'
+            priority: 2702
+            protocol: '*'
+            sourcePortRange: '*'
+            destinationPortRange: '443'
+            sourceAddressPrefix: 'GatewayManager'
+            destinationAddressPrefix: '*'
+          }
+        }
+        {
+          name: 'AllowHttpsInBound'
+          properties: {
+            access: 'Allow'
+            direction: 'Inbound'
+            priority: 2703
+            protocol: '*'
+            sourcePortRange: '*'
+            destinationPortRange: '443'
+            sourceAddressPrefix: 'Internet'
+            destinationAddressPrefix: '*'
+          }
+        }
+        {
+          name: 'AllowSshRdpOutbound'
+          properties: {
+            access: 'Allow'
+            direction: 'Outbound'
+            priority: 100
+            protocol: '*'
+            sourcePortRange: '*'
+            destinationPortRanges: ['22', '3389']
+            sourceAddressPrefix: '*'
+            destinationAddressPrefix: 'VirtualNetwork'
+          }
+        }
+        {
+          name: 'AllowAzureCloudOutbound'
+          properties: {
+            access: 'Allow'
+            direction: 'Outbound'
+            priority: 110
+            protocol: 'Tcp'
+            sourcePortRange: '*'
+            destinationPortRange: '443'
+            sourceAddressPrefix: '*'
+            destinationAddressPrefix: 'AzureCloud'
+          }
+        }
+      ]
+    }
+  }
+]
+
+@description('Tags to apply to the resources.')
+param tags object = {}
+
+@description('Resource ID of the Log Analytics Workspace for diagnostics.')
+param logAnalyticsWorkspaceId string
+
+@description('Optional. Enable/Disable usage telemetry for module.')
+param enableTelemetry bool = true
+
+@description('Suffix for resource naming.')
+param resourceSuffix string
+
+// ============================================================================
+// NSGs — one per subnet
+// ============================================================================
+@batchSize(1)
+module nsgs 'br/public:avm/res/network/network-security-group:0.5.3' = [
+  for (subnet, i) in subnets: if (!empty(subnet.?networkSecurityGroup)) {
+    name: take('avm.res.network.nsg.${subnet.?networkSecurityGroup.name}.${resourceSuffix}', 64)
+    params: {
+      name: '${subnet.?networkSecurityGroup.name}-${resourceSuffix}'
+      location: location
+      securityRules: subnet.?networkSecurityGroup.securityRules
+      tags: tags
+      enableTelemetry: enableTelemetry
+    }
+  }
+]
+
+// ============================================================================
+// Virtual Network + Subnets
+// ============================================================================
+module virtualNetwork 'br/public:avm/res/network/virtual-network:0.8.0' = {
+  name: take('avm.res.network.virtual-network.${name}', 64)
+  params: {
+    name: name
+    location: location
+    addressPrefixes: addressPrefixes
+    subnets: [
+      for (subnet, i) in subnets: {
+        name: subnet.name
+        addressPrefixes: subnet.?addressPrefixes
+        networkSecurityGroupResourceId: !empty(subnet.?networkSecurityGroup) ? nsgs[i]!.outputs.resourceId : null
+        privateEndpointNetworkPolicies: subnet.?privateEndpointNetworkPolicies
+        privateLinkServiceNetworkPolicies: subnet.?privateLinkServiceNetworkPolicies
+        delegation: subnet.?delegation
+      }
+    ]
+    diagnosticSettings: [
+      {
+        name: 'vnetDiagnostics'
+        workspaceResourceId: logAnalyticsWorkspaceId
+        logCategoriesAndGroups: [
+          {
+            categoryGroup: 'allLogs'
+            enabled: true
+          }
+        ]
+        metricCategories: [
+          {
+            category: 'AllMetrics'
+            enabled: true
+          }
+        ]
+      }
+    ]
+    tags: tags
+    enableTelemetry: enableTelemetry
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+output name string = virtualNetwork.outputs.name
+output resourceId string = virtualNetwork.outputs.resourceId
+
+output subnets subnetOutputType[] = [
+  for (subnet, i) in subnets: {
+    name: subnet.name
+    resourceId: virtualNetwork.outputs.subnetResourceIds[i]
+    nsgName: !empty(subnet.?networkSecurityGroup) ? subnet.?networkSecurityGroup.name : null
+    nsgResourceId: !empty(subnet.?networkSecurityGroup) ? nsgs[i]!.outputs.resourceId : null
+  }
+]
+
+// Individual subnet outputs for backward compatibility
+output backendSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'backend')
+  ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'backend')]
+  : ''
+output containerSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'containers')
+  ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'containers')]
+  : ''
+output webserverfarmSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'webserverfarm')
+  ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'webserverfarm')]
+  : ''
+output administrationSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'administration')
+  ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'administration')]
+  : ''
+output bastionSubnetResourceId string = contains(map(subnets, subnet => subnet.name), 'AzureBastionSubnet')
+  ? virtualNetwork.outputs.subnetResourceIds[indexOf(map(subnets, subnet => subnet.name), 'AzureBastionSubnet')]
+  : ''
+
+// ============================================================================
+// Custom Types
+// ============================================================================
+@export()
+@description('Subnet output type')
+type subnetOutputType = {
+  @description('The name of the subnet.')
+  name: string
+  @description('The resource ID of the subnet.')
+  resourceId: string
+  @description('The name of the associated NSG, if any.')
+  nsgName: string?
+  @description('The resource ID of the associated NSG, if any.')
+  nsgResourceId: string?
+}
+
+@export()
+@description('Subnet configuration type')
+type subnetType = {
+  @description('Required. The name of the subnet.')
+  name: string
+  @description('Required. Address prefixes for the subnet.')
+  addressPrefixes: string[]
+  @description('Optional. Delegation for the subnet.')
+  delegation: string?
+  @description('Optional. Private endpoint network policies.')
+  privateEndpointNetworkPolicies: ('Disabled' | 'Enabled' | 'NetworkSecurityGroupEnabled' | 'RouteTableEnabled')?
+  @description('Optional. Private link service network policies.')
+  privateLinkServiceNetworkPolicies: ('Disabled' | 'Enabled')?
+  @description('Optional. NSG configuration for the subnet.')
+  networkSecurityGroup: networkSecurityGroupType?
+  @description('Optional. Route table resource ID.')
+  routeTableResourceId: string?
+  @description('Optional. Service endpoint policies.')
+  serviceEndpointPolicies: object[]?
+  @description('Optional. Service endpoints to enable.')
+  serviceEndpoints: string[]?
+  @description('Optional. Disable default outbound connectivity.')
+  defaultOutboundAccess: bool?
+}
+
+@export()
+@description('NSG configuration type')
+type networkSecurityGroupType = {
+  @description('Required. The name of the NSG.')
+  name: string
+  @description('Required. Security rules for the NSG.')
+  securityRules: object[]
+}
diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep
new file mode 100644
index 000000000..7ebabd16b
--- /dev/null
+++ b/infra/bicep/main.bicep
@@ -0,0 +1,538 @@
+// ========== main.bicep ========== //
+
+// ============================================================================
+// main.bicep — Orchestrator
+// Description: Pure orchestrator for Conversation Knowledge Mining solution. Calls modules to deploy resources.
+//              All resource names are derived from params — no hardcoded names.
+//              This file only calls modules; no inline resource definitions.
+// ============================================================================
+
+targetScope = 'resourceGroup'
+
+// ============================================================================
+// Parameters — Core
+// ============================================================================
+
+@minLength(3)
+@maxLength(16)
+@description('Optional. A unique application/solution name used as base for all resource naming.')
+param solutionName string = 'kmgen'
+
+@maxLength(5)
+@description('Optional. A unique text suffix appended to resource names for uniqueness.')
+param solutionUniqueText string = substring(uniqueString(subscription().id, resourceGroup().name, solutionName), 0, 5)
+
+@metadata({ azd: { type: 'location' } })
+@description('Optional. Primary Azure region for resource deployment.')
+param location string = resourceGroup().location
+
+@allowed(['australiaeast', 'swedencentral', 'southeastasia'])
+@metadata({
+  azd:{
+    type: 'location'
+    usageName: [
+      'OpenAI.GlobalStandard.gpt-5.2,150'
+      'OpenAI.GlobalStandard.text-embedding-3-small,80'
+    ]
+  }
+})
+@description('Required. Location for AI Foundry and model deployments.')
+param azureAiServiceLocation string
+
+@description('Optional. Tags to apply to all resources.')
+param tags object = {}
+
+@description('Optional. Set to true to also deploy Cosmos DB (not required — SQL is the primary database).')
+param deployCosmos bool = false
+
+// ============================================================================
+// Parameters — AI Configuration
+// ============================================================================
+
+@allowed(['Standard', 'GlobalStandard'])
+@description('Optional. GPT model deployment type.')
+param deploymentType string = 'GlobalStandard'
+
+@description('Optional. Name of the GPT model to deploy.')
+param gptModelName string = 'gpt-5.2'
+
+@description('Optional. Version of the GPT model to deploy.')
+param gptModelVersion string = '2025-12-11'
+
+@minValue(10)
+@description('Optional. Capacity of the GPT deployment (TPM in thousands).')
+param gptDeploymentCapacity int = 150
+
+@allowed(['text-embedding-3-small'])
+@description('Optional. Name of the Text Embedding model to deploy.')
+param embeddingModel string = 'text-embedding-3-small'
+
+@minValue(10)
+@description('Optional. Capacity of the Embedding Model deployment.')
+param embeddingDeploymentCapacity int = 80
+
+// ============================================================================
+// Parameters — Compute
+// ============================================================================
+
+@description('Optional. Name of the Azure Container Registry. Leave empty to auto-generate a globally unique name (cr<suffix>).')
+param containerRegistryName string = ''
+
+@description('Optional. Backend container image name.')
+param backendContainerImageName string = 'km-api'
+
+@description('Optional. Backend container image tag.')
+param backendContainerImageTag string = 'latest'
+
+@description('Optional. Frontend container image name.')
+param frontendContainerImageName string = 'km-app'
+
+@description('Optional. Frontend container image tag.')
+param frontendContainerImageTag string = 'latest'
+
+@allowed(['F1', 'D1', 'B1', 'B2', 'B3', 'S1', 'S2', 'S3', 'P1', 'P2', 'P3', 'P1v3', 'P1v4'])
+@description('Optional. App Service Plan SKU (used by AVM flavors).')
+param appServicePlanSku string = 'B3'
+
+@description('Kind of web app.')
+param kind string = 'app,linux,container'
+
+// ============================================================================
+// Parameters — Authentication (matches infra_old/main.bicep)
+// ============================================================================
+
+@description('Optional. Azure AD tenant ID for authentication.')
+param azureAdTenantId string = ''
+
+@description('Optional. Azure AD client ID for authentication.')
+param azureAdClientId string = ''
+
+@description('Optional. Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable.')
+@secure()
+param adminApiKey string = ''
+
+// ============================================================================
+// Parameters — Existing Resources
+// ============================================================================
+
+@description('Optional. Resource ID of an existing Log Analytics workspace. Empty creates a new one.')
+param existingLogAnalyticsWorkspaceId string = ''
+
+@description('Optional. Resource ID of an existing AI Foundry project. Empty creates a new one.')
+param existingFoundryProjectResourceId string = ''
+
+// ============================================================================
+// Parameters — Identity
+// ============================================================================
+
+@allowed(['User', 'ServicePrincipal'])
+@description('Optional. Principal type of the deploying user. Use ServicePrincipal for CI/CD pipelines with OIDC.')
+param deployingUserPrincipalType string = 'User'
+
+@description('Optional. Created by user name for resource tagging.')
+param createdBy string = contains(deployer(), 'userPrincipalName') ? split(deployer().userPrincipalName, '@')[0] : deployer().objectId
+
+// ============================================================================
+// Variables
+// ============================================================================
+
+var solutionSuffix = toLower(trim(replace(
+  replace(
+    replace(replace(replace(replace('${solutionName}${solutionUniqueText}', '-', ''), '_', ''), '.', ''), '/', ''),
+    ' ',
+    ''
+  ),
+  '*',
+  ''
+)))
+
+// ACR names are globally unique — default to a suffixed name so multiple deployments don't collide.
+var containerRegistryResourceName = !empty(containerRegistryName) ? containerRegistryName : 'acrkm${solutionSuffix}'
+
+var deployerInfo = deployer()
+var deployingUserPrincipalId = deployerInfo.objectId
+var deployingUserPrincipalName = deployerInfo.?userPrincipalName ?? deployerInfo.objectId
+var existingTags = resourceGroup().tags ?? {}
+
+
+// Tags: merge existing RG tags with standard metadata
+var resourceTags = union(existingTags, tags, {
+  TemplateName: 'KM-Generic'
+  CreatedBy: createdBy
+  DeploymentName: deployment().name
+  Type: 'Non-WAF'
+})
+
+// ============================================================================
+// Resource Group Tags
+// ============================================================================
+resource resourceGroupTags 'Microsoft.Resources/tags@2024-11-01' = {
+  name: 'default'
+  properties: {
+    tags: resourceTags
+  }
+}
+
+// ========== Monitoring (Log Analytics + Application Insights) ========== //
+var useExistingLogAnalytics = !empty(existingLogAnalyticsWorkspaceId)
+
+// ========== Log Analytics module ========== //
+module log_analytics './modules/monitoring/log-analytics.bicep' = if (!useExistingLogAnalytics) {
+  name: take('module.log-analytics.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+var logAnalyticsWorkspaceResourceId = useExistingLogAnalytics
+  ? existingLogAnalyticsWorkspaceId
+  : log_analytics!.outputs.resourceId
+
+// ========== Application Insights module ========== //
+module app_insights './modules/monitoring/app-insights.bicep' = {
+  name: take('module.app-insights.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    workspaceResourceId: logAnalyticsWorkspaceResourceId
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+// ==========AI Foundry and related resources ========== //
+var aiModelDeployments = [
+  {
+    name: gptModelName
+    model: gptModelName
+    sku: {
+      name: deploymentType
+      capacity: gptDeploymentCapacity
+    }
+    version: gptModelVersion
+    raiPolicyName: 'Microsoft.Default'
+  }
+  {
+    name: embeddingModel
+    model: embeddingModel
+    sku: {
+      name: 'GlobalStandard'
+      capacity: embeddingDeploymentCapacity
+    }
+    version: '1'
+    raiPolicyName: 'Microsoft.Default'
+  }
+]
+
+// Deploy new AI Services account + AI Foundry project (no connections, no deployments)
+module ai_foundry_project './modules/ai/ai-foundry-project.bicep' = if (empty(existingFoundryProjectResourceId)) {
+  name: take('module.ai-foundry-project.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: azureAiServiceLocation
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+// ========== Unified AI Foundry resource name vars ========== //
+var useExistingAIProject = !empty(existingFoundryProjectResourceId)
+var aiFoundryResourceName = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[8] : ai_foundry_project!.outputs.name
+var aiProjectResourceName = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[10] : ai_foundry_project!.outputs.projectName
+var aiFoundrySubscriptionId = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[2] : subscription().subscriptionId
+var aiFoundryResourceGroupName = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[4] : resourceGroup().name
+
+// Reference existing AI Foundry project (reads runtime properties: endpoints, identities)
+module existing_project_setup './modules/ai/existing-project-setup.bicep' = if (useExistingAIProject) {
+  name: take('module.existing-project-setup.${solutionName}', 64)
+  scope: resourceGroup(aiFoundrySubscriptionId, aiFoundryResourceGroupName)
+  params: {
+    name: aiFoundryResourceName
+    projectName: aiProjectResourceName
+  }
+}
+
+// AI Search connection (single call for both existing and new paths)
+module foundry_search_connection './modules/ai/ai-foundry-connection.bicep' = {
+  name: take('module.foundry-search-conn.${solutionName}', 64)
+  scope: resourceGroup(aiFoundrySubscriptionId, aiFoundryResourceGroupName)
+  params: {
+    solutionName: solutionSuffix
+    aiServicesAccountName: aiFoundryResourceName
+    projectName: aiProjectResourceName
+    category: 'CognitiveSearch'
+    target: ai_search!.outputs.endpoint
+    authType: 'AAD'
+    metadata: {
+      ApiType: 'Azure'
+      ResourceId: ai_search!.outputs.resourceId
+    }
+  }
+}
+
+// Model deployments (single loop for both existing and new paths)
+@batchSize(1)
+module model_deployments './modules/ai/ai-foundry-model-deployment.bicep' = [for (deployment, i) in aiModelDeployments: {
+  name: take('module.model-deployment-${i}.${solutionName}', 64)
+  scope: resourceGroup(aiFoundrySubscriptionId, aiFoundryResourceGroupName)
+  params: {
+    aiServicesAccountName: aiFoundryResourceName
+    deploymentName: deployment.name
+    modelName: deployment.model
+    modelVersion: deployment.version
+    raiPolicyName: deployment.raiPolicyName
+    skuName: deployment.sku.name
+    skuCapacity: deployment.sku.capacity
+  }
+}]
+
+// ========== AI Search module ========== //
+module ai_search './modules/ai/ai-search.bicep' = {
+  name: take('module.ai-search.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    skuName: 'standard'
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+// ========== AI outputs (ternary: existing vs new) ========== //
+var aiFoundryEndpoint = useExistingAIProject ? existing_project_setup!.outputs.endpoint : ai_foundry_project!.outputs.endpoint
+var azureOpenAiCuEndpoint = useExistingAIProject ? existing_project_setup!.outputs.azureOpenAiCuEndpoint : ai_foundry_project!.outputs.azureOpenAiCuEndpoint
+var projectEndpoint = useExistingAIProject ? existing_project_setup!.outputs.projectEndpoint : ai_foundry_project!.outputs.projectEndpoint
+var aiFoundryResourceId = useExistingAIProject ? existing_project_setup!.outputs.resourceId : ai_foundry_project!.outputs.resourceId
+var aiProjectPrincipalId = useExistingAIProject ? existing_project_setup!.outputs.projectIdentityPrincipalId : ai_foundry_project!.outputs.projectIdentityPrincipalId
+
+// ========== Storage Account module ========== //
+module storage_account './modules/data/storage-account.bicep' = {
+  name: take('module.storage-account.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    tags: {}
+    containers: [
+      { name: 'data', publicAccess: 'None' }
+    ]
+    enableHierarchicalNamespace: true
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+// ========== Cosmos DB module (optional — not required, SQL is the primary database) ========== //
+module cosmosDBModule './modules/data/cosmos-db-nosql.bicep' = if (deployCosmos) {
+  name: take('module.cosmos-db-nosql.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    name: 'cosmos-${solutionSuffix}'
+    location: location
+    databaseName: 'km-db'
+    containers: [
+      { name: 'chat_sessions', partitionKeyPath: '/user_id' }
+      { name: 'chat_messages', partitionKeyPath: '/session_id' }
+      { name: 'document_insights', partitionKeyPath: '/dataset_id' }
+      { name: 'enrichment_cache', partitionKeyPath: '/doc_hash' }
+    ]
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+// ========== SQL Database module ========== //
+module sqlDBModule './modules/data/sql-database.bicep' = {
+  name: take('module.sql-db.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    name: 'sql-${solutionSuffix}'
+    databaseName: 'sqldb-${solutionSuffix}'
+    location: location
+    tags: resourceTags
+    deployerPrincipalId: deployingUserPrincipalId
+    deployerPrincipalName: deployingUserPrincipalName
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+// ========== App Service Plan module ========== //
+module hostingplan './modules/compute/app-service-plan.bicep' = {
+  name: take('module.app-service-plan.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    location: location
+    skuName: appServicePlanSku
+  }
+}
+
+// ========== Container Registry module (dedicated ACR for application images) ========== //
+module container_registry './modules/compute/container-registry.bicep' = {
+  name: take('module.container-registry.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    name: containerRegistryResourceName
+    location: location
+    tags: resourceTags
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+// ========== Compute image names ========== //
+var placeholderImageName = 'DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
+
+// ========== Backend Deployment ========== //
+module backend_docker './modules/compute/app-service.bicep' = {
+  name: take('module.app-service-backend.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    name: 'api-${solutionSuffix}'
+    location: location
+    tags: union(tags, { 'azd-service-name': 'api' })
+    serverFarmResourceId: hostingplan!.outputs.resourceId
+    kind: kind
+    linuxFxVersion: placeholderImageName
+    acrUseManagedIdentityCreds: true
+    appSettings: {
+      DOCKER_REGISTRY_SERVER_URL: 'https://${container_registry.outputs.loginServer}'
+      WEBSITES_PORT: '8000'
+      AZURE_OPENAI_ENDPOINT: aiFoundryEndpoint
+      AZURE_OPENAI_CHAT_DEPLOYMENT: gptModelName
+      AZURE_OPENAI_EMBEDDING_DEPLOYMENT: embeddingModel
+      AZURE_SEARCH_ENDPOINT: ai_search.outputs.endpoint
+      AZURE_SEARCH_INDEX_NAME: 'knowledge-mining-index'
+      AZURE_CONTENT_UNDERSTANDING_ENDPOINT: azureOpenAiCuEndpoint
+      AZURE_STORAGE_ACCOUNT: storage_account.outputs.name
+      AZURE_SQL_SERVER: sqlDBModule!.outputs.serverFqdn
+      AZURE_SQL_DATABASE: sqlDBModule!.outputs.databaseName
+      AZURE_COSMOS_ENDPOINT: deployCosmos ? cosmosDBModule!.outputs.endpoint : ''
+      AZURE_COSMOS_DATABASE: deployCosmos ? 'km-db' : ''
+      AZURE_AD_TENANT_ID: azureAdTenantId
+      AZURE_AD_CLIENT_ID: azureAdClientId
+      AZURE_AI_AGENT_ENDPOINT: projectEndpoint
+      AZURE_AI_SEARCH_CONNECTION_NAME: foundry_search_connection.outputs.connectionName
+      API_APP_NAME: 'api-${solutionSuffix}'
+      APP_FRONTEND_HOSTNAME: 'https://app-${solutionSuffix}.azurewebsites.net'
+      APP_ENV: 'Prod'
+      ADMIN_API_KEY: adminApiKey
+      SOLUTION_SUFFIX: solutionSuffix
+    }
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+// ========== Frontend Deployment ========== //
+module frontend_docker './modules/compute/app-service.bicep' = {
+  name: take('module.app-service-frontend.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    name: 'app-${solutionSuffix}'
+    location: location
+    tags: union(tags, { 'azd-service-name': 'webapp' })
+    serverFarmResourceId: hostingplan!.outputs.resourceId
+    kind: kind
+    linuxFxVersion: placeholderImageName
+    acrUseManagedIdentityCreds: true
+    appSettings: {
+      DOCKER_REGISTRY_SERVER_URL: 'https://${container_registry.outputs.loginServer}'
+      APP_API_BASE_URL: backend_docker!.outputs.appUrl
+      WEBSITES_PORT: '80'
+    }
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+// ========== Role Assignments (centralized)  ========== //
+module role_assignments './modules/identity/role-assignments.bicep' = {
+  name: take('module.role-assignments.${solutionName}', 64)
+  params: {
+    solutionName: solutionSuffix
+    useExistingAIProject: useExistingAIProject
+    existingFoundryProjectResourceId: existingFoundryProjectResourceId
+    aiFoundryResourceId: !useExistingAIProject ? aiFoundryResourceId : ''
+    aiSearchResourceId: ai_search.outputs.resourceId
+    storageAccountResourceId: storage_account.outputs.resourceId
+    aiProjectPrincipalId: aiProjectPrincipalId
+    aiSearchPrincipalId: ai_search.outputs.identityPrincipalId
+    deployerPrincipalId: deployingUserPrincipalId
+    deployerPrincipalType: deployingUserPrincipalType
+    backendAppServicePrincipalId: backend_docker!.outputs.identityPrincipalId
+    cosmosDbAccountName: deployCosmos ? cosmosDBModule!.outputs.name : ''
+    containerRegistryResourceId: container_registry.outputs.resourceId
+    acrPullPrincipals: [
+      { principalId: backend_docker!.outputs.identityPrincipalId, principalType: 'ServicePrincipal' }
+      { principalId: frontend_docker!.outputs.identityPrincipalId, principalType: 'ServicePrincipal' }
+    ]
+  }
+  scope: resourceGroup(resourceGroup().name)
+}
+
+ // ========== Outputs (matches infra_old/main.bicep output list) ========== //
+
+@description('Azure OpenAI endpoint URL.')
+output AZURE_OPENAI_ENDPOINT string = aiFoundryEndpoint
+
+@description('Azure AI Search endpoint URL.')
+output AZURE_SEARCH_ENDPOINT string = ai_search.outputs.endpoint
+
+@description('Azure Content Understanding endpoint URL.')
+output AZURE_CONTENT_UNDERSTANDING_ENDPOINT string = azureOpenAiCuEndpoint
+
+@description('Azure Storage account name.')
+output AZURE_STORAGE_ACCOUNT string = storage_account.outputs.name
+
+@description('Azure SQL Server FQDN.')
+output AZURE_SQL_SERVER string = sqlDBModule!.outputs.serverFqdn
+
+@description('Azure SQL Database name.')
+output AZURE_SQL_DATABASE string = sqlDBModule!.outputs.databaseName
+
+@description('Backend API application (and SQL contained user) name.')
+output API_APP_NAME string = backend_docker!.outputs.name
+
+@description('Backend API system-assigned managed identity principal ID.')
+output AZURE_API_PRINCIPAL_ID string = backend_docker!.outputs.identityPrincipalId
+
+@description('Azure Cosmos DB endpoint.')
+output AZURE_COSMOS_ENDPOINT string = deployCosmos ? cosmosDBModule!.outputs.endpoint : ''
+
+@description('Azure AI Agent endpoint URL.')
+output AZURE_AI_AGENT_ENDPOINT string = projectEndpoint
+
+@description('Backend API application URL.')
+output API_APP_URL string = backend_docker!.outputs.appUrl
+
+@description('Frontend web application URL.')
+output WEB_APP_URL string = frontend_docker!.outputs.appUrl
+
+@description('Backend service URI (used by azd).')
+output SERVICE_BACKEND_URI string = backend_docker!.outputs.appUrl
+
+@description('Frontend service URI (used by azd).')
+output SERVICE_FRONTEND_URI string = frontend_docker!.outputs.appUrl
+
+@description('AI Search connection name in AI Foundry.')
+output AZURE_AI_SEARCH_CONNECTION_NAME string = foundry_search_connection.outputs.connectionName
+
+@description('Azure Container Registry name.')
+output ACR_NAME string = container_registry.outputs.name
+
+@description('Azure Container Registry login server URL.')
+output ACR_LOGIN_SERVER string = container_registry.outputs.loginServer
+
+@description('Backend container image repository name to build and push to ACR.')
+output BACKEND_CONTAINER_IMAGE_NAME string = backendContainerImageName
+
+@description('Backend container image tag to build and push to ACR.')
+output BACKEND_CONTAINER_IMAGE_TAG string = backendContainerImageTag
+
+@description('Frontend container image repository name to build and push to ACR.')
+output FRONTEND_CONTAINER_IMAGE_NAME string = frontendContainerImageName
+
+@description('Frontend container image tag to build and push to ACR.')
+output FRONTEND_CONTAINER_IMAGE_TAG string = frontendContainerImageTag
+
+@description('Frontend web application (App Service) name.')
+output FRONTEND_APP_NAME string = frontend_docker!.outputs.name
+
+@description('Resource group name.')
+output RESOURCE_GROUP_NAME string = resourceGroup().name
+
+@description('Solution resource token suffix used in resource names.')
+output SOLUTION_SUFFIX string = solutionSuffix
diff --git a/infra/bicep/main.json b/infra/bicep/main.json
new file mode 100644
index 000000000..43f2b76f1
--- /dev/null
+++ b/infra/bicep/main.json
@@ -0,0 +1,4414 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.46.1.21595",
+      "templateHash": "7213137512787294477"
+    }
+  },
+  "parameters": {
+    "solutionName": {
+      "type": "string",
+      "defaultValue": "kmgen",
+      "minLength": 3,
+      "maxLength": 16,
+      "metadata": {
+        "description": "Optional. A unique application/solution name used as base for all resource naming."
+      }
+    },
+    "solutionUniqueText": {
+      "type": "string",
+      "defaultValue": "[substring(uniqueString(subscription().id, resourceGroup().name, parameters('solutionName')), 0, 5)]",
+      "maxLength": 5,
+      "metadata": {
+        "description": "Optional. A unique text suffix appended to resource names for uniqueness."
+      }
+    },
+    "location": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "metadata": {
+        "azd": {
+          "type": "location"
+        },
+        "description": "Optional. Primary Azure region for resource deployment."
+      }
+    },
+    "azureAiServiceLocation": {
+      "type": "string",
+      "allowedValues": [
+        "australiaeast",
+        "swedencentral",
+        "southeastasia"
+      ],
+      "metadata": {
+        "azd": {
+          "type": "location",
+          "usageName": [
+            "OpenAI.GlobalStandard.gpt-5.2,150",
+            "OpenAI.GlobalStandard.text-embedding-3-small,80"
+          ]
+        },
+        "description": "Required. Location for AI Foundry and model deployments."
+      }
+    },
+    "tags": {
+      "type": "object",
+      "defaultValue": {},
+      "metadata": {
+        "description": "Optional. Tags to apply to all resources."
+      }
+    },
+    "deployCosmos": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Set to true to also deploy Cosmos DB (not required — SQL is the primary database)."
+      }
+    },
+    "deploymentType": {
+      "type": "string",
+      "defaultValue": "GlobalStandard",
+      "allowedValues": [
+        "Standard",
+        "GlobalStandard"
+      ],
+      "metadata": {
+        "description": "Optional. GPT model deployment type."
+      }
+    },
+    "gptModelName": {
+      "type": "string",
+      "defaultValue": "gpt-5.2",
+      "metadata": {
+        "description": "Optional. Name of the GPT model to deploy."
+      }
+    },
+    "gptModelVersion": {
+      "type": "string",
+      "defaultValue": "2025-12-11",
+      "metadata": {
+        "description": "Optional. Version of the GPT model to deploy."
+      }
+    },
+    "gptDeploymentCapacity": {
+      "type": "int",
+      "defaultValue": 150,
+      "minValue": 10,
+      "metadata": {
+        "description": "Optional. Capacity of the GPT deployment (TPM in thousands)."
+      }
+    },
+    "embeddingModel": {
+      "type": "string",
+      "defaultValue": "text-embedding-3-small",
+      "allowedValues": [
+        "text-embedding-3-small"
+      ],
+      "metadata": {
+        "description": "Optional. Name of the Text Embedding model to deploy."
+      }
+    },
+    "embeddingDeploymentCapacity": {
+      "type": "int",
+      "defaultValue": 80,
+      "minValue": 10,
+      "metadata": {
+        "description": "Optional. Capacity of the Embedding Model deployment."
+      }
+    },
+    "containerRegistryName": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Name of the Azure Container Registry. Leave empty to auto-generate a globally unique name (cr<suffix>)."
+      }
+    },
+    "backendContainerImageName": {
+      "type": "string",
+      "defaultValue": "km-api",
+      "metadata": {
+        "description": "Optional. Backend container image name."
+      }
+    },
+    "backendContainerImageTag": {
+      "type": "string",
+      "defaultValue": "latest",
+      "metadata": {
+        "description": "Optional. Backend container image tag."
+      }
+    },
+    "frontendContainerImageName": {
+      "type": "string",
+      "defaultValue": "km-app",
+      "metadata": {
+        "description": "Optional. Frontend container image name."
+      }
+    },
+    "frontendContainerImageTag": {
+      "type": "string",
+      "defaultValue": "latest",
+      "metadata": {
+        "description": "Optional. Frontend container image tag."
+      }
+    },
+    "appServicePlanSku": {
+      "type": "string",
+      "defaultValue": "B3",
+      "allowedValues": [
+        "F1",
+        "D1",
+        "B1",
+        "B2",
+        "B3",
+        "S1",
+        "S2",
+        "S3",
+        "P1",
+        "P2",
+        "P3",
+        "P1v3",
+        "P1v4"
+      ],
+      "metadata": {
+        "description": "Optional. App Service Plan SKU (used by AVM flavors)."
+      }
+    },
+    "kind": {
+      "type": "string",
+      "defaultValue": "app,linux,container",
+      "metadata": {
+        "description": "Kind of web app."
+      }
+    },
+    "azureAdTenantId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Azure AD tenant ID for authentication."
+      }
+    },
+    "azureAdClientId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Azure AD client ID for authentication."
+      }
+    },
+    "adminApiKey": {
+      "type": "securestring",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable."
+      }
+    },
+    "existingLogAnalyticsWorkspaceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Resource ID of an existing Log Analytics workspace. Empty creates a new one."
+      }
+    },
+    "existingFoundryProjectResourceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Optional. Resource ID of an existing AI Foundry project. Empty creates a new one."
+      }
+    },
+    "deployingUserPrincipalType": {
+      "type": "string",
+      "defaultValue": "User",
+      "allowedValues": [
+        "User",
+        "ServicePrincipal"
+      ],
+      "metadata": {
+        "description": "Optional. Principal type of the deploying user. Use ServicePrincipal for CI/CD pipelines with OIDC."
+      }
+    },
+    "createdBy": {
+      "type": "string",
+      "defaultValue": "[if(contains(deployer(), 'userPrincipalName'), split(deployer().userPrincipalName, '@')[0], deployer().objectId)]",
+      "metadata": {
+        "description": "Optional. Created by user name for resource tagging."
+      }
+    }
+  },
+  "variables": {
+    "solutionSuffix": "[toLower(trim(replace(replace(replace(replace(replace(replace(format('{0}{1}', parameters('solutionName'), parameters('solutionUniqueText')), '-', ''), '_', ''), '.', ''), '/', ''), ' ', ''), '*', '')))]",
+    "containerRegistryResourceName": "[if(not(empty(parameters('containerRegistryName'))), parameters('containerRegistryName'), format('acrkm{0}', variables('solutionSuffix')))]",
+    "deployerInfo": "[deployer()]",
+    "deployingUserPrincipalId": "[variables('deployerInfo').objectId]",
+    "deployingUserPrincipalName": "[coalesce(tryGet(variables('deployerInfo'), 'userPrincipalName'), variables('deployerInfo').objectId)]",
+    "existingTags": "[coalesce(resourceGroup().tags, createObject())]",
+    "resourceTags": "[union(variables('existingTags'), parameters('tags'), createObject('TemplateName', 'KM-Generic', 'CreatedBy', parameters('createdBy'), 'DeploymentName', deployment().name, 'Type', 'Non-WAF'))]",
+    "useExistingLogAnalytics": "[not(empty(parameters('existingLogAnalyticsWorkspaceId')))]",
+    "aiModelDeployments": [
+      {
+        "name": "[parameters('gptModelName')]",
+        "model": "[parameters('gptModelName')]",
+        "sku": {
+          "name": "[parameters('deploymentType')]",
+          "capacity": "[parameters('gptDeploymentCapacity')]"
+        },
+        "version": "[parameters('gptModelVersion')]",
+        "raiPolicyName": "Microsoft.Default"
+      },
+      {
+        "name": "[parameters('embeddingModel')]",
+        "model": "[parameters('embeddingModel')]",
+        "sku": {
+          "name": "GlobalStandard",
+          "capacity": "[parameters('embeddingDeploymentCapacity')]"
+        },
+        "version": "1",
+        "raiPolicyName": "Microsoft.Default"
+      }
+    ],
+    "useExistingAIProject": "[not(empty(parameters('existingFoundryProjectResourceId')))]",
+    "aiFoundrySubscriptionId": "[if(variables('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], subscription().subscriptionId)]",
+    "aiFoundryResourceGroupName": "[if(variables('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], resourceGroup().name)]",
+    "placeholderImageName": "DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
+  },
+  "resources": [
+    {
+      "type": "Microsoft.Resources/tags",
+      "apiVersion": "2024-11-01",
+      "name": "default",
+      "properties": {
+        "tags": "[variables('resourceTags')]"
+      }
+    },
+    {
+      "condition": "[not(variables('useExistingLogAnalytics'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.log-analytics.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "3561501102733674034"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('log-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the Log Analytics workspace. Defaults to log-{solutionName}."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "retentionInDays": {
+              "type": "int",
+              "defaultValue": 365,
+              "metadata": {
+                "description": "Retention period in days."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "PerGB2018",
+              "metadata": {
+                "description": "SKU name for the workspace."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resource."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.OperationalInsights/workspaces",
+              "apiVersion": "2023-09-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "identity": "[parameters('identity')]",
+              "properties": {
+                "retentionInDays": "[parameters('retentionInDays')]",
+                "sku": {
+                  "name": "[parameters('skuName')]"
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Log Analytics workspace."
+              },
+              "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Log Analytics workspace."
+              },
+              "value": "[parameters('name')]"
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Location of the workspace."
+              },
+              "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), '2023-09-01', 'full').location]"
+            },
+            "logAnalyticsWorkspaceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Log Analytics workspace customer ID."
+              },
+              "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), '2023-09-01').customerId]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.app-insights.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "workspaceResourceId": "[if(variables('useExistingLogAnalytics'), createObject('value', parameters('existingLogAnalyticsWorkspaceId')), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.log-analytics.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "2461614014827306322"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('appi-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the Application Insights instance. Defaults to appi-{solutionName}."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "workspaceResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Log Analytics workspace to link to."
+              }
+            },
+            "applicationType": {
+              "type": "string",
+              "defaultValue": "web",
+              "metadata": {
+                "description": "Application type."
+              }
+            },
+            "retentionInDays": {
+              "type": "int",
+              "defaultValue": 365,
+              "metadata": {
+                "description": "Retention period in days."
+              }
+            },
+            "disableIpMasking": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Disable IP masking for security."
+              }
+            },
+            "flowType": {
+              "type": "string",
+              "defaultValue": "Bluefield",
+              "metadata": {
+                "description": "Flow type for Application Insights."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "web",
+              "metadata": {
+                "description": "Kind of Application Insights resource."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Insights/components",
+              "apiVersion": "2020-02-02",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "[parameters('kind')]",
+              "properties": {
+                "Application_Type": "[parameters('applicationType')]",
+                "Flow_Type": "[parameters('flowType')]",
+                "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
+                "RetentionInDays": "[parameters('retentionInDays')]",
+                "DisableIpMasking": "[parameters('disableIpMasking')]",
+                "publicNetworkAccessForIngestion": "Enabled",
+                "publicNetworkAccessForQuery": "Enabled"
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Application Insights instance."
+              },
+              "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Application Insights instance."
+              },
+              "value": "[parameters('name')]"
+            },
+            "instrumentationKey": {
+              "type": "string",
+              "metadata": {
+                "description": "Instrumentation key for the Application Insights instance."
+              },
+              "value": "[reference(resourceId('Microsoft.Insights/components', parameters('name')), '2020-02-02').InstrumentationKey]"
+            },
+            "connectionString": {
+              "type": "string",
+              "metadata": {
+                "description": "Connection string for the Application Insights instance."
+              },
+              "value": "[reference(resourceId('Microsoft.Insights/components', parameters('name')), '2020-02-02').ConnectionString]"
+            },
+            "applicationId": {
+              "type": "string",
+              "metadata": {
+                "description": "Application ID of the Application Insights instance."
+              },
+              "value": "[reference(resourceId('Microsoft.Insights/components', parameters('name')), '2020-02-02').AppId]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.log-analytics.{0}', parameters('solutionName')), 64))]"
+      ]
+    },
+    {
+      "condition": "[empty(parameters('existingFoundryProjectResourceId'))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('azureAiServiceLocation')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "7677890268465434115"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Solution name suffix used to generate resource names."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('aif-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the AI Services account. Defaults to aif-{solutionName}."
+              }
+            },
+            "projectName": {
+              "type": "string",
+              "defaultValue": "[format('proj-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Azure region for the resources."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Tags to apply to resources."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "S0",
+              "metadata": {
+                "description": "Optional. SKU name for the AI Services account."
+              }
+            },
+            "disableLocalAuth": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Whether to disable local (key-based) authentication."
+              }
+            },
+            "allowProjectManagement": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Whether to allow project management (AI Foundry hub)."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Optional. Public network access setting."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resources."
+              }
+            },
+            "networkAclsDefaultAction": {
+              "type": "string",
+              "defaultValue": "Allow",
+              "allowedValues": [
+                "Allow",
+                "Deny"
+              ],
+              "metadata": {
+                "description": "Optional. Network ACLs default action."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.CognitiveServices/accounts",
+              "apiVersion": "2025-12-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[parameters('skuName')]"
+              },
+              "kind": "AIServices",
+              "identity": "[parameters('identity')]",
+              "properties": {
+                "allowProjectManagement": "[parameters('allowProjectManagement')]",
+                "customSubDomainName": "[parameters('name')]",
+                "networkAcls": {
+                  "defaultAction": "[parameters('networkAclsDefaultAction')]",
+                  "virtualNetworkRules": [],
+                  "ipRules": []
+                },
+                "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                "disableLocalAuth": "[parameters('disableLocalAuth')]"
+              }
+            },
+            {
+              "type": "Microsoft.CognitiveServices/accounts/projects",
+              "apiVersion": "2025-12-01",
+              "name": "[format('{0}/{1}', parameters('name'), parameters('projectName'))]",
+              "location": "[parameters('location')]",
+              "kind": "AIServices",
+              "identity": "[parameters('identity')]",
+              "properties": {},
+              "dependsOn": [
+                "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Services account."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Services account."
+              },
+              "value": "[parameters('name')]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the AI Services account (OpenAI Language Model Instance API)."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['OpenAI Language Model Instance API']]"
+            },
+            "cognitiveServicesEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the AI Services account (Cognitive Services)."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoint]"
+            },
+            "azureOpenAiCuEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure OpenAI Content Understanding endpoint URL."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]"
+            },
+            "principalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID of the AI Services account."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full').identity.principalId]"
+            },
+            "projectResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Foundry project."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]"
+            },
+            "projectName": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Foundry project."
+              },
+              "value": "[parameters('projectName')]"
+            },
+            "projectEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "AI Foundry project endpoint."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]"
+            },
+            "projectIdentityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID of the project."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full').identity.principalId]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "condition": "[variables('useExistingAIProject')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)]",
+      "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+      "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value))]",
+          "projectName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[10]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectName.value))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "8348022486141626008"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the existing Cognitive Services account."
+              }
+            },
+            "projectName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. The name of the existing AI project."
+              }
+            }
+          },
+          "resources": [],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Services account."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Services account."
+              },
+              "value": "[parameters('name')]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the AI Services account (OpenAI Language Model Instance API)."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['OpenAI Language Model Instance API']]"
+            },
+            "cognitiveServicesEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the AI Services account (Cognitive Services)."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoint]"
+            },
+            "azureOpenAiCuEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure OpenAI Content Understanding endpoint URL."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]"
+            },
+            "principalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID of the AI Services account (empty if none)."
+              },
+              "value": "[if(and(contains(reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full'), 'identity'), contains(reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full').identity, 'principalId')), reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full').identity.principalId, '')]"
+            },
+            "projectResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Foundry project."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]"
+            },
+            "projectName": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Foundry project."
+              },
+              "value": "[parameters('projectName')]"
+            },
+            "projectEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "AI Foundry project endpoint."
+              },
+              "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]"
+            },
+            "projectIdentityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID of the project (empty if none)."
+              },
+              "value": "[if(and(contains(reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full'), 'identity'), contains(reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full').identity, 'principalId')), reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full').identity.principalId, '')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64)]",
+      "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+      "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "aiServicesAccountName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value))]",
+          "projectName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[10]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectName.value))]",
+          "category": {
+            "value": "CognitiveSearch"
+          },
+          "target": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value]"
+          },
+          "authType": {
+            "value": "AAD"
+          },
+          "metadata": {
+            "value": {
+              "ApiType": "Azure",
+              "ResourceId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "14116608463414189185"
+            }
+          },
+          "parameters": {
+            "aiServicesAccountName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the parent AI Services account."
+              }
+            },
+            "projectName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the AI Foundry project."
+              }
+            },
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Solution name suffix used to generate the connection name."
+              }
+            },
+            "connectionName": {
+              "type": "string",
+              "defaultValue": "[toLower(format('{0}-connection-{1}', parameters('category'), parameters('solutionName')))]",
+              "metadata": {
+                "description": "Optional. Connection name. Defaults to lowercase category with solution suffix."
+              }
+            },
+            "category": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Connection category (e.g., CognitiveSearch, AzureBlob, AppInsights, RemoteTool)."
+              }
+            },
+            "target": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Connection target (URL or resource ID)."
+              }
+            },
+            "authType": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Authentication type (e.g., AAD, ApiKey, ProjectManagedIdentity)."
+              }
+            },
+            "isSharedToAll": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Optional. Whether the connection is shared to all project users."
+              }
+            },
+            "isDefault": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether this is the default connection for its category."
+              }
+            },
+            "metadata": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Connection metadata object."
+              }
+            },
+            "useWorkspaceManagedIdentity": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to use workspace-managed identity for authentication."
+              }
+            },
+            "credentialsKey": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Credentials key (for ApiKey auth type)."
+              }
+            }
+          },
+          "variables": {
+            "baseProperties": {
+              "category": "[parameters('category')]",
+              "target": "[parameters('target')]",
+              "authType": "[parameters('authType')]",
+              "isSharedToAll": "[parameters('isSharedToAll')]",
+              "metadata": "[parameters('metadata')]",
+              "useWorkspaceManagedIdentity": "[parameters('useWorkspaceManagedIdentity')]"
+            },
+            "optionalDefault": "[if(parameters('isDefault'), createObject('isDefault', true()), createObject())]",
+            "optionalCredentials": "[if(not(empty(parameters('credentialsKey'))), createObject('credentials', createObject('key', parameters('credentialsKey'))), createObject())]"
+          },
+          "resources": [
+            {
+              "type": "Microsoft.CognitiveServices/accounts/projects/connections",
+              "apiVersion": "2025-12-01",
+              "name": "[format('{0}/{1}/{2}', parameters('aiServicesAccountName'), parameters('projectName'), parameters('connectionName'))]",
+              "properties": "[union(variables('baseProperties'), variables('optionalDefault'), variables('optionalCredentials'))]"
+            }
+          ],
+          "outputs": {
+            "connectionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Connection name."
+              },
+              "value": "[parameters('connectionName')]"
+            },
+            "connectionId": {
+              "type": "string",
+              "metadata": {
+                "description": "Connection resource ID."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects/connections', parameters('aiServicesAccountName'), parameters('projectName'), parameters('connectionName'))]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64))]"
+      ]
+    },
+    {
+      "copy": {
+        "name": "model_deployments",
+        "count": "[length(variables('aiModelDeployments'))]",
+        "mode": "serial",
+        "batchSize": 1
+      },
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.model-deployment-{0}.{1}', copyIndex(), parameters('solutionName')), 64)]",
+      "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+      "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "aiServicesAccountName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value))]",
+          "deploymentName": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].name]"
+          },
+          "modelName": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].model]"
+          },
+          "modelVersion": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].version]"
+          },
+          "raiPolicyName": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].raiPolicyName]"
+          },
+          "skuName": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].sku.name]"
+          },
+          "skuCapacity": {
+            "value": "[variables('aiModelDeployments')[copyIndex()].sku.capacity]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "5315493943580072668"
+            }
+          },
+          "parameters": {
+            "aiServicesAccountName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name of the parent AI Services account."
+              }
+            },
+            "deploymentName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Name for this model deployment."
+              }
+            },
+            "modelFormat": {
+              "type": "string",
+              "defaultValue": "OpenAI",
+              "metadata": {
+                "description": "Optional. Model format (e.g., OpenAI)."
+              }
+            },
+            "modelName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. Model name (e.g., gpt-4o, text-embedding-ada-002)."
+              }
+            },
+            "modelVersion": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Model version. Empty string means latest."
+              }
+            },
+            "raiPolicyName": {
+              "type": "string",
+              "defaultValue": "Microsoft.Default",
+              "metadata": {
+                "description": "Optional. RAI policy name."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required. SKU name (e.g., Standard, GlobalStandard)."
+              }
+            },
+            "skuCapacity": {
+              "type": "int",
+              "metadata": {
+                "description": "Required. SKU capacity (tokens per minute in thousands)."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.CognitiveServices/accounts/deployments",
+              "apiVersion": "2025-12-01",
+              "name": "[format('{0}/{1}', parameters('aiServicesAccountName'), parameters('deploymentName'))]",
+              "properties": {
+                "model": {
+                  "format": "[parameters('modelFormat')]",
+                  "name": "[parameters('modelName')]",
+                  "version": "[if(not(empty(parameters('modelVersion'))), parameters('modelVersion'), null())]"
+                },
+                "raiPolicyName": "[parameters('raiPolicyName')]"
+              },
+              "sku": {
+                "name": "[parameters('skuName')]",
+                "capacity": "[parameters('skuCapacity')]"
+              }
+            }
+          ],
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the deployed model."
+              },
+              "value": "[parameters('deploymentName')]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the model deployment."
+              },
+              "value": "[resourceId('Microsoft.CognitiveServices/accounts/deployments', parameters('aiServicesAccountName'), parameters('deploymentName'))]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.ai-search.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "skuName": {
+            "value": "standard"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "10009140357497945010"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "minLength": 3,
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('srch-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Optional. Override name for the search service. Defaults to srch-{solutionName}."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "basic",
+              "allowedValues": [
+                "free",
+                "basic",
+                "standard",
+                "standard2",
+                "standard3",
+                "storage_optimized_l1",
+                "storage_optimized_l2"
+              ],
+              "metadata": {
+                "description": "SKU name for the search service."
+              }
+            },
+            "replicaCount": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Number of replicas."
+              }
+            },
+            "partitionCount": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Number of partitions."
+              }
+            },
+            "hostingMode": {
+              "type": "string",
+              "defaultValue": "Default",
+              "allowedValues": [
+                "Default",
+                "HighDensity"
+              ],
+              "metadata": {
+                "description": "Hosting mode."
+              }
+            },
+            "semanticSearch": {
+              "type": "string",
+              "defaultValue": "free",
+              "allowedValues": [
+                "disabled",
+                "free",
+                "standard"
+              ],
+              "metadata": {
+                "description": "Semantic search tier."
+              }
+            },
+            "disableLocalAuth": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Whether to disable local authentication."
+              }
+            },
+            "authOptions": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Authentication options for the search service."
+              }
+            },
+            "networkRuleSet": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Network rule set for the search service."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resource."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Search/searchServices",
+              "apiVersion": "2025-05-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "sku": {
+                "name": "[parameters('skuName')]"
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "searchServiceUpdate",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "skuName": {
+                    "value": "[parameters('skuName')]"
+                  },
+                  "replicaCount": {
+                    "value": "[parameters('replicaCount')]"
+                  },
+                  "partitionCount": {
+                    "value": "[parameters('partitionCount')]"
+                  },
+                  "hostingMode": {
+                    "value": "[parameters('hostingMode')]"
+                  },
+                  "semanticSearch": {
+                    "value": "[parameters('semanticSearch')]"
+                  },
+                  "disableLocalAuth": {
+                    "value": "[parameters('disableLocalAuth')]"
+                  },
+                  "authOptions": {
+                    "value": "[parameters('authOptions')]"
+                  },
+                  "networkRuleSet": {
+                    "value": "[parameters('networkRuleSet')]"
+                  },
+                  "identity": {
+                    "value": "[parameters('identity')]"
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "490514611876211300"
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the existing AI Search service."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Azure region of the search service."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "basic",
+                      "metadata": {
+                        "description": "SKU name for the search service."
+                      }
+                    },
+                    "replicaCount": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Number of replicas."
+                      }
+                    },
+                    "partitionCount": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Number of partitions."
+                      }
+                    },
+                    "hostingMode": {
+                      "type": "string",
+                      "defaultValue": "Default",
+                      "allowedValues": [
+                        "Default",
+                        "HighDensity"
+                      ],
+                      "metadata": {
+                        "description": "Hosting mode."
+                      }
+                    },
+                    "semanticSearch": {
+                      "type": "string",
+                      "defaultValue": "free",
+                      "metadata": {
+                        "description": "Semantic search tier."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Whether to disable local authentication."
+                      }
+                    },
+                    "authOptions": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Authentication options for the search service."
+                      }
+                    },
+                    "networkRuleSet": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Network rule set for the search service."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resource."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Search/searchServices",
+                      "apiVersion": "2025-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]"
+                      },
+                      "identity": "[parameters('identity')]",
+                      "properties": {
+                        "replicaCount": "[parameters('replicaCount')]",
+                        "partitionCount": "[parameters('partitionCount')]",
+                        "hostingMode": "[parameters('hostingMode')]",
+                        "semanticSearch": "[parameters('semanticSearch')]",
+                        "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                        "authOptions": "[if(not(empty(parameters('authOptions'))), parameters('authOptions'), null())]",
+                        "networkRuleSet": "[if(not(empty(parameters('networkRuleSet'))), parameters('networkRuleSet'), null())]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID of the AI Search system-assigned managed identity."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Search/searchServices', parameters('name')), '2025-05-01', 'full').identity.principalId]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the AI Search service."
+              },
+              "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the AI Search service."
+              },
+              "value": "[parameters('name')]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint URL of the AI Search service."
+              },
+              "value": "[format('https://{0}.search.windows.net', parameters('name'))]"
+            },
+            "identityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID."
+              },
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', 'searchServiceUpdate'), '2025-04-01').outputs.systemAssignedMIPrincipalId.value]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.storage-account.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": {}
+          },
+          "containers": {
+            "value": [
+              {
+                "name": "data",
+                "publicAccess": "None"
+              }
+            ]
+          },
+          "enableHierarchicalNamespace": {
+            "value": true
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "4421785903472529399"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[take(format('st{0}', toLower(replace(parameters('solutionName'), '-', ''))), 24)]",
+              "metadata": {
+                "description": "Name of the storage account."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "Standard_LRS",
+              "metadata": {
+                "description": "Storage account SKU."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "StorageV2",
+              "metadata": {
+                "description": "Storage account kind."
+              }
+            },
+            "accessTier": {
+              "type": "string",
+              "defaultValue": "Hot",
+              "allowedValues": [
+                "Hot",
+                "Cool"
+              ],
+              "metadata": {
+                "description": "Access tier."
+              }
+            },
+            "allowBlobPublicAccess": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Allow blob public access."
+              }
+            },
+            "allowSharedKeyAccess": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Allow shared key access."
+              }
+            },
+            "enableHierarchicalNamespace": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable hierarchical namespace (Data Lake Storage Gen2)."
+              }
+            },
+            "containers": {
+              "type": "array",
+              "defaultValue": [
+                {
+                  "name": "default",
+                  "publicAccess": "None"
+                }
+              ],
+              "metadata": {
+                "description": "Blob containers to create."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resource."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Storage/storageAccounts",
+              "apiVersion": "2025-08-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "[parameters('kind')]",
+              "sku": {
+                "name": "[parameters('skuName')]"
+              },
+              "identity": "[parameters('identity')]",
+              "properties": {
+                "accessTier": "[parameters('accessTier')]",
+                "allowBlobPublicAccess": "[parameters('allowBlobPublicAccess')]",
+                "allowSharedKeyAccess": "[parameters('allowSharedKeyAccess')]",
+                "minimumTlsVersion": "TLS1_2",
+                "supportsHttpsTrafficOnly": true,
+                "isHnsEnabled": "[parameters('enableHierarchicalNamespace')]",
+                "encryption": {
+                  "services": {
+                    "blob": {
+                      "enabled": true
+                    },
+                    "file": {
+                      "enabled": true
+                    }
+                  },
+                  "keySource": "Microsoft.Storage",
+                  "requireInfrastructureEncryption": true
+                }
+              }
+            },
+            {
+              "type": "Microsoft.Storage/storageAccounts/blobServices",
+              "apiVersion": "2025-08-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'default')]",
+              "dependsOn": [
+                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+              ]
+            },
+            {
+              "copy": {
+                "name": "blobContainers",
+                "count": "[length(parameters('containers'))]"
+              },
+              "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+              "apiVersion": "2025-08-01",
+              "name": "[format('{0}/{1}/{2}', parameters('name'), 'default', parameters('containers')[copyIndex()].name)]",
+              "properties": {
+                "publicAccess": "[parameters('containers')[copyIndex()].publicAccess]"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('name'), 'default')]"
+              ]
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Storage Account."
+              },
+              "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Storage Account."
+              },
+              "value": "[parameters('name')]"
+            },
+            "blobEndpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Primary blob endpoint."
+              },
+              "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2025-08-01').primaryEndpoints.blob]"
+            },
+            "serviceEndpoints": {
+              "type": "object",
+              "metadata": {
+                "description": "All service endpoints."
+              },
+              "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2025-08-01').primaryEndpoints]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "condition": "[parameters('deployCosmos')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "name": {
+            "value": "[format('cosmos-{0}', variables('solutionSuffix'))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "databaseName": {
+            "value": "km-db"
+          },
+          "containers": {
+            "value": [
+              {
+                "name": "chat_sessions",
+                "partitionKeyPath": "/user_id"
+              },
+              {
+                "name": "chat_messages",
+                "partitionKeyPath": "/session_id"
+              },
+              {
+                "name": "document_insights",
+                "partitionKeyPath": "/dataset_id"
+              },
+              {
+                "name": "enrichment_cache",
+                "partitionKeyPath": "/doc_hash"
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "7776062422456459323"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('cosmos-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the Cosmos DB account."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "databaseName": {
+              "type": "string",
+              "defaultValue": "db_conversation_history",
+              "metadata": {
+                "description": "Database name."
+              }
+            },
+            "containers": {
+              "type": "array",
+              "defaultValue": [
+                {
+                  "name": "conversations",
+                  "partitionKeyPath": "/userId"
+                }
+              ],
+              "metadata": {
+                "description": "Container definitions."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resource."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.DocumentDB/databaseAccounts",
+              "apiVersion": "2025-10-15",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "GlobalDocumentDB",
+              "identity": "[parameters('identity')]",
+              "properties": {
+                "consistencyPolicy": {
+                  "defaultConsistencyLevel": "Session"
+                },
+                "locations": [
+                  {
+                    "locationName": "[parameters('location')]",
+                    "failoverPriority": 0,
+                    "isZoneRedundant": false
+                  }
+                ],
+                "databaseAccountOfferType": "Standard",
+                "enableAutomaticFailover": false,
+                "enableMultipleWriteLocations": false,
+                "disableLocalAuth": true,
+                "capabilities": [
+                  {
+                    "name": "EnableServerless"
+                  }
+                ]
+              }
+            },
+            {
+              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+              "apiVersion": "2025-10-15",
+              "name": "[format('{0}/{1}', parameters('name'), parameters('databaseName'))]",
+              "properties": {
+                "resource": {
+                  "id": "[parameters('databaseName')]"
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+              ]
+            },
+            {
+              "copy": {
+                "name": "containersRes",
+                "count": "[length(parameters('containers'))]"
+              },
+              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
+              "apiVersion": "2025-10-15",
+              "name": "[format('{0}/{1}/{2}', parameters('name'), parameters('databaseName'), parameters('containers')[copyIndex()].name)]",
+              "properties": {
+                "resource": {
+                  "id": "[parameters('containers')[copyIndex()].name]",
+                  "partitionKey": {
+                    "paths": [
+                      "[parameters('containers')[copyIndex()].partitionKeyPath]"
+                    ],
+                    "kind": "Hash"
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('name'), parameters('databaseName'))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the Cosmos DB account."
+              },
+              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Cosmos DB account."
+              },
+              "value": "[parameters('name')]"
+            },
+            "endpoint": {
+              "type": "string",
+              "metadata": {
+                "description": "Endpoint of the Cosmos DB account."
+              },
+              "value": "[format('https://{0}.documents.azure.com:443/', parameters('name'))]"
+            },
+            "databaseName": {
+              "type": "string",
+              "metadata": {
+                "description": "Database name."
+              },
+              "value": "[parameters('databaseName')]"
+            },
+            "containerName": {
+              "type": "string",
+              "metadata": {
+                "description": "Container name (first container)."
+              },
+              "value": "[parameters('containers')[0].name]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.sql-db.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "name": {
+            "value": "[format('sql-{0}', variables('solutionSuffix'))]"
+          },
+          "databaseName": {
+            "value": "[format('sqldb-{0}', variables('solutionSuffix'))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[variables('resourceTags')]"
+          },
+          "deployerPrincipalId": {
+            "value": "[variables('deployingUserPrincipalId')]"
+          },
+          "deployerPrincipalName": {
+            "value": "[variables('deployingUserPrincipalName')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "1308147711399284018"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('sql-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the SQL Server."
+              }
+            },
+            "databaseName": {
+              "type": "string",
+              "defaultValue": "[format('sqldb-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the SQL Database."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "deployerPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "Principal ID of the deployer for admin access."
+              }
+            },
+            "deployerPrincipalName": {
+              "type": "string",
+              "metadata": {
+                "description": "Principal name of the deployer for admin access."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "GP_S_Gen5",
+              "metadata": {
+                "description": "SKU name for the database."
+              }
+            },
+            "skuTier": {
+              "type": "string",
+              "defaultValue": "GeneralPurpose",
+              "metadata": {
+                "description": "SKU tier for the database."
+              }
+            },
+            "skuFamily": {
+              "type": "string",
+              "defaultValue": "Gen5",
+              "metadata": {
+                "description": "SKU family."
+              }
+            },
+            "skuCapacity": {
+              "type": "int",
+              "defaultValue": 2,
+              "metadata": {
+                "description": "vCore capacity."
+              }
+            },
+            "autoPauseDelay": {
+              "type": "int",
+              "defaultValue": 60,
+              "metadata": {
+                "description": "Auto-pause delay in minutes."
+              }
+            },
+            "minCapacity": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Minimum capacity (vCores)."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resource."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Sql/servers",
+              "apiVersion": "2025-01-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "identity": "[parameters('identity')]",
+              "properties": {
+                "publicNetworkAccess": "Enabled",
+                "version": "12.0",
+                "restrictOutboundNetworkAccess": "Disabled",
+                "minimalTlsVersion": "1.2",
+                "administrators": {
+                  "login": "[parameters('deployerPrincipalName')]",
+                  "sid": "[parameters('deployerPrincipalId')]",
+                  "tenantId": "[subscription().tenantId]",
+                  "administratorType": "ActiveDirectory",
+                  "azureADOnlyAuthentication": true
+                }
+              }
+            },
+            {
+              "type": "Microsoft.Sql/servers/firewallRules",
+              "apiVersion": "2025-01-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'AllowSpecificRange')]",
+              "properties": {
+                "startIpAddress": "0.0.0.0",
+                "endIpAddress": "255.255.255.255"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Sql/servers/firewallRules",
+              "apiVersion": "2025-01-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'AllowAllAzureServicesAndResourcesWithinAzureIps')]",
+              "properties": {
+                "startIpAddress": "0.0.0.0",
+                "endIpAddress": "0.0.0.0"
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Sql/servers/databases",
+              "apiVersion": "2025-01-01",
+              "name": "[format('{0}/{1}', parameters('name'), parameters('databaseName'))]",
+              "location": "[parameters('location')]",
+              "sku": {
+                "name": "[parameters('skuName')]",
+                "tier": "[parameters('skuTier')]",
+                "family": "[parameters('skuFamily')]",
+                "capacity": "[parameters('skuCapacity')]"
+              },
+              "properties": {
+                "collation": "SQL_Latin1_General_CP1_CI_AS",
+                "autoPauseDelay": "[parameters('autoPauseDelay')]",
+                "minCapacity": "[parameters('minCapacity')]",
+                "readScale": "Disabled",
+                "zoneRedundant": false
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "serverFqdn": {
+              "type": "string",
+              "metadata": {
+                "description": "Fully qualified domain name of the SQL Server."
+              },
+              "value": "[format('{0}.database.windows.net', parameters('name'))]"
+            },
+            "databaseName": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the SQL Database."
+              },
+              "value": "[parameters('databaseName')]"
+            },
+            "serverResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the SQL Server."
+              },
+              "value": "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the SQL Server."
+              },
+              "value": "[parameters('name')]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.app-service-plan.{0}', parameters('solutionName')), 64)]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "skuName": {
+            "value": "[parameters('appServicePlanSku')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "17503458259299065073"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[format('asp-{0}', parameters('solutionName'))]",
+              "metadata": {
+                "description": "Name of the App Service Plan."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "B2",
+              "allowedValues": [
+                "F1",
+                "D1",
+                "B1",
+                "B2",
+                "B3",
+                "S1",
+                "S2",
+                "S3",
+                "P1",
+                "P2",
+                "P3",
+                "P4",
+                "P0v3",
+                "P0v4",
+                "P1v3",
+                "P1v4",
+                "P2v3",
+                "P3v3"
+              ],
+              "metadata": {
+                "description": "SKU name for the App Service Plan."
+              }
+            },
+            "reserved": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Whether the plan is Linux-based."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "linux",
+              "metadata": {
+                "description": "Kind of the App Service Plan."
+              }
+            },
+            "skuCapacity": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Number of instances (workers)."
+              }
+            },
+            "zoneRedundant": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable zone redundancy. Requires Premium SKU (P1v3+)."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resource."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Web/serverfarms",
+              "apiVersion": "2025-05-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "[parameters('kind')]",
+              "sku": {
+                "name": "[parameters('skuName')]",
+                "capacity": "[parameters('skuCapacity')]"
+              },
+              "properties": {
+                "reserved": "[parameters('reserved')]",
+                "zoneRedundant": "[parameters('zoneRedundant')]"
+              },
+              "identity": "[parameters('identity')]"
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service Plan."
+              },
+              "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the App Service Plan."
+              },
+              "value": "[parameters('name')]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.container-registry.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "name": {
+            "value": "[variables('containerRegistryResourceName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[variables('resourceTags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "4857117904279025114"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name used for naming convention."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[replace(format('cr{0}', parameters('solutionName')), '-', '')]",
+              "metadata": {
+                "description": "Name of the container registry."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for deployment."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Resource tags."
+              }
+            },
+            "sku": {
+              "type": "string",
+              "defaultValue": "Standard",
+              "allowedValues": [
+                "Basic",
+                "Standard",
+                "Premium"
+              ],
+              "metadata": {
+                "description": "SKU for the container registry."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "exportPolicyStatus": {
+              "type": "string",
+              "defaultValue": "enabled",
+              "metadata": {
+                "description": "Export policy status."
+              }
+            },
+            "retentionPolicyStatus": {
+              "type": "string",
+              "defaultValue": "disabled",
+              "metadata": {
+                "description": "Retention policy status."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resource."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.ContainerRegistry/registries",
+              "apiVersion": "2025-04-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "sku": {
+                "name": "[parameters('sku')]"
+              },
+              "identity": "[parameters('identity')]",
+              "properties": {
+                "adminUserEnabled": false,
+                "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                "dataEndpointEnabled": false,
+                "networkRuleBypassOptions": "AzureServices",
+                "policies": {
+                  "azureADAuthenticationAsArmPolicy": {
+                    "status": "enabled"
+                  },
+                  "exportPolicy": {
+                    "status": "[parameters('exportPolicyStatus')]"
+                  },
+                  "retentionPolicy": {
+                    "status": "[parameters('retentionPolicyStatus')]",
+                    "days": 7
+                  },
+                  "trustPolicy": {
+                    "status": "disabled",
+                    "type": "Notary"
+                  }
+                },
+                "zoneRedundancy": "Disabled"
+              }
+            }
+          ],
+          "outputs": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "The name of the container registry."
+              },
+              "value": "[parameters('name')]"
+            },
+            "loginServer": {
+              "type": "string",
+              "metadata": {
+                "description": "The login server URL."
+              },
+              "value": "[reference(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '2025-04-01').loginServer]"
+            },
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "The resource ID of the container registry."
+              },
+              "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
+            }
+          }
+        }
+      }
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "name": {
+            "value": "[format('api-{0}', variables('solutionSuffix'))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[union(parameters('tags'), createObject('azd-service-name', 'api'))]"
+          },
+          "serverFarmResourceId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.app-service-plan.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+          },
+          "kind": {
+            "value": "[parameters('kind')]"
+          },
+          "linuxFxVersion": {
+            "value": "[variables('placeholderImageName')]"
+          },
+          "acrUseManagedIdentityCreds": {
+            "value": true
+          },
+          "appSettings": {
+            "value": {
+              "DOCKER_REGISTRY_SERVER_URL": "[format('https://{0}', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.loginServer.value)]",
+              "WEBSITES_PORT": "8000",
+              "AZURE_OPENAI_ENDPOINT": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value)]",
+              "AZURE_OPENAI_CHAT_DEPLOYMENT": "[parameters('gptModelName')]",
+              "AZURE_OPENAI_EMBEDDING_DEPLOYMENT": "[parameters('embeddingModel')]",
+              "AZURE_SEARCH_ENDPOINT": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value]",
+              "AZURE_SEARCH_INDEX_NAME": "knowledge-mining-index",
+              "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.azureOpenAiCuEndpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.azureOpenAiCuEndpoint.value)]",
+              "AZURE_STORAGE_ACCOUNT": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]",
+              "AZURE_SQL_SERVER": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.serverFqdn.value]",
+              "AZURE_SQL_DATABASE": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.databaseName.value]",
+              "AZURE_COSMOS_ENDPOINT": "[if(parameters('deployCosmos'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value, '')]",
+              "AZURE_COSMOS_DATABASE": "[if(parameters('deployCosmos'), 'km-db', '')]",
+              "AZURE_AD_TENANT_ID": "[parameters('azureAdTenantId')]",
+              "AZURE_AD_CLIENT_ID": "[parameters('azureAdClientId')]",
+              "AZURE_AI_AGENT_ENDPOINT": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectEndpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectEndpoint.value)]",
+              "AZURE_AI_SEARCH_CONNECTION_NAME": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.connectionName.value]",
+              "API_APP_NAME": "[format('api-{0}', variables('solutionSuffix'))]",
+              "APP_FRONTEND_HOSTNAME": "[format('https://app-{0}.azurewebsites.net', variables('solutionSuffix'))]",
+              "APP_ENV": "Prod",
+              "ADMIN_API_KEY": "[parameters('adminApiKey')]",
+              "SOLUTION_SUFFIX": "[variables('solutionSuffix')]"
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "15416323965013625336"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[parameters('solutionName')]",
+              "metadata": {
+                "description": "Name of the App Service."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "serverFarmResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service Plan."
+              }
+            },
+            "linuxFxVersion": {
+              "type": "string",
+              "metadata": {
+                "description": "Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag)."
+              }
+            },
+            "appSettings": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Application settings key-value pairs."
+              }
+            },
+            "alwaysOn": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Whether to enable Always On."
+              }
+            },
+            "healthCheckPath": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Health check path for the app."
+              }
+            },
+            "webSocketsEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to enable WebSockets."
+              }
+            },
+            "appCommandLine": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Command line for the application."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "app,linux",
+              "allowedValues": [
+                "functionapp",
+                "functionapp,linux",
+                "functionapp,workflowapp",
+                "functionapp,workflowapp,linux",
+                "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
+                "app,linux",
+                "app",
+                "linux,api",
+                "api",
+                "app,linux,container",
+                "app,container,windows"
+              ],
+              "metadata": {
+                "description": "Required. Type of site to deploy."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resource."
+              }
+            },
+            "acrUseManagedIdentityCreds": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to use managed identity credentials for ACR authentication."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+              "apiVersion": "2025-05-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'ftp')]",
+              "properties": {
+                "allow": false
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+              "apiVersion": "2025-05-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'scm')]",
+              "properties": {
+                "allow": false
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Web/sites",
+              "apiVersion": "2025-05-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "[parameters('kind')]",
+              "identity": "[parameters('identity')]",
+              "properties": {
+                "serverFarmId": "[parameters('serverFarmResourceId')]",
+                "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                "siteConfig": {
+                  "alwaysOn": "[parameters('alwaysOn')]",
+                  "ftpsState": "Disabled",
+                  "linuxFxVersion": "[parameters('linuxFxVersion')]",
+                  "minTlsVersion": "1.2",
+                  "healthCheckPath": "[if(not(empty(parameters('healthCheckPath'))), parameters('healthCheckPath'), null())]",
+                  "webSocketsEnabled": "[parameters('webSocketsEnabled')]",
+                  "appCommandLine": "[parameters('appCommandLine')]",
+                  "acrUseManagedIdentityCreds": "[parameters('acrUseManagedIdentityCreds')]"
+                },
+                "endToEndEncryptionEnabled": true
+              }
+            },
+            {
+              "type": "Microsoft.Web/sites/config",
+              "apiVersion": "2025-05-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'appsettings')]",
+              "properties": "[parameters('appSettings')]",
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Web/sites/config",
+              "apiVersion": "2025-05-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+              "properties": {
+                "applicationLogs": {
+                  "fileSystem": {
+                    "level": "Verbose"
+                  }
+                },
+                "detailedErrorMessages": {
+                  "enabled": true
+                },
+                "failedRequestsTracing": {
+                  "enabled": true
+                },
+                "httpLogs": {
+                  "fileSystem": {
+                    "enabled": true,
+                    "retentionInDays": 1,
+                    "retentionInMb": 35
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                "[resourceId('Microsoft.Web/sites/config', parameters('name'), 'appsettings')]"
+              ]
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service."
+              },
+              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the App Service."
+              },
+              "value": "[parameters('name')]"
+            },
+            "defaultHostname": {
+              "type": "string",
+              "metadata": {
+                "description": "Default hostname of the App Service."
+              },
+              "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01').defaultHostName]"
+            },
+            "appUrl": {
+              "type": "string",
+              "metadata": {
+                "description": "URL of the App Service."
+              },
+              "value": "[format('https://{0}', reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01').defaultHostName)]"
+            },
+            "identityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID."
+              },
+              "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01', 'full').identity.principalId]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64))]",
+        "[resourceId('Microsoft.Resources/deployments', take(format('module.app-service-plan.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64))]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "name": {
+            "value": "[format('app-{0}', variables('solutionSuffix'))]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[union(parameters('tags'), createObject('azd-service-name', 'webapp'))]"
+          },
+          "serverFarmResourceId": {
+            "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.app-service-plan.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+          },
+          "kind": {
+            "value": "[parameters('kind')]"
+          },
+          "linuxFxVersion": {
+            "value": "[variables('placeholderImageName')]"
+          },
+          "acrUseManagedIdentityCreds": {
+            "value": true
+          },
+          "appSettings": {
+            "value": {
+              "DOCKER_REGISTRY_SERVER_URL": "[format('https://{0}', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.loginServer.value)]",
+              "APP_API_BASE_URL": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]",
+              "WEBSITES_PORT": "80"
+            }
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "15416323965013625336"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution name suffix used to derive the resource name."
+              }
+            },
+            "name": {
+              "type": "string",
+              "defaultValue": "[parameters('solutionName')]",
+              "metadata": {
+                "description": "Name of the App Service."
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure region for the resource."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to the resource."
+              }
+            },
+            "serverFarmResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service Plan."
+              }
+            },
+            "linuxFxVersion": {
+              "type": "string",
+              "metadata": {
+                "description": "Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag)."
+              }
+            },
+            "appSettings": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Application settings key-value pairs."
+              }
+            },
+            "alwaysOn": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Whether to enable Always On."
+              }
+            },
+            "healthCheckPath": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Health check path for the app."
+              }
+            },
+            "webSocketsEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to enable WebSockets."
+              }
+            },
+            "appCommandLine": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Command line for the application."
+              }
+            },
+            "kind": {
+              "type": "string",
+              "defaultValue": "app,linux",
+              "allowedValues": [
+                "functionapp",
+                "functionapp,linux",
+                "functionapp,workflowapp",
+                "functionapp,workflowapp,linux",
+                "functionapp,linux,container",
+                "functionapp,linux,container,azurecontainerapps",
+                "app,linux",
+                "app",
+                "linux,api",
+                "api",
+                "app,linux,container",
+                "app,container,windows"
+              ],
+              "metadata": {
+                "description": "Required. Type of site to deploy."
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "metadata": {
+                "description": "Public network access setting."
+              }
+            },
+            "identity": {
+              "type": "object",
+              "defaultValue": {
+                "type": "SystemAssigned"
+              },
+              "metadata": {
+                "description": "Optional. Managed identity configuration for the resource."
+              }
+            },
+            "acrUseManagedIdentityCreds": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional. Whether to use managed identity credentials for ACR authentication."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+              "apiVersion": "2025-05-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'ftp')]",
+              "properties": {
+                "allow": false
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+              "apiVersion": "2025-05-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'scm')]",
+              "properties": {
+                "allow": false
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Web/sites",
+              "apiVersion": "2025-05-01",
+              "name": "[parameters('name')]",
+              "location": "[parameters('location')]",
+              "tags": "[parameters('tags')]",
+              "kind": "[parameters('kind')]",
+              "identity": "[parameters('identity')]",
+              "properties": {
+                "serverFarmId": "[parameters('serverFarmResourceId')]",
+                "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                "siteConfig": {
+                  "alwaysOn": "[parameters('alwaysOn')]",
+                  "ftpsState": "Disabled",
+                  "linuxFxVersion": "[parameters('linuxFxVersion')]",
+                  "minTlsVersion": "1.2",
+                  "healthCheckPath": "[if(not(empty(parameters('healthCheckPath'))), parameters('healthCheckPath'), null())]",
+                  "webSocketsEnabled": "[parameters('webSocketsEnabled')]",
+                  "appCommandLine": "[parameters('appCommandLine')]",
+                  "acrUseManagedIdentityCreds": "[parameters('acrUseManagedIdentityCreds')]"
+                },
+                "endToEndEncryptionEnabled": true
+              }
+            },
+            {
+              "type": "Microsoft.Web/sites/config",
+              "apiVersion": "2025-05-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'appsettings')]",
+              "properties": "[parameters('appSettings')]",
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Web/sites/config",
+              "apiVersion": "2025-05-01",
+              "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+              "properties": {
+                "applicationLogs": {
+                  "fileSystem": {
+                    "level": "Verbose"
+                  }
+                },
+                "detailedErrorMessages": {
+                  "enabled": true
+                },
+                "failedRequestsTracing": {
+                  "enabled": true
+                },
+                "httpLogs": {
+                  "fileSystem": {
+                    "enabled": true,
+                    "retentionInDays": 1,
+                    "retentionInMb": 35
+                  }
+                }
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                "[resourceId('Microsoft.Web/sites/config', parameters('name'), 'appsettings')]"
+              ]
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the App Service."
+              },
+              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+            },
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the App Service."
+              },
+              "value": "[parameters('name')]"
+            },
+            "defaultHostname": {
+              "type": "string",
+              "metadata": {
+                "description": "Default hostname of the App Service."
+              },
+              "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01').defaultHostName]"
+            },
+            "appUrl": {
+              "type": "string",
+              "metadata": {
+                "description": "URL of the App Service."
+              },
+              "value": "[format('https://{0}', reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01').defaultHostName)]"
+            },
+            "identityPrincipalId": {
+              "type": "string",
+              "metadata": {
+                "description": "System-assigned identity principal ID."
+              },
+              "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01', 'full').identity.principalId]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64))]",
+        "[resourceId('Microsoft.Resources/deployments', take(format('module.app-service-plan.{0}', parameters('solutionName')), 64))]"
+      ]
+    },
+    {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[take(format('module.role-assignments.{0}', parameters('solutionName')), 64)]",
+      "resourceGroup": "[resourceGroup().name]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "solutionName": {
+            "value": "[variables('solutionSuffix')]"
+          },
+          "useExistingAIProject": {
+            "value": "[variables('useExistingAIProject')]"
+          },
+          "existingFoundryProjectResourceId": {
+            "value": "[parameters('existingFoundryProjectResourceId')]"
+          },
+          "aiFoundryResourceId": "[if(not(variables('useExistingAIProject')), if(variables('useExistingAIProject'), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value)), createObject('value', ''))]",
+          "aiSearchResourceId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+          },
+          "storageAccountResourceId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+          },
+          "aiProjectPrincipalId": "[if(variables('useExistingAIProject'), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectIdentityPrincipalId.value), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectIdentityPrincipalId.value))]",
+          "aiSearchPrincipalId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]"
+          },
+          "deployerPrincipalId": {
+            "value": "[variables('deployingUserPrincipalId')]"
+          },
+          "deployerPrincipalType": {
+            "value": "[parameters('deployingUserPrincipalType')]"
+          },
+          "backendAppServicePrincipalId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]"
+          },
+          "cosmosDbAccountName": "[if(parameters('deployCosmos'), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value), createObject('value', ''))]",
+          "containerRegistryResourceId": {
+            "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+          },
+          "acrPullPrincipals": {
+            "value": [
+              {
+                "principalId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]",
+                "principalType": "ServicePrincipal"
+              },
+              {
+                "principalId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]",
+                "principalType": "ServicePrincipal"
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.46.1.21595",
+              "templateHash": "16253024886724298901"
+            }
+          },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Solution name suffix for generating unique role assignment GUIDs."
+              }
+            },
+            "useExistingAIProject": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Whether to use an existing AI project (true) or create new (false)."
+              }
+            },
+            "existingFoundryProjectResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the existing AI project (for deriving AI Services name/sub/RG)."
+              }
+            },
+            "aiProjectPrincipalId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Principal ID of the AI project identity (works for both new and existing projects)."
+              }
+            },
+            "aiSearchPrincipalId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Principal ID of the AI Search identity."
+              }
+            },
+            "backendAppServicePrincipalId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Principal ID of the backend App Service system-assigned identity (empty if not deployed)."
+              }
+            },
+            "deployerPrincipalId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Principal ID of the deploying user (for user access roles)."
+              }
+            },
+            "deployerPrincipalType": {
+              "type": "string",
+              "defaultValue": "User",
+              "allowedValues": [
+                "User",
+                "ServicePrincipal"
+              ],
+              "metadata": {
+                "description": "Principal type of the deploying user."
+              }
+            },
+            "aiFoundryResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the AI Foundry account (empty if not deployed — new project path)."
+              }
+            },
+            "aiSearchResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the AI Search service (empty if not deployed)."
+              }
+            },
+            "storageAccountResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the Storage Account (empty if not deployed)."
+              }
+            },
+            "cosmosDbAccountName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Name of the Cosmos DB account (empty if not deployed)."
+              }
+            },
+            "useExistingContainerRegistry": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Whether to use an existing container registry (true) or the one created in this deployment (false)."
+              }
+            },
+            "containerRegistryResourceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Resource ID of the container registry to grant AcrPull on (for deriving name/sub/RG; empty = skip ACR role assignments)."
+              }
+            },
+            "acrPullPrincipals": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Principals to grant AcrPull on the container registry (array of objects with principalId and principalType)."
+              }
+            }
+          },
+          "variables": {
+            "existingAIFoundryName": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[8], '')]",
+            "existingAIFoundrySubscription": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], subscription().subscriptionId)]",
+            "existingAIFoundryResourceGroup": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], resourceGroup().name)]",
+            "containerRegistryName": "[if(empty(parameters('containerRegistryResourceId')), '', split(parameters('containerRegistryResourceId'), '/')[8])]",
+            "containerRegistrySubscription": "[if(empty(parameters('containerRegistryResourceId')), subscription().subscriptionId, split(parameters('containerRegistryResourceId'), '/')[2])]",
+            "containerRegistryResourceGroup": "[if(empty(parameters('containerRegistryResourceId')), resourceGroup().name, split(parameters('containerRegistryResourceId'), '/')[4])]",
+            "roleDefinitions": {
+              "azureAiUser": "53ca6127-db72-4b80-b1b0-d745d6d5456d",
+              "cognitiveServicesUser": "a97b65f3-24c7-4388-baec-2e87135dc908",
+              "cognitiveServicesOpenAIUser": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",
+              "azureAIDeveloper": "64702f94-c441-49e6-a78b-ef80e0188fee",
+              "searchIndexDataReader": "1407120a-92aa-4202-b7e9-c0e197c71c8f",
+              "searchIndexDataContributor": "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
+              "searchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
+              "storageBlobDataContributor": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
+              "storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
+              "storageQueueDataContributor": "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
+              "acrPull": "7f951dda-4ed3-4680-a7ca-43fe172d538d"
+            }
+          },
+          "resources": [
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiSearchPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('aiSearchPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+              "properties": {
+                "principalId": "[parameters('aiSearchPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiFoundryResourceId')))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').azureAiUser)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiFoundryResourceId')))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').searchIndexDataReader)]",
+              "properties": {
+                "principalId": "[parameters('aiProjectPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataReader)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+              "properties": {
+                "principalId": "[parameters('aiProjectPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').searchIndexDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('aiProjectPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').storageBlobDataReader)]",
+              "properties": {
+                "principalId": "[parameters('aiProjectPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataReader)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiSearchPrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiSearchPrincipalId'), variables('roleDefinitions').storageBlobDataReader)]",
+              "properties": {
+                "principalId": "[parameters('aiSearchPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataReader)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
+                "principalType": "ServicePrincipal"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+              "apiVersion": "2025-10-15",
+              "name": "[format('{0}/{1}', parameters('cosmosDbAccountName'), guid(parameters('solutionName'), resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbAccountName'), '00000000-0000-0000-0000-000000000002'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbAccountName')), parameters('backendAppServicePrincipalId')))]",
+              "properties": {
+                "principalId": "[parameters('backendAppServicePrincipalId')]",
+                "roleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbAccountName'), '00000000-0000-0000-0000-000000000002')]",
+                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbAccountName'))]"
+              }
+            },
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('deployerPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').cognitiveServicesUser)]",
+              "properties": {
+                "principalId": "[parameters('deployerPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesUser)]",
+                "principalType": "[parameters('deployerPrincipalType')]"
+              }
+            },
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('deployerPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').azureAiUser)]",
+              "properties": {
+                "principalId": "[parameters('deployerPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]",
+                "principalType": "[parameters('deployerPrincipalType')]"
+              }
+            },
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('deployerPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').azureAIDeveloper)]",
+              "properties": {
+                "principalId": "[parameters('deployerPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAIDeveloper)]",
+                "principalType": "[parameters('deployerPrincipalType')]"
+              }
+            },
+            {
+              "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('deployerPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+              "properties": {
+                "principalId": "[parameters('deployerPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                "principalType": "[parameters('deployerPrincipalType')]"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('deployerPrincipalId'))), not(empty(parameters('aiSearchResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').searchIndexDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('deployerPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataContributor)]",
+                "principalType": "[parameters('deployerPrincipalType')]"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('deployerPrincipalId'))), not(empty(parameters('aiSearchResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+              "properties": {
+                "principalId": "[parameters('deployerPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                "principalType": "[parameters('deployerPrincipalType')]"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('deployerPrincipalId'))), not(empty(parameters('storageAccountResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('deployerPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                "principalType": "[parameters('deployerPrincipalType')]"
+              }
+            },
+            {
+              "condition": "[and(not(empty(parameters('deployerPrincipalId'))), not(empty(parameters('storageAccountResourceId'))))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+              "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
+              "properties": {
+                "principalId": "[parameters('deployerPrincipalId')]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
+                "principalType": "[parameters('deployerPrincipalType')]"
+              }
+            },
+            {
+              "copy": {
+                "name": "acrPullAssignments",
+                "count": "[length(parameters('acrPullPrincipals'))]"
+              },
+              "condition": "[and(not(parameters('useExistingContainerRegistry')), not(empty(parameters('acrPullPrincipals')[copyIndex()].principalId)))]",
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', variables('containerRegistryName'))]",
+              "name": "[guid(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId, variables('roleDefinitions').acrPull)]",
+              "properties": {
+                "principalId": "[parameters('acrPullPrincipals')[copyIndex()].principalId]",
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').acrPull)]",
+                "principalType": "[parameters('acrPullPrincipals')[copyIndex()].principalType]"
+              }
+            },
+            {
+              "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('aiSearchPrincipalId'))))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "assignOpenAIRoleToAISearchExisting",
+              "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+              "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "principalId": {
+                    "value": "[parameters('aiSearchPrincipalId')]"
+                  },
+                  "roleDefinitionId": {
+                    "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                  },
+                  "roleAssignmentName": {
+                    "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('aiSearchPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                  },
+                  "aiFoundryName": {
+                    "value": "[variables('existingAIFoundryName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1001648557732946394"
+                    }
+                  },
+                  "parameters": {
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID to assign the role to."
+                      }
+                    },
+                    "roleDefinitionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the role definition to assign."
+                      }
+                    },
+                    "roleAssignmentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "A unique name for the role assignment."
+                      }
+                    },
+                    "principalType": {
+                      "type": "string",
+                      "defaultValue": "ServicePrincipal",
+                      "allowedValues": [
+                        "ServicePrincipal",
+                        "User",
+                        "Group"
+                      ],
+                      "metadata": {
+                        "description": "The principal type of the identity being assigned."
+                      }
+                    },
+                    "targetResourceType": {
+                      "type": "string",
+                      "defaultValue": "AIServices",
+                      "allowedValues": [
+                        "AIServices",
+                        "ContainerRegistry"
+                      ],
+                      "metadata": {
+                        "description": "The type of target resource to scope the role assignment to."
+                      }
+                    },
+                    "aiFoundryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target AI Services (Cognitive Services) account. Required when targetResourceType is AIServices."
+                      }
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    },
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "assignAiUserRoleToBackendExisting",
+              "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+              "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "principalId": {
+                    "value": "[parameters('backendAppServicePrincipalId')]"
+                  },
+                  "roleDefinitionId": {
+                    "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]"
+                  },
+                  "roleAssignmentName": {
+                    "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').azureAiUser)]"
+                  },
+                  "aiFoundryName": {
+                    "value": "[variables('existingAIFoundryName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1001648557732946394"
+                    }
+                  },
+                  "parameters": {
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID to assign the role to."
+                      }
+                    },
+                    "roleDefinitionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the role definition to assign."
+                      }
+                    },
+                    "roleAssignmentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "A unique name for the role assignment."
+                      }
+                    },
+                    "principalType": {
+                      "type": "string",
+                      "defaultValue": "ServicePrincipal",
+                      "allowedValues": [
+                        "ServicePrincipal",
+                        "User",
+                        "Group"
+                      ],
+                      "metadata": {
+                        "description": "The principal type of the identity being assigned."
+                      }
+                    },
+                    "targetResourceType": {
+                      "type": "string",
+                      "defaultValue": "AIServices",
+                      "allowedValues": [
+                        "AIServices",
+                        "ContainerRegistry"
+                      ],
+                      "metadata": {
+                        "description": "The type of target resource to scope the role assignment to."
+                      }
+                    },
+                    "aiFoundryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target AI Services (Cognitive Services) account. Required when targetResourceType is AIServices."
+                      }
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    },
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('backendAppServicePrincipalId'))))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "assignOpenAIUserRoleToBackendExisting",
+              "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+              "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "principalId": {
+                    "value": "[parameters('backendAppServicePrincipalId')]"
+                  },
+                  "roleDefinitionId": {
+                    "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                  },
+                  "roleAssignmentName": {
+                    "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                  },
+                  "aiFoundryName": {
+                    "value": "[variables('existingAIFoundryName')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1001648557732946394"
+                    }
+                  },
+                  "parameters": {
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID to assign the role to."
+                      }
+                    },
+                    "roleDefinitionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the role definition to assign."
+                      }
+                    },
+                    "roleAssignmentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "A unique name for the role assignment."
+                      }
+                    },
+                    "principalType": {
+                      "type": "string",
+                      "defaultValue": "ServicePrincipal",
+                      "allowedValues": [
+                        "ServicePrincipal",
+                        "User",
+                        "Group"
+                      ],
+                      "metadata": {
+                        "description": "The principal type of the identity being assigned."
+                      }
+                    },
+                    "targetResourceType": {
+                      "type": "string",
+                      "defaultValue": "AIServices",
+                      "allowedValues": [
+                        "AIServices",
+                        "ContainerRegistry"
+                      ],
+                      "metadata": {
+                        "description": "The type of target resource to scope the role assignment to."
+                      }
+                    },
+                    "aiFoundryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target AI Services (Cognitive Services) account. Required when targetResourceType is AIServices."
+                      }
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    },
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    }
+                  ]
+                }
+              }
+            },
+            {
+              "copy": {
+                "name": "acrPullAssignmentsExisting",
+                "count": "[length(parameters('acrPullPrincipals'))]"
+              },
+              "condition": "[and(parameters('useExistingContainerRegistry'), not(empty(parameters('acrPullPrincipals')[copyIndex()].principalId)))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('acrPull-{0}', uniqueString(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId)), 64)]",
+              "subscriptionId": "[variables('containerRegistrySubscription')]",
+              "resourceGroup": "[variables('containerRegistryResourceGroup')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "targetResourceType": {
+                    "value": "ContainerRegistry"
+                  },
+                  "containerRegistryName": {
+                    "value": "[variables('containerRegistryName')]"
+                  },
+                  "principalId": {
+                    "value": "[parameters('acrPullPrincipals')[copyIndex()].principalId]"
+                  },
+                  "principalType": {
+                    "value": "[parameters('acrPullPrincipals')[copyIndex()].principalType]"
+                  },
+                  "roleDefinitionId": {
+                    "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').acrPull)]"
+                  },
+                  "roleAssignmentName": {
+                    "value": "[guid(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId, variables('roleDefinitions').acrPull)]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1001648557732946394"
+                    }
+                  },
+                  "parameters": {
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID to assign the role to."
+                      }
+                    },
+                    "roleDefinitionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the role definition to assign."
+                      }
+                    },
+                    "roleAssignmentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "A unique name for the role assignment."
+                      }
+                    },
+                    "principalType": {
+                      "type": "string",
+                      "defaultValue": "ServicePrincipal",
+                      "allowedValues": [
+                        "ServicePrincipal",
+                        "User",
+                        "Group"
+                      ],
+                      "metadata": {
+                        "description": "The principal type of the identity being assigned."
+                      }
+                    },
+                    "targetResourceType": {
+                      "type": "string",
+                      "defaultValue": "AIServices",
+                      "allowedValues": [
+                        "AIServices",
+                        "ContainerRegistry"
+                      ],
+                      "metadata": {
+                        "description": "The type of target resource to scope the role assignment to."
+                      }
+                    },
+                    "aiFoundryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target AI Services (Cognitive Services) account. Required when targetResourceType is AIServices."
+                      }
+                    },
+                    "containerRegistryName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    },
+                    {
+                      "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                      "name": "[parameters('roleAssignmentName')]",
+                      "properties": {
+                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                        "principalId": "[parameters('principalId')]",
+                        "principalType": "[parameters('principalType')]"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64))]",
+        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64))]"
+      ]
+    }
+  ],
+  "outputs": {
+    "AZURE_OPENAI_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure OpenAI endpoint URL."
+      },
+      "value": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value)]"
+    },
+    "AZURE_SEARCH_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure AI Search endpoint URL."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value]"
+    },
+    "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Content Understanding endpoint URL."
+      },
+      "value": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.azureOpenAiCuEndpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.azureOpenAiCuEndpoint.value)]"
+    },
+    "AZURE_STORAGE_ACCOUNT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Storage account name."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]"
+    },
+    "AZURE_SQL_SERVER": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure SQL Server FQDN."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.serverFqdn.value]"
+    },
+    "AZURE_SQL_DATABASE": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure SQL Database name."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.databaseName.value]"
+    },
+    "API_APP_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend API application (and SQL contained user) name."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]"
+    },
+    "AZURE_API_PRINCIPAL_ID": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend API system-assigned managed identity principal ID."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]"
+    },
+    "AZURE_COSMOS_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Cosmos DB endpoint."
+      },
+      "value": "[if(parameters('deployCosmos'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value, '')]"
+    },
+    "AZURE_AI_AGENT_ENDPOINT": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure AI Agent endpoint URL."
+      },
+      "value": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectEndpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectEndpoint.value)]"
+    },
+    "API_APP_URL": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend API application URL."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]"
+    },
+    "WEB_APP_URL": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend web application URL."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]"
+    },
+    "SERVICE_BACKEND_URI": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend service URI (used by azd)."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]"
+    },
+    "SERVICE_FRONTEND_URI": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend service URI (used by azd)."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]"
+    },
+    "AZURE_AI_SEARCH_CONNECTION_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "AI Search connection name in AI Foundry."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.connectionName.value]"
+    },
+    "ACR_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Container Registry name."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]"
+    },
+    "ACR_LOGIN_SERVER": {
+      "type": "string",
+      "metadata": {
+        "description": "Azure Container Registry login server URL."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.loginServer.value]"
+    },
+    "BACKEND_CONTAINER_IMAGE_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend container image repository name to build and push to ACR."
+      },
+      "value": "[parameters('backendContainerImageName')]"
+    },
+    "BACKEND_CONTAINER_IMAGE_TAG": {
+      "type": "string",
+      "metadata": {
+        "description": "Backend container image tag to build and push to ACR."
+      },
+      "value": "[parameters('backendContainerImageTag')]"
+    },
+    "FRONTEND_CONTAINER_IMAGE_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend container image repository name to build and push to ACR."
+      },
+      "value": "[parameters('frontendContainerImageName')]"
+    },
+    "FRONTEND_CONTAINER_IMAGE_TAG": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend container image tag to build and push to ACR."
+      },
+      "value": "[parameters('frontendContainerImageTag')]"
+    },
+    "FRONTEND_APP_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Frontend web application (App Service) name."
+      },
+      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]"
+    },
+    "RESOURCE_GROUP_NAME": {
+      "type": "string",
+      "metadata": {
+        "description": "Resource group name."
+      },
+      "value": "[resourceGroup().name]"
+    },
+    "SOLUTION_SUFFIX": {
+      "type": "string",
+      "metadata": {
+        "description": "Solution resource token suffix used in resource names."
+      },
+      "value": "[variables('solutionSuffix')]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/infra/bicep/modules/ai/ai-foundry-connection.bicep b/infra/bicep/modules/ai/ai-foundry-connection.bicep
new file mode 100644
index 000000000..6649b5f74
--- /dev/null
+++ b/infra/bicep/modules/ai/ai-foundry-connection.bicep
@@ -0,0 +1,88 @@
+// ============================================================================
+// Module: AI Foundry Project Connection (Single) — Vanilla Bicep
+// Description: Creates a single connection on an AI Foundry project.
+//              Generic, reusable — call once per connection type from main.bicep.
+//              Supports any connection category (CognitiveSearch, AzureBlob,
+//              AppInsights, RemoteTool, etc.) via parameterized properties.
+// ============================================================================
+
+targetScope = 'resourceGroup'
+
+@description('Required. Name of the parent AI Services account.')
+param aiServicesAccountName string
+
+@description('Required. Name of the AI Foundry project.')
+param projectName string
+
+@description('Required. Solution name suffix used to generate the connection name.')
+param solutionName string
+
+@description('Optional. Connection name. Defaults to lowercase category with solution suffix.')
+param connectionName string = toLower('${category}-connection-${solutionName}')
+
+@description('Required. Connection category (e.g., CognitiveSearch, AzureBlob, AppInsights, RemoteTool).')
+param category string
+
+@description('Required. Connection target (URL or resource ID).')
+param target string
+
+@description('Required. Authentication type (e.g., AAD, ApiKey, ProjectManagedIdentity).')
+param authType string
+
+@description('Optional. Whether the connection is shared to all project users.')
+param isSharedToAll bool = true
+
+@description('Optional. Whether this is the default connection for its category.')
+param isDefault bool = false
+
+@description('Optional. Connection metadata object.')
+param metadata object = {}
+
+@description('Optional. Whether to use workspace-managed identity for authentication.')
+param useWorkspaceManagedIdentity bool = false
+
+@secure()
+@description('Optional. Credentials key (for ApiKey auth type).')
+param credentialsKey string = ''
+
+// ============================================================================
+// Existing Resource References
+// ============================================================================
+resource aiServicesAccount 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = {
+  name: aiServicesAccountName
+}
+
+resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-12-01' existing = {
+  parent: aiServicesAccount
+  name: projectName
+}
+
+// ============================================================================
+// Connection
+// ============================================================================
+var baseProperties = {
+  category: category
+  target: target
+  authType: authType
+  isSharedToAll: isSharedToAll
+  metadata: metadata
+  useWorkspaceManagedIdentity: useWorkspaceManagedIdentity
+}
+
+var optionalDefault = isDefault ? { isDefault: true } : {}
+var optionalCredentials = !empty(credentialsKey) ? { credentials: { key: credentialsKey } } : {}
+
+resource connection 'Microsoft.CognitiveServices/accounts/projects/connections@2025-12-01' = {
+  parent: aiProject
+  name: connectionName
+  properties: any(union(baseProperties, optionalDefault, optionalCredentials))
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Connection name.')
+output connectionName string = connection.name
+
+@description('Connection resource ID.')
+output connectionId string = connection.id
diff --git a/infra/bicep/modules/ai/ai-foundry-model-deployment.bicep b/infra/bicep/modules/ai/ai-foundry-model-deployment.bicep
new file mode 100644
index 000000000..4ed69a72c
--- /dev/null
+++ b/infra/bicep/modules/ai/ai-foundry-model-deployment.bicep
@@ -0,0 +1,66 @@
+// ============================================================================
+// Module: Model Deployment — Vanilla Bicep
+// Description: Deploys a single AI model to an existing AI Services account.
+//              Called repetitively from main.bicep for each model in the array.
+//              Generic, reusable across GSAs.
+// ============================================================================
+
+targetScope = 'resourceGroup'
+
+@description('Required. Name of the parent AI Services account.')
+param aiServicesAccountName string
+
+@description('Required. Name for this model deployment.')
+param deploymentName string
+
+@description('Optional. Model format (e.g., OpenAI).')
+param modelFormat string = 'OpenAI'
+
+@description('Required. Model name (e.g., gpt-4o, text-embedding-ada-002).')
+param modelName string
+
+@description('Optional. Model version. Empty string means latest.')
+param modelVersion string = ''
+
+@description('Optional. RAI policy name.')
+param raiPolicyName string = 'Microsoft.Default'
+
+@description('Required. SKU name (e.g., Standard, GlobalStandard).')
+param skuName string
+
+@description('Required. SKU capacity (tokens per minute in thousands).')
+param skuCapacity int
+
+// ============================================================================
+// Model Deployment
+// ============================================================================
+resource aiServicesAccount 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = {
+  name: aiServicesAccountName
+}
+
+resource modelDeployment 'Microsoft.CognitiveServices/accounts/deployments@2025-12-01' = {
+  parent: aiServicesAccount
+  name: deploymentName
+  properties: {
+    model: {
+      format: modelFormat
+      name: modelName
+      version: !empty(modelVersion) ? modelVersion : null
+    }
+    raiPolicyName: raiPolicyName
+  }
+  sku: {
+    name: skuName
+    capacity: skuCapacity
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+
+@description('Name of the deployed model.')
+output name string = modelDeployment.name
+
+@description('Resource ID of the model deployment.')
+output resourceId string = modelDeployment.id
diff --git a/infra/bicep/modules/ai/ai-foundry-project.bicep b/infra/bicep/modules/ai/ai-foundry-project.bicep
new file mode 100644
index 000000000..6eea3c122
--- /dev/null
+++ b/infra/bicep/modules/ai/ai-foundry-project.bicep
@@ -0,0 +1,112 @@
+// ============================================================================
+// Module: AI Foundry Project (Account + Project) — Vanilla Bicep
+// Description: Creates an Azure AI Services account and AI Foundry project.
+//              Generic, reusable across GSAs — no app-specific parameters.
+// ============================================================================
+
+targetScope = 'resourceGroup'
+
+@description('Required. Solution name suffix used to generate resource names.')
+param solutionName string
+
+@description('Optional. Override name for the AI Services account. Defaults to aif-{solutionName}.')
+param name string = 'aif-${solutionName}'
+
+@description('Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}.')
+param projectName string = 'proj-${solutionName}'
+
+@description('Required. Azure region for the resources.')
+param location string
+
+@description('Optional. Tags to apply to resources.')
+param tags object = {}
+
+@description('Optional. SKU name for the AI Services account.')
+param skuName string = 'S0'
+
+@description('Optional. Whether to disable local (key-based) authentication.')
+param disableLocalAuth bool = true
+
+@description('Optional. Whether to allow project management (AI Foundry hub).')
+param allowProjectManagement bool = true
+
+@description('Optional. Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+@description('Optional. Managed identity configuration for the resources.')
+param identity object = { type: 'SystemAssigned' }
+
+@description('Optional. Network ACLs default action.')
+@allowed(['Allow', 'Deny'])
+param networkAclsDefaultAction string = 'Allow'
+
+// ============================================================================
+// AI Services Account
+// ============================================================================
+resource aiServices 'Microsoft.CognitiveServices/accounts@2025-12-01' = {
+  name: name
+  location: location
+  tags: tags
+  sku: {
+    name: skuName
+  }
+  kind: 'AIServices'
+  identity: identity
+  properties: {
+    allowProjectManagement: allowProjectManagement
+    customSubDomainName: name
+    networkAcls: {
+      defaultAction: networkAclsDefaultAction
+      virtualNetworkRules: []
+      ipRules: []
+    }
+    publicNetworkAccess: publicNetworkAccess
+    disableLocalAuth: disableLocalAuth
+  }
+}
+
+// ============================================================================
+// AI Foundry Project
+// ============================================================================
+resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-12-01' = {
+  parent: aiServices
+  name: projectName
+  location: location
+  kind: 'AIServices'
+  identity: identity
+  properties: {}
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+
+@description('Resource ID of the AI Services account.')
+output resourceId string = aiServices.id
+
+@description('Name of the AI Services account.')
+output name string = aiServices.name
+
+@description('Endpoint of the AI Services account (OpenAI Language Model Instance API).')
+output endpoint string = aiServices.properties.endpoints['OpenAI Language Model Instance API']
+
+@description('Endpoint of the AI Services account (Cognitive Services).')
+output cognitiveServicesEndpoint string = aiServices.properties.endpoint
+
+@description('Azure OpenAI Content Understanding endpoint URL.')
+output azureOpenAiCuEndpoint string = aiServices.properties.endpoints['Content Understanding']
+
+@description('System-assigned identity principal ID of the AI Services account.')
+output principalId string = aiServices.identity.principalId
+
+@description('Resource ID of the AI Foundry project.')
+output projectResourceId string = aiProject.id
+
+@description('Name of the AI Foundry project.')
+output projectName string = aiProject.name
+
+@description('AI Foundry project endpoint.')
+output projectEndpoint string = aiProject.properties.endpoints['AI Foundry API']
+
+@description('System-assigned identity principal ID of the project.')
+output projectIdentityPrincipalId string = aiProject.identity.principalId
diff --git a/infra/bicep/modules/ai/ai-search-identity.bicep b/infra/bicep/modules/ai/ai-search-identity.bicep
new file mode 100644
index 000000000..b85729b18
--- /dev/null
+++ b/infra/bicep/modules/ai/ai-search-identity.bicep
@@ -0,0 +1,71 @@
+// ============================================================================
+// Module: AI Search Identity Update
+// Description: Separate deployment that enables managed identity and applies
+//              full configuration on an existing AI Search service.
+//              Called by ai-search.bicep as Step 2 of the two-step pattern.
+// ============================================================================
+
+targetScope = 'resourceGroup'
+
+@description('The name of the existing AI Search service.')
+param name string
+
+@description('The Azure region of the search service.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('SKU name for the search service.')
+param skuName string = 'basic'
+
+@description('Number of replicas.')
+param replicaCount int = 1
+
+@description('Number of partitions.')
+param partitionCount int = 1
+
+@description('Hosting mode.')
+@allowed(['Default', 'HighDensity'])
+param hostingMode string = 'Default'
+
+@description('Semantic search tier.')
+param semanticSearch string = 'free'
+
+@description('Whether to disable local authentication.')
+param disableLocalAuth bool = true
+
+@description('Optional. Authentication options for the search service.')
+param authOptions object = {}
+
+@description('Optional. Network rule set for the search service.')
+param networkRuleSet object = {}
+
+@description('Optional. Managed identity configuration for the resource.')
+param identity object = { type: 'SystemAssigned' }
+
+@description('Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+resource searchServiceUpdate 'Microsoft.Search/searchServices@2025-05-01' = {
+  name: name
+  location: location
+  tags: tags
+  sku: {
+    name: skuName
+  }
+  identity: identity
+  properties: {
+    replicaCount: replicaCount
+    partitionCount: partitionCount
+    hostingMode: hostingMode
+    semanticSearch: semanticSearch
+    disableLocalAuth: disableLocalAuth
+    publicNetworkAccess: publicNetworkAccess
+    authOptions: !empty(authOptions) ? authOptions : null
+    networkRuleSet: !empty(networkRuleSet) ? networkRuleSet : null
+  }
+}
+
+@description('The principal ID of the AI Search system-assigned managed identity.')
+output systemAssignedMIPrincipalId string = searchServiceUpdate.identity.principalId
diff --git a/infra/bicep/modules/ai/ai-search.bicep b/infra/bicep/modules/ai/ai-search.bicep
new file mode 100644
index 000000000..84512c0cb
--- /dev/null
+++ b/infra/bicep/modules/ai/ai-search.bicep
@@ -0,0 +1,105 @@
+// ============================================================================
+// Module: AI Search
+// Description: Deploys Azure AI Search with a two-step pattern:
+//   Step 1: Plain Bicep resource for fast initial creation (name, location, SKU)
+//   Step 2: Separate module deployment to enable managed identity & full config
+// This reduces deployment time by making the resource available immediately
+// while identity enablement proceeds as a separate ARM deployment.
+// ============================================================================
+
+targetScope = 'resourceGroup'
+
+@description('Solution name suffix used to derive the resource name.')
+@minLength(3)
+param solutionName string
+
+@description('Optional. Override name for the search service. Defaults to srch-{solutionName}.')
+param name string = 'srch-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('SKU name for the search service.')
+@allowed(['free', 'basic', 'standard', 'standard2', 'standard3', 'storage_optimized_l1', 'storage_optimized_l2'])
+param skuName string = 'basic'
+
+@description('Number of replicas.')
+param replicaCount int = 1
+
+@description('Number of partitions.')
+param partitionCount int = 1
+
+@description('Hosting mode.')
+@allowed(['Default', 'HighDensity'])
+param hostingMode string = 'Default'
+
+@description('Semantic search tier.')
+@allowed(['disabled', 'free', 'standard'])
+param semanticSearch string = 'free'
+
+@description('Whether to disable local authentication.')
+param disableLocalAuth bool = true
+
+@description('Optional. Authentication options for the search service.')
+param authOptions object = {}
+
+@description('Optional. Network rule set for the search service.')
+param networkRuleSet object = {}
+
+@description('Optional. Managed identity configuration for the resource.')
+param identity object = { type: 'SystemAssigned' }
+
+@description('Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+// ============================================================================
+// Step 1: Initial resource creation (fast — no identity)
+// ============================================================================
+resource aiSearch 'Microsoft.Search/searchServices@2025-05-01' = {
+  name: name
+  location: location
+  sku: {
+    name: skuName
+  }
+}
+
+// ============================================================================
+// Step 2: Separate deployment — enables identity & full configuration
+// ============================================================================
+module searchServiceUpdate 'ai-search-identity.bicep' = {
+  name: 'searchServiceUpdate'
+  params: {
+    name: aiSearch.name
+    location: location
+    tags: tags
+    skuName: skuName
+    replicaCount: replicaCount
+    partitionCount: partitionCount
+    hostingMode: hostingMode
+    semanticSearch: semanticSearch
+    disableLocalAuth: disableLocalAuth
+    authOptions: authOptions
+    networkRuleSet: networkRuleSet
+    identity: identity
+    publicNetworkAccess: publicNetworkAccess
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+
+@description('Resource ID of the AI Search service.')
+output resourceId string = aiSearch.id
+
+@description('Name of the AI Search service.')
+output name string = aiSearch.name
+
+@description('Endpoint URL of the AI Search service.')
+output endpoint string = 'https://${aiSearch.name}.search.windows.net'
+
+@description('System-assigned identity principal ID.')
+output identityPrincipalId string = searchServiceUpdate.outputs.systemAssignedMIPrincipalId
diff --git a/infra/bicep/modules/ai/existing-project-setup.bicep b/infra/bicep/modules/ai/existing-project-setup.bicep
new file mode 100644
index 000000000..df0acdc5e
--- /dev/null
+++ b/infra/bicep/modules/ai/existing-project-setup.bicep
@@ -0,0 +1,60 @@
+// ============================================================================
+// Module: Existing AI Foundry Project Reference — Vanilla Bicep
+// Description: References an existing AI Services account and project to
+//              retrieve their identities. No deployments, no connections.
+//              Use generic ai-foundry-connection and ai-foundry-model-deployment
+//              modules for those concerns.
+// ============================================================================
+
+@description('Required. The name of the existing Cognitive Services account.')
+param name string
+
+@description('Required. The name of the existing AI project.')
+param projectName string
+
+// ============================================================================
+// Existing Resource References
+// ============================================================================
+
+resource aiServices 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = {
+  name: name
+}
+
+resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-12-01' existing = {
+  parent: aiServices
+  name: projectName
+}
+
+// ============================================================================
+// Outputs (aligned with ai-foundry-project.bicep)
+// ============================================================================
+
+@description('Resource ID of the AI Services account.')
+output resourceId string = aiServices.id
+
+@description('Name of the AI Services account.')
+output name string = aiServices.name
+
+@description('Endpoint of the AI Services account (OpenAI Language Model Instance API).')
+output endpoint string = aiServices.properties.endpoints['OpenAI Language Model Instance API']
+
+@description('Endpoint of the AI Services account (Cognitive Services).')
+output cognitiveServicesEndpoint string = aiServices.properties.endpoint
+
+@description('Azure OpenAI Content Understanding endpoint URL.')
+output azureOpenAiCuEndpoint string = aiServices.properties.endpoints['Content Understanding']
+
+@description('System-assigned identity principal ID of the AI Services account (empty if none).')
+output principalId string = contains(aiServices, 'identity') && contains(aiServices.identity, 'principalId') ? aiServices.identity.principalId : ''
+
+@description('Resource ID of the AI Foundry project.')
+output projectResourceId string = aiProject.id
+
+@description('Name of the AI Foundry project.')
+output projectName string = aiProject.name
+
+@description('AI Foundry project endpoint.')
+output projectEndpoint string = aiProject.properties.endpoints['AI Foundry API']
+
+@description('System-assigned identity principal ID of the project (empty if none).')
+output projectIdentityPrincipalId string = contains(aiProject, 'identity') && contains(aiProject.identity, 'principalId') ? aiProject.identity.principalId : ''
diff --git a/infra/bicep/modules/compute/app-service-plan.bicep b/infra/bicep/modules/compute/app-service-plan.bicep
new file mode 100644
index 000000000..d8ad7f9fa
--- /dev/null
+++ b/infra/bicep/modules/compute/app-service-plan.bicep
@@ -0,0 +1,64 @@
+// ============================================================================
+// Module: App Service Plan
+// Description: Creates an Azure App Service Plan
+// API: Microsoft.Web/serverfarms@2025-05-01
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the App Service Plan.')
+param name string = 'asp-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('SKU name for the App Service Plan.')
+@allowed(['F1', 'D1', 'B1', 'B2', 'B3', 'S1', 'S2', 'S3', 'P1', 'P2', 'P3', 'P4', 'P0v3', 'P0v4', 'P1v3', 'P1v4', 'P2v3', 'P3v3'])
+param skuName string = 'B2'
+
+@description('Whether the plan is Linux-based.')
+param reserved bool = true
+
+@description('Kind of the App Service Plan.')
+param kind string = 'linux'
+
+@description('Number of instances (workers).')
+param skuCapacity int = 1
+
+@description('Enable zone redundancy. Requires Premium SKU (P1v3+).')
+param zoneRedundant bool = false
+
+@description('Optional. Managed identity configuration for the resource.')
+param identity object = { type: 'SystemAssigned' }
+
+// ============================================================================
+// Resource Deployment
+// ============================================================================
+resource appServicePlan 'Microsoft.Web/serverfarms@2025-05-01' = {
+  name: name
+  location: location
+  tags: tags
+  kind: kind
+  sku: {
+    name: skuName
+    capacity: skuCapacity
+  }
+  properties: {
+    reserved: reserved
+    zoneRedundant: zoneRedundant
+  }
+  identity: identity
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the App Service Plan.')
+output resourceId string = appServicePlan.id
+
+@description('Name of the App Service Plan.')
+output name string = appServicePlan.name
diff --git a/infra/bicep/modules/compute/app-service.bicep b/infra/bicep/modules/compute/app-service.bicep
new file mode 100644
index 000000000..d0b804e09
--- /dev/null
+++ b/infra/bicep/modules/compute/app-service.bicep
@@ -0,0 +1,139 @@
+// ============================================================================
+// Module: App Service
+// Description: Creates an Azure App Service (Web App)
+// API: Microsoft.Web/sites@2025-05-01
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the App Service.')
+param name string = solutionName
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Resource ID of the App Service Plan.')
+param serverFarmResourceId string
+
+@description('Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag).')
+param linuxFxVersion string
+
+@description('Application settings key-value pairs.')
+param appSettings object = {}
+
+@description('Whether to enable Always On.')
+param alwaysOn bool = true
+
+@description('Optional. Health check path for the app.')
+param healthCheckPath string = ''
+
+@description('Optional. Whether to enable WebSockets.')
+param webSocketsEnabled bool = false
+
+@description('Optional. Command line for the application.')
+param appCommandLine string = ''
+
+@description('Required. Type of site to deploy.')
+@allowed([
+  'functionapp' // function app windows os
+  'functionapp,linux' // function app linux os
+  'functionapp,workflowapp' // logic app workflow
+  'functionapp,workflowapp,linux' // logic app docker container
+  'functionapp,linux,container' // function app linux container
+  'functionapp,linux,container,azurecontainerapps' // function app linux container azure container apps
+  'app,linux' // linux web app
+  'app' // windows web app
+  'linux,api' // linux api app
+  'api' // windows api app
+  'app,linux,container' // linux container app
+  'app,container,windows' // windows container app
+])
+param kind string = 'app,linux'
+
+@description('Public network access setting.')
+param publicNetworkAccess string = 'Enabled'
+
+@description('Optional. Managed identity configuration for the resource.')
+param identity object = { type: 'SystemAssigned' }
+
+@description('Optional. Whether to use managed identity credentials for ACR authentication.')
+param acrUseManagedIdentityCreds bool = false
+
+// ============================================================================
+// Resource Deployment
+// ============================================================================
+resource appService 'Microsoft.Web/sites@2025-05-01' = {
+  name: name
+  location: location
+  tags: tags
+  kind: kind
+  identity: identity
+  properties: {
+    serverFarmId: serverFarmResourceId
+    publicNetworkAccess: publicNetworkAccess
+    siteConfig: {
+      alwaysOn: alwaysOn
+      ftpsState: 'Disabled'
+      linuxFxVersion: linuxFxVersion
+      minTlsVersion: '1.2'
+      healthCheckPath: !empty(healthCheckPath) ? healthCheckPath : null
+      webSocketsEnabled: webSocketsEnabled
+      appCommandLine: appCommandLine
+      acrUseManagedIdentityCreds: acrUseManagedIdentityCreds
+    }
+    endToEndEncryptionEnabled: true
+  }
+
+  resource basicPublishingCredentialsPoliciesFtp 'basicPublishingCredentialsPolicies' = {
+    name: 'ftp'
+    properties: {
+      allow: false
+    }
+  }
+  resource basicPublishingCredentialsPoliciesScm 'basicPublishingCredentialsPolicies' = {
+    name: 'scm'
+    properties: {
+      allow: false
+    }
+  }
+}
+
+resource configAppSettings 'Microsoft.Web/sites/config@2025-05-01' = {
+  name: 'appsettings'
+  parent: appService
+  properties: appSettings
+}
+
+resource configLogs 'Microsoft.Web/sites/config@2025-05-01' = {
+  name: 'logs'
+  parent: appService
+  properties: {
+    applicationLogs: { fileSystem: { level: 'Verbose' } }
+    detailedErrorMessages: { enabled: true }
+    failedRequestsTracing: { enabled: true }
+    httpLogs: { fileSystem: { enabled: true, retentionInDays: 1, retentionInMb: 35 } }
+  }
+  dependsOn: [configAppSettings]
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the App Service.')
+output resourceId string = appService.id
+
+@description('Name of the App Service.')
+output name string = appService.name
+
+@description('Default hostname of the App Service.')
+output defaultHostname string = appService.properties.defaultHostName
+
+@description('URL of the App Service.')
+output appUrl string = 'https://${appService.properties.defaultHostName}'
+
+@description('System-assigned identity principal ID.')
+output identityPrincipalId string = appService.identity.principalId
diff --git a/infra/bicep/modules/compute/container-registry.bicep b/infra/bicep/modules/compute/container-registry.bicep
new file mode 100644
index 000000000..537df2c61
--- /dev/null
+++ b/infra/bicep/modules/compute/container-registry.bicep
@@ -0,0 +1,84 @@
+// ============================================================================
+// Module: Azure Container Registry
+// Description: Creates an Azure Container Registry
+// API: Microsoft.ContainerRegistry/registries@2025-04-01
+// ============================================================================
+
+@description('Solution name used for naming convention.')
+param solutionName string
+
+@description('Name of the container registry.')
+param name string = replace('cr${solutionName}', '-', '')
+
+@description('Azure region for deployment.')
+param location string
+
+@description('Resource tags.')
+param tags object = {}
+
+@description('SKU for the container registry.')
+@allowed(['Basic', 'Standard', 'Premium'])
+param sku string = 'Standard'
+
+@description('Public network access setting.')
+@allowed(['Enabled', 'Disabled'])
+param publicNetworkAccess string = 'Enabled'
+
+@description('Export policy status.')
+param exportPolicyStatus string = 'enabled'
+
+@description('Retention policy status.')
+param retentionPolicyStatus string = 'disabled'
+
+@description('Optional. Managed identity configuration for the resource.')
+param identity object = { type: 'SystemAssigned' }
+
+// ============================================================================
+// Resource Deployment
+// ============================================================================
+resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' = {
+  name: name
+  location: location
+  tags: tags
+  sku: {
+    name: sku
+  }
+  identity: identity
+  properties: {
+    adminUserEnabled: false
+    publicNetworkAccess: publicNetworkAccess
+    dataEndpointEnabled: false
+    networkRuleBypassOptions: 'AzureServices'
+    policies: {
+      // Must be 'enabled' for App Service managed-identity image pulls; otherwise ACR token
+      // retrieval fails (ACRTokenRetrievalFailure) during container startup.
+      azureADAuthenticationAsArmPolicy: {
+        status: 'enabled'
+      }
+      exportPolicy: {
+        status: exportPolicyStatus
+      }
+      retentionPolicy: {
+        status: retentionPolicyStatus
+        days: 7
+      }
+      trustPolicy: {
+        status: 'disabled'
+        type: 'Notary'
+      }
+    }
+    zoneRedundancy: 'Disabled'
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('The name of the container registry.')
+output name string = containerRegistry.name
+
+@description('The login server URL.')
+output loginServer string = containerRegistry.properties.loginServer
+
+@description('The resource ID of the container registry.')
+output resourceId string = containerRegistry.id
diff --git a/infra/bicep/modules/data/cosmos-db-nosql.bicep b/infra/bicep/modules/data/cosmos-db-nosql.bicep
new file mode 100644
index 000000000..f9ef6c666
--- /dev/null
+++ b/infra/bicep/modules/data/cosmos-db-nosql.bicep
@@ -0,0 +1,97 @@
+// ============================================================================
+// Module: Cosmos DB
+// Description: Creates an Azure Cosmos DB (NoSQL) account with database/container
+// API: Microsoft.DocumentDB/databaseAccounts@2025-10-15
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the Cosmos DB account.')
+param name string = 'cosmos-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Database name.')
+param databaseName string = 'db_conversation_history'
+
+@description('Container definitions.')
+param containers array = [
+  {
+    name: 'conversations'
+    partitionKeyPath: '/userId'
+  }
+]
+
+@description('Optional. Managed identity configuration for the resource.')
+param identity object = { type: 'SystemAssigned' }
+
+// ============================================================================
+// Resource Deployment
+// ============================================================================
+resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {
+  name: name
+  location: location
+  tags: tags
+  kind: 'GlobalDocumentDB'
+  identity: identity
+  properties: {
+    consistencyPolicy: { defaultConsistencyLevel: 'Session' }
+    locations: [
+      {
+        locationName: location
+        failoverPriority: 0
+        isZoneRedundant: false
+      }
+    ]
+    databaseAccountOfferType: 'Standard'
+    enableAutomaticFailover: false
+    enableMultipleWriteLocations: false
+    disableLocalAuth: true
+    capabilities: [ { name: 'EnableServerless' } ]
+  }
+}
+
+resource database 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2025-10-15' = {
+  parent: cosmos
+  name: databaseName
+  properties: {
+    resource: { id: databaseName }
+  }
+}
+
+resource containersRes 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-10-15' = [for container in containers: {
+  parent: database
+  name: container.name
+  properties: {
+    resource: {
+      id: container.name
+      partitionKey: {
+        paths: [container.partitionKeyPath]
+        kind: 'Hash'
+      }
+    }
+  }
+}]
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the Cosmos DB account.')
+output resourceId string = cosmos.id
+
+@description('Name of the Cosmos DB account.')
+output name string = cosmos.name
+
+@description('Endpoint of the Cosmos DB account.')
+output endpoint string = 'https://${name}.documents.azure.com:443/'
+
+@description('Database name.')
+output databaseName string = databaseName
+
+@description('Container name (first container).')
+output containerName string = containers[0].name
diff --git a/infra/bicep/modules/data/sql-database.bicep b/infra/bicep/modules/data/sql-database.bicep
new file mode 100644
index 000000000..a9bbf118f
--- /dev/null
+++ b/infra/bicep/modules/data/sql-database.bicep
@@ -0,0 +1,122 @@
+// ============================================================================
+// Module: SQL Database
+// Description: Creates an Azure SQL Server and Database
+// API: Microsoft.Sql/servers@2025-01-01
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the SQL Server.')
+param name string = 'sql-${solutionName}'
+
+@description('Name of the SQL Database.')
+param databaseName string = 'sqldb-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Principal ID of the deployer for admin access.')
+param deployerPrincipalId string
+
+@description('Principal name of the deployer for admin access.')
+param deployerPrincipalName string
+
+@description('SKU name for the database.')
+param skuName string = 'GP_S_Gen5'
+
+@description('SKU tier for the database.')
+param skuTier string = 'GeneralPurpose'
+
+@description('SKU family.')
+param skuFamily string = 'Gen5'
+
+@description('vCore capacity.')
+param skuCapacity int = 2
+
+@description('Auto-pause delay in minutes.')
+param autoPauseDelay int = 60
+
+@description('Minimum capacity (vCores).')
+param minCapacity int = 1
+
+@description('Optional. Managed identity configuration for the resource.')
+param identity object = { type: 'SystemAssigned' }
+
+// ============================================================================
+// Resource Deployment
+// ============================================================================
+resource sqlServer 'Microsoft.Sql/servers@2025-01-01' = {
+  name: name
+  location: location
+  tags: tags
+  identity: identity
+  properties: {
+    publicNetworkAccess: 'Enabled'
+    version: '12.0'
+    restrictOutboundNetworkAccess: 'Disabled'
+    minimalTlsVersion: '1.2'
+    administrators: {
+      login: deployerPrincipalName
+      sid: deployerPrincipalId
+      tenantId: subscription().tenantId
+      administratorType: 'ActiveDirectory'
+      azureADOnlyAuthentication: true
+    }
+  }
+}
+
+resource firewallRule 'Microsoft.Sql/servers/firewallRules@2025-01-01' = {
+  name: 'AllowSpecificRange'
+  parent: sqlServer
+  properties: {
+    startIpAddress: '0.0.0.0'
+    endIpAddress: '255.255.255.255'
+  }
+}
+
+resource AllowAllAzureServicesAndResourcesWithinAzureIps 'Microsoft.Sql/servers/firewallRules@2025-01-01' = {
+  name: 'AllowAllAzureServicesAndResourcesWithinAzureIps'
+  parent: sqlServer
+  properties: {
+    startIpAddress: '0.0.0.0'
+    endIpAddress: '0.0.0.0'
+  }
+}
+
+resource sqlDB 'Microsoft.Sql/servers/databases@2025-01-01' = {
+  parent: sqlServer
+  name: databaseName
+  location: location
+  sku: {
+    name: skuName
+    tier: skuTier
+    family: skuFamily
+    capacity: skuCapacity
+  }
+  properties: {
+    collation: 'SQL_Latin1_General_CP1_CI_AS'
+    autoPauseDelay: autoPauseDelay
+    minCapacity: minCapacity
+    readScale: 'Disabled'
+    zoneRedundant: false
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Fully qualified domain name of the SQL Server.')
+output serverFqdn string = '${name}.database.windows.net'
+
+@description('Name of the SQL Database.')
+output databaseName string = databaseName
+
+@description('Resource ID of the SQL Server.')
+output serverResourceId string = sqlServer.id
+
+@description('Name of the SQL Server.')
+output name string = sqlServer.name
diff --git a/infra/bicep/modules/data/storage-account.bicep b/infra/bicep/modules/data/storage-account.bicep
new file mode 100644
index 000000000..bbd6a4210
--- /dev/null
+++ b/infra/bicep/modules/data/storage-account.bicep
@@ -0,0 +1,109 @@
+// ============================================================================
+// Module: Storage Account
+// Description: Creates an Azure Storage Account with blob container
+// API: Microsoft.Storage/storageAccounts@2025-08-01
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Name of the storage account.')
+param name string = take('st${toLower(replace(solutionName, '-', ''))}', 24)
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Storage account SKU.')
+param skuName string = 'Standard_LRS'
+
+@description('Storage account kind.')
+param kind string = 'StorageV2'
+
+@description('Access tier.')
+@allowed(['Hot', 'Cool'])
+param accessTier string = 'Hot'
+
+@description('Allow blob public access.')
+param allowBlobPublicAccess bool = false
+
+@description('Allow shared key access.')
+param allowSharedKeyAccess bool = true
+
+@description('Enable hierarchical namespace (Data Lake Storage Gen2).')
+param enableHierarchicalNamespace bool = false
+
+@description('Blob containers to create.')
+param containers array = [
+  {
+    name: 'default'
+    publicAccess: 'None'
+  }
+]
+
+@description('Optional. Managed identity configuration for the resource.')
+param identity object = { type: 'SystemAssigned' }
+
+// ============================================================================
+// Resource Deployment
+// ============================================================================
+resource storageAccount 'Microsoft.Storage/storageAccounts@2025-08-01' = {
+  name: name
+  location: location
+  tags: tags
+  kind: kind
+  sku: {
+    name: skuName
+  }
+  identity: identity
+  properties: {
+    accessTier: accessTier
+    allowBlobPublicAccess: allowBlobPublicAccess
+    allowSharedKeyAccess: allowSharedKeyAccess
+    minimumTlsVersion: 'TLS1_2'
+    supportsHttpsTrafficOnly: true
+    isHnsEnabled: enableHierarchicalNamespace
+    encryption: {
+      services: {
+        blob: {
+          enabled: true
+        }
+        file: {
+          enabled: true
+        }
+      }
+      keySource: 'Microsoft.Storage'
+      requireInfrastructureEncryption: true
+    }
+  }
+}
+
+resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2025-08-01' = {
+  parent: storageAccount
+  name: 'default'
+}
+
+resource blobContainers 'Microsoft.Storage/storageAccounts/blobServices/containers@2025-08-01' = [for container in containers: {
+  parent: blobService
+  name: container.name
+  properties: {
+    publicAccess: container.publicAccess
+  }
+}]
+
+// ============================================================================
+// Outputs
+// ============================================================================
+@description('Resource ID of the Storage Account.')
+output resourceId string = storageAccount.id
+
+@description('Name of the Storage Account.')
+output name string = storageAccount.name
+
+@description('Primary blob endpoint.')
+output blobEndpoint string = storageAccount.properties.primaryEndpoints.blob
+
+@description('All service endpoints.')
+output serviceEndpoints object = storageAccount.properties.primaryEndpoints
diff --git a/infra/bicep/modules/identity/cross-scope-role-assignment.bicep b/infra/bicep/modules/identity/cross-scope-role-assignment.bicep
new file mode 100644
index 000000000..57c4f9b8b
--- /dev/null
+++ b/infra/bicep/modules/identity/cross-scope-role-assignment.bicep
@@ -0,0 +1,58 @@
+// ============================================================================
+// cross-scope-role-assignment.bicep
+// Description: Reusable helper that creates a single role assignment scoped
+//              to an existing AI Services resource. Used for cross-resource-
+//              group RBAC where the AI Services lives in a different RG.
+// ============================================================================
+
+@description('The principal ID to assign the role to.')
+param principalId string
+
+@description('The resource ID of the role definition to assign.')
+param roleDefinitionId string
+
+@description('A unique name for the role assignment.')
+param roleAssignmentName string
+
+@description('The principal type of the identity being assigned.')
+@allowed(['ServicePrincipal', 'User', 'Group'])
+param principalType string = 'ServicePrincipal'
+
+@description('The type of target resource to scope the role assignment to.')
+@allowed(['AIServices', 'ContainerRegistry'])
+param targetResourceType string = 'AIServices'
+
+@description('Name of the target AI Services (Cognitive Services) account. Required when targetResourceType is AIServices.')
+param aiFoundryName string = ''
+
+@description('Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry.')
+param containerRegistryName string = ''
+
+// Reference the existing target resource in this resource group
+resource aiServices 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = if (targetResourceType == 'AIServices') {
+  name: aiFoundryName
+}
+
+resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' existing = if (targetResourceType == 'ContainerRegistry') {
+  name: containerRegistryName
+}
+
+resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (targetResourceType == 'AIServices') {
+  name: roleAssignmentName
+  scope: aiServices
+  properties: {
+    roleDefinitionId: roleDefinitionId
+    principalId: principalId
+    principalType: principalType
+  }
+}
+
+resource acrRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (targetResourceType == 'ContainerRegistry') {
+  name: roleAssignmentName
+  scope: containerRegistry
+  properties: {
+    roleDefinitionId: roleDefinitionId
+    principalId: principalId
+    principalType: principalType
+  }
+}
diff --git a/infra/bicep/modules/identity/role-assignments.bicep b/infra/bicep/modules/identity/role-assignments.bicep
new file mode 100644
index 000000000..f9be11be0
--- /dev/null
+++ b/infra/bicep/modules/identity/role-assignments.bicep
@@ -0,0 +1,444 @@
+// ============================================================================
+// Module: Role Assignments (centralized — all cross-service + data plane RBAC)
+// Description: RG-level, cross-service, and data-plane role assignments.
+//              One place to audit "who has access to what".
+// ============================================================================
+
+// ============================================================================
+// Parameters
+// ============================================================================
+
+@description('Solution name suffix for generating unique role assignment GUIDs.')
+param solutionName string = ''
+
+@description('Whether to use an existing AI project (true) or create new (false).')
+param useExistingAIProject bool = false
+
+@description('Resource ID of the existing AI project (for deriving AI Services name/sub/RG).')
+param existingFoundryProjectResourceId string = ''
+
+// --- Identity Principal IDs ---
+
+@description('Principal ID of the AI project identity (works for both new and existing projects).')
+param aiProjectPrincipalId string = ''
+
+@description('Principal ID of the AI Search identity.')
+param aiSearchPrincipalId string = ''
+
+@description('Principal ID of the backend App Service system-assigned identity (empty if not deployed).')
+param backendAppServicePrincipalId string = ''
+
+@description('Principal ID of the deploying user (for user access roles).')
+param deployerPrincipalId string = ''
+
+@description('Principal type of the deploying user.')
+@allowed(['User', 'ServicePrincipal'])
+param deployerPrincipalType string = 'User'
+
+// --- Resource References ---
+
+@description('Resource ID of the AI Foundry account (empty if not deployed — new project path).')
+param aiFoundryResourceId string = ''
+
+@description('Resource ID of the AI Search service (empty if not deployed).')
+param aiSearchResourceId string = ''
+
+@description('Resource ID of the Storage Account (empty if not deployed).')
+param storageAccountResourceId string = ''
+
+@description('Name of the Cosmos DB account (empty if not deployed).')
+param cosmosDbAccountName string = ''
+
+@description('Whether to use an existing container registry (true) or the one created in this deployment (false).')
+param useExistingContainerRegistry bool = false
+
+@description('Resource ID of the container registry to grant AcrPull on (for deriving name/sub/RG; empty = skip ACR role assignments).')
+param containerRegistryResourceId string = ''
+
+@description('Principals to grant AcrPull on the container registry (array of objects with principalId and principalType).')
+param acrPullPrincipals array = []
+
+// ============================================================================
+// Derived Variables
+// ============================================================================
+
+var existingAIFoundryName = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[8] : ''
+var existingAIFoundrySubscription = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[2] : subscription().subscriptionId
+var existingAIFoundryResourceGroup = useExistingAIProject ? split(existingFoundryProjectResourceId, '/')[4] : resourceGroup().name
+
+// Container registry — derive name, subscription, and resource group from the resource ID (new or existing).
+var containerRegistryName = empty(containerRegistryResourceId) ? '' : split(containerRegistryResourceId, '/')[8]
+var containerRegistrySubscription = empty(containerRegistryResourceId) ? subscription().subscriptionId : split(containerRegistryResourceId, '/')[2]
+var containerRegistryResourceGroup = empty(containerRegistryResourceId) ? resourceGroup().name : split(containerRegistryResourceId, '/')[4]
+
+// ============================================================================
+// Role Definitions
+// ============================================================================
+
+var roleDefinitions = {
+  azureAiUser: '53ca6127-db72-4b80-b1b0-d745d6d5456d' // Foundry User
+  cognitiveServicesUser: 'a97b65f3-24c7-4388-baec-2e87135dc908'
+  cognitiveServicesOpenAIUser: '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
+  azureAIDeveloper: '64702f94-c441-49e6-a78b-ef80e0188fee'
+  searchIndexDataReader: '1407120a-92aa-4202-b7e9-c0e197c71c8f'
+  searchIndexDataContributor: '8ebe5a00-799e-43f5-93ac-243d3dce84a7'
+  searchServiceContributor: '7ca78c08-252a-4471-8644-bb5ff32d4ba0'
+  storageBlobDataContributor: 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
+  storageBlobDataReader: '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1'
+  storageQueueDataContributor: '974c5e8b-45b9-4653-ba55-5f855dd0fb88'
+  acrPull: '7f951dda-4ed3-4680-a7ca-43fe172d538d'
+}
+
+// ============================================================================
+// Existing Resource References
+// ============================================================================
+
+resource aiFoundryAccount 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = if (!empty(aiFoundryResourceId)) {
+  name: last(split(aiFoundryResourceId, '/'))
+}
+
+resource aiSearchService 'Microsoft.Search/searchServices@2025-05-01' existing = if (!empty(aiSearchResourceId)) {
+  name: last(split(aiSearchResourceId, '/'))
+}
+
+resource storageAccount 'Microsoft.Storage/storageAccounts@2025-08-01' existing = if (!empty(storageAccountResourceId)) {
+  name: last(split(storageAccountResourceId, '/'))
+}
+
+resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' existing = if (!empty(cosmosDbAccountName)) {
+  name: cosmosDbAccountName
+}
+
+resource cosmosContributorRoleDefinition 'Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions@2025-10-15' existing = if (!empty(cosmosDbAccountName)) {
+  parent: cosmosAccount
+  name: '00000000-0000-0000-0000-000000000002' // Cosmos DB Built-in Data Contributor
+}
+
+// ============================================================================
+// 1. AI SERVICES ROLE ASSIGNMENTS
+//    Cross-service roles scoped to AI Foundry account
+// ============================================================================
+
+// AI Search → Cognitive Services OpenAI User on AI Foundry (new project, same RG)
+resource assignOpenAIRoleToAISearch 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiSearchPrincipalId) && !empty(aiFoundryResourceId)) {
+  name: guid(solutionName, aiFoundryAccount.id, aiSearchPrincipalId, roleDefinitions.cognitiveServicesOpenAIUser)
+  scope: aiFoundryAccount
+  properties: {
+    principalId: aiSearchPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesOpenAIUser)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// AI Search → Cognitive Services OpenAI User on existing AI Foundry (cross-scope)
+module assignOpenAIToSearchExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(aiSearchPrincipalId)) {
+  name: 'assignOpenAIRoleToAISearchExisting'
+  scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup)
+  params: {
+    principalId: aiSearchPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesOpenAIUser)
+    roleAssignmentName: guid(solutionName, existingAIFoundryName, aiSearchPrincipalId, roleDefinitions.cognitiveServicesOpenAIUser)
+    aiFoundryName: existingAIFoundryName
+  }
+}
+
+// Backend App Service → Foundry User on AI Foundry (new project, same RG)
+resource backendAppAiUserAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiFoundryResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, aiFoundryAccount.id, backendAppServicePrincipalId, roleDefinitions.azureAiUser)
+  scope: aiFoundryAccount
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.azureAiUser)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Foundry User on existing AI Foundry (cross-scope)
+module backendAppAiUserExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(backendAppServicePrincipalId)) {
+  name: 'assignAiUserRoleToBackendExisting'
+  scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup)
+  params: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.azureAiUser)
+    roleAssignmentName: guid(solutionName, existingAIFoundryName, backendAppServicePrincipalId, roleDefinitions.azureAiUser)
+    aiFoundryName: existingAIFoundryName
+  }
+}
+
+// Backend App Service → Cognitive Services OpenAI User on AI Foundry (new project, same RG)
+resource backendAppOpenAIUserAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiFoundryResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, aiFoundryAccount.id, backendAppServicePrincipalId, roleDefinitions.cognitiveServicesOpenAIUser)
+  scope: aiFoundryAccount
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesOpenAIUser)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Cognitive Services OpenAI User on existing AI Foundry (cross-scope)
+module backendAppOpenAIUserExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(backendAppServicePrincipalId)) {
+  name: 'assignOpenAIUserRoleToBackendExisting'
+  scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup)
+  params: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesOpenAIUser)
+    roleAssignmentName: guid(solutionName, existingAIFoundryName, backendAppServicePrincipalId, roleDefinitions.cognitiveServicesOpenAIUser)
+    aiFoundryName: existingAIFoundryName
+  }
+}
+
+// ============================================================================
+// 2. SEARCH SERVICE ROLE ASSIGNMENTS
+//    AI Project and Backend identities → AI Search
+// ============================================================================
+
+// AI Project → Search Index Data Reader on AI Search
+resource projectSearchReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(aiProjectPrincipalId)) {
+  name: guid(solutionName, aiSearchService.id, aiProjectPrincipalId, roleDefinitions.searchIndexDataReader)
+  scope: aiSearchService
+  properties: {
+    principalId: aiProjectPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchIndexDataReader)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// AI Project → Search Service Contributor on AI Search
+resource projectSearchContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(aiProjectPrincipalId)) {
+  name: guid(solutionName, aiSearchService.id, aiProjectPrincipalId, roleDefinitions.searchServiceContributor)
+  scope: aiSearchService
+  properties: {
+    principalId: aiProjectPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchServiceContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Search Index Data Contributor on AI Search
+resource backendAppSearchIndexContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, aiSearchService.id, backendAppServicePrincipalId, roleDefinitions.searchIndexDataContributor)
+  scope: aiSearchService
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchIndexDataContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Search Service Contributor on AI Search
+resource backendAppSearchContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, aiSearchService.id, backendAppServicePrincipalId, roleDefinitions.searchServiceContributor)
+  scope: aiSearchService
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchServiceContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// ============================================================================
+// 3. STORAGE ROLE ASSIGNMENTS
+//    AI Project, AI Search, and Existing Project identities → Storage
+// ============================================================================
+
+// AI Project → Storage Blob Data Contributor
+resource projectStorageContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(aiProjectPrincipalId)) {
+  name: guid(solutionName, storageAccount.id, aiProjectPrincipalId, roleDefinitions.storageBlobDataContributor)
+  scope: storageAccount
+  properties: {
+    principalId: aiProjectPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// AI Project → Storage Blob Data Reader
+resource projectStorageReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(aiProjectPrincipalId)) {
+  name: guid(solutionName, storageAccount.id, aiProjectPrincipalId, roleDefinitions.storageBlobDataReader)
+  scope: storageAccount
+  properties: {
+    principalId: aiProjectPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataReader)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// AI Search → Storage Blob Data Reader
+resource searchStorageReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(aiSearchPrincipalId)) {
+  name: guid(solutionName, storageAccount.id, aiSearchPrincipalId, roleDefinitions.storageBlobDataReader)
+  scope: storageAccount
+  properties: {
+    principalId: aiSearchPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataReader)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Storage Blob Data Contributor
+resource backendAppStorageBlobContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, storageAccount.id, backendAppServicePrincipalId, roleDefinitions.storageBlobDataContributor)
+  scope: storageAccount
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// Backend App Service → Storage Queue Data Contributor
+resource backendAppStorageQueueContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(storageAccountResourceId) && !empty(backendAppServicePrincipalId)) {
+  name: guid(solutionName, storageAccount.id, backendAppServicePrincipalId, roleDefinitions.storageQueueDataContributor)
+  scope: storageAccount
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageQueueDataContributor)
+    principalType: 'ServicePrincipal'
+  }
+}
+
+// ============================================================================
+// 4. COSMOS DB ROLE ASSIGNMENTS
+//    Backend App Service → Cosmos DB (data-plane, uses sqlRoleAssignments)
+// ============================================================================
+
+resource backendAppCosmosRoleAssignment 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2025-10-15' = if (!empty(cosmosDbAccountName) && !empty(backendAppServicePrincipalId)) {
+  parent: cosmosAccount
+  name: guid(solutionName, cosmosContributorRoleDefinition.id, cosmosAccount.id, backendAppServicePrincipalId)
+  properties: {
+    principalId: backendAppServicePrincipalId
+    roleDefinitionId: cosmosContributorRoleDefinition.id
+    scope: cosmosAccount.id
+  }
+}
+
+// ============================================================================
+// 5. DEPLOYER (USER) ROLE ASSIGNMENTS
+//    Deploying user → AI Services, Search, Storage (Bicep-only)
+// ============================================================================
+
+// Deploying User → Cognitive Services User on AI Services
+resource deployerAiServicesAccess 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(deployerPrincipalId) && !empty(aiFoundryResourceId)) {
+  scope: aiFoundryAccount
+  name: guid(solutionName, aiFoundryAccount.id, deployerPrincipalId, roleDefinitions.cognitiveServicesUser)
+  properties: {
+    principalId: deployerPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesUser)
+    principalType: deployerPrincipalType
+  }
+}
+
+// Deploying User → Foundry User on AI Services
+resource deployerAzureAIAccess 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(deployerPrincipalId) && !empty(aiFoundryResourceId)) {
+  scope: aiFoundryAccount
+  name: guid(solutionName, aiFoundryAccount.id, deployerPrincipalId, roleDefinitions.azureAiUser)
+  properties: {
+    principalId: deployerPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.azureAiUser)
+    principalType: deployerPrincipalType
+  }
+}
+
+// Deploying User → Azure AI Developer on AI Services
+resource deployerAiDeveloperAccess 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(deployerPrincipalId) && !empty(aiFoundryResourceId)) {
+  scope: aiFoundryAccount
+  name: guid(solutionName, aiFoundryAccount.id, deployerPrincipalId, roleDefinitions.azureAIDeveloper)
+  properties: {
+    principalId: deployerPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.azureAIDeveloper)
+    principalType: deployerPrincipalType
+  }
+}
+
+// Deploying User → Cognitive Services OpenAI User on AI Services
+resource deployerOpenAIUserAccess 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(deployerPrincipalId) && !empty(aiFoundryResourceId)) {
+  scope: aiFoundryAccount
+  name: guid(solutionName, aiFoundryAccount.id, deployerPrincipalId, roleDefinitions.cognitiveServicesOpenAIUser)
+  properties: {
+    principalId: deployerPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.cognitiveServicesOpenAIUser)
+    principalType: deployerPrincipalType
+  }
+}
+
+// Deploying User → Search Index Data Contributor on AI Search
+resource deployerSearchIndexContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId) && !empty(aiSearchResourceId)) {
+  scope: aiSearchService
+  name: guid(solutionName, aiSearchService.id, deployerPrincipalId, roleDefinitions.searchIndexDataContributor)
+  properties: {
+    principalId: deployerPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchIndexDataContributor)
+    principalType: deployerPrincipalType
+  }
+}
+
+// Deploying User → Search Service Contributor on AI Search
+resource deployerSearchServiceContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId) && !empty(aiSearchResourceId)) {
+  scope: aiSearchService
+  name: guid(solutionName, aiSearchService.id, deployerPrincipalId, roleDefinitions.searchServiceContributor)
+  properties: {
+    principalId: deployerPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.searchServiceContributor)
+    principalType: deployerPrincipalType
+  }
+}
+
+// Deploying User → Storage Blob Data Contributor
+resource deployerStorageBlobContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId) && !empty(storageAccountResourceId)) {
+  scope: storageAccount
+  name: guid(solutionName, storageAccount.id, deployerPrincipalId, roleDefinitions.storageBlobDataContributor)
+  properties: {
+    principalId: deployerPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageBlobDataContributor)
+    principalType: deployerPrincipalType
+  }
+}
+
+// Deploying User → Storage Queue Data Contributor
+resource deployerStorageQueueContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId) && !empty(storageAccountResourceId)) {
+  scope: storageAccount
+  name: guid(solutionName, storageAccount.id, deployerPrincipalId, roleDefinitions.storageQueueDataContributor)
+  properties: {
+    principalId: deployerPrincipalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.storageQueueDataContributor)
+    principalType: deployerPrincipalType
+  }
+}
+
+// Container registry AcrPull assignments.
+// Grants AcrPull to every principal in acrPullPrincipals (e.g. the deployer, the
+// backend/frontend app services, or container app identities). Mirrors the AI
+// Foundry pattern: a newly created (same resource group) registry is assigned
+// inline; an existing (reused) registry — which may live in another resource
+// group or subscription — is assigned via the cross-scope helper.
+resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' existing = if (!useExistingContainerRegistry) {
+  name: containerRegistryName
+}
+
+// Each principal → AcrPull on a newly created (same resource group) container registry
+resource acrPullAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [for principal in acrPullPrincipals: if (!useExistingContainerRegistry && !empty(principal.principalId)) {
+  scope: containerRegistry
+  name: guid(solutionName, containerRegistryName, principal.principalId, roleDefinitions.acrPull)
+  properties: {
+    principalId: principal.principalId
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.acrPull)
+    principalType: principal.principalType
+  }
+}]
+
+// Each principal → AcrPull on an existing (reused) cross-scope container registry
+module acrPullAssignmentsExisting './cross-scope-role-assignment.bicep' = [for principal in acrPullPrincipals: if (useExistingContainerRegistry && !empty(principal.principalId)) {
+  name: take('acrPull-${uniqueString(solutionName, containerRegistryName, principal.principalId)}', 64)
+  scope: resourceGroup(containerRegistrySubscription, containerRegistryResourceGroup)
+  params: {
+    targetResourceType: 'ContainerRegistry'
+    containerRegistryName: containerRegistryName
+    principalId: principal.principalId
+    principalType: principal.principalType
+    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitions.acrPull)
+    roleAssignmentName: guid(solutionName, containerRegistryName, principal.principalId, roleDefinitions.acrPull)
+  }
+}]
+
+// NOTE: Deployer roles on existing AI Foundry (cross-scope) are assigned via
+// 00_build_solution.py to avoid conflicts when the deployer already has the roles.
diff --git a/infra/bicep/modules/monitoring/app-insights.bicep b/infra/bicep/modules/monitoring/app-insights.bicep
new file mode 100644
index 000000000..21109d756
--- /dev/null
+++ b/infra/bicep/modules/monitoring/app-insights.bicep
@@ -0,0 +1,75 @@
+// ============================================================================
+// Module: Application Insights
+// Description: Vanilla Bicep module for Application Insights
+// Resource: Microsoft.Insights/components@2020-02-02
+// Docs: https://learn.microsoft.com/azure/templates/microsoft.insights/components
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Optional. Override name for the Application Insights instance. Defaults to appi-{solutionName}.')
+param name string = 'appi-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Resource ID of the Log Analytics workspace to link to.')
+param workspaceResourceId string
+
+@description('Application type.')
+param applicationType string = 'web'
+
+@description('Retention period in days.')
+param retentionInDays int = 365
+
+@description('Disable IP masking for security.')
+param disableIpMasking bool = false
+
+@description('Flow type for Application Insights.')
+param flowType string = 'Bluefield'
+
+@description('Kind of Application Insights resource.')
+param kind string = 'web'
+
+// ============================================================================
+// Resource
+// ============================================================================
+
+resource appInsights 'Microsoft.Insights/components@2020-02-02' = {
+  name: name
+  location: location
+  tags: tags
+  kind: kind
+  properties: {
+    Application_Type: applicationType
+    Flow_Type: flowType
+    WorkspaceResourceId: workspaceResourceId
+    RetentionInDays: retentionInDays
+    DisableIpMasking: disableIpMasking
+    publicNetworkAccessForIngestion: 'Enabled'
+    publicNetworkAccessForQuery: 'Enabled'
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+
+@description('Resource ID of the Application Insights instance.')
+output resourceId string = appInsights.id
+
+@description('Name of the Application Insights instance.')
+output name string = appInsights.name
+
+@description('Instrumentation key for the Application Insights instance.')
+output instrumentationKey string = appInsights.properties.InstrumentationKey
+
+@description('Connection string for the Application Insights instance.')
+output connectionString string = appInsights.properties.ConnectionString
+
+@description('Application ID of the Application Insights instance.')
+output applicationId string = appInsights.properties.AppId
diff --git a/infra/bicep/modules/monitoring/log-analytics.bicep b/infra/bicep/modules/monitoring/log-analytics.bicep
new file mode 100644
index 000000000..3a20b3ab2
--- /dev/null
+++ b/infra/bicep/modules/monitoring/log-analytics.bicep
@@ -0,0 +1,62 @@
+// ============================================================================
+// Module: Log Analytics Workspace
+// Description: Vanilla Bicep module for Log Analytics Workspace
+// Resource: Microsoft.OperationalInsights/workspaces@2023-09-01
+// Docs: https://learn.microsoft.com/azure/templates/microsoft.operationalinsights/workspaces
+// Note: This module only handles NEW workspace creation.
+//       Existing workspace logic is handled in main.bicep.
+// ============================================================================
+
+@description('Solution name suffix used to derive the resource name.')
+param solutionName string
+
+@description('Optional. Override name for the Log Analytics workspace. Defaults to log-{solutionName}.')
+param name string = 'log-${solutionName}'
+
+@description('Azure region for the resource.')
+param location string
+
+@description('Tags to apply to the resource.')
+param tags object = {}
+
+@description('Retention period in days.')
+param retentionInDays int = 365
+
+@description('SKU name for the workspace.')
+param skuName string = 'PerGB2018'
+
+@description('Optional. Managed identity configuration for the resource.')
+param identity object = { type: 'SystemAssigned' }
+
+// ============================================================================
+// Resource
+// ============================================================================
+
+resource logAnalytics 'Microsoft.OperationalInsights/workspaces@2023-09-01' = {
+  name: name
+  location: location
+  tags: tags
+  identity: identity
+  properties: {
+    retentionInDays: retentionInDays
+    sku: {
+      name: skuName
+    }
+  }
+}
+
+// ============================================================================
+// Outputs
+// ============================================================================
+
+@description('Resource ID of the Log Analytics workspace.')
+output resourceId string = logAnalytics.id
+
+@description('Name of the Log Analytics workspace.')
+output name string = logAnalytics.name
+
+@description('Location of the workspace.')
+output location string = logAnalytics.location
+
+@description('Log Analytics workspace customer ID.')
+output logAnalyticsWorkspaceId string = logAnalytics.properties.customerId
diff --git a/infra/main.bicep b/infra/main.bicep
index 7d6106b80..b65604eb4 100644
--- a/infra/main.bicep
+++ b/infra/main.bicep
@@ -1,392 +1,335 @@
+// ============================================================================
+// main.bicep — Deployment Router
+// Description: Routes deployment to the appropriate infrastructure flavor.
+//   - 'bicep'   → Vanilla Bicep modules (Docker deployment)
+//   - 'avm'     → AVM-based modules (non-WAF)
+//   - 'avm-waf' → AVM-based modules with WAF-aligned features
+//              (monitoring, private networking, scalability, redundancy)
+// ============================================================================
 targetScope = 'resourceGroup'
 
-@minLength(1)
-@maxLength(64)
-@description('Name of the environment (e.g., dev, prod)')
-param environmentName string
+// ============================================================================
+// Routing Parameter
+// ============================================================================
+
+@allowed(['bicep', 'avm', 'avm-waf'])
+@description('Required. Deployment flavor: bicep (vanilla Docker), avm (AVM non-WAF), or avm-waf (AVM WAF-aligned).')
+param deploymentFlavor string
+
+// ============================================================================
+// Parameters — Core (shared across all flavors)
+// ============================================================================
+
+@minLength(3)
+@maxLength(16)
+@description('Optional. A unique application/solution name used as base for all resource naming.')
+param solutionName string = 'kmgen'
+
+@maxLength(5)
+@description('Optional. A unique text suffix appended to resource names for uniqueness.')
+param solutionUniqueText string = substring(uniqueString(subscription().id, resourceGroup().name, solutionName), 0, 5)
+
+@metadata({ azd: { type: 'location' } })
+@description('Optional. Primary Azure region for resource deployment.')
+param location string = resourceGroup().location
+
+@allowed(['australiaeast', 'swedencentral', 'southeastasia'])
+@metadata({
+  azd:{
+    type: 'location'
+    usageName: [
+      'OpenAI.GlobalStandard.gpt-5.2,150'
+      'OpenAI.GlobalStandard.text-embedding-3-small,80'
+    ]
+  }
+})
+@description('Required. Location for AI Foundry and model deployments.')
+param azureAiServiceLocation string
 
-@minLength(1)
-@description('Primary location for all resources')
-param location string
+@description('Optional. Set to true to also deploy Cosmos DB (not required — SQL is the primary database).')
+param deployCosmos bool = false
 
-@description('Name of the Azure OpenAI chat deployment')
-param chatDeploymentName string = 'gpt-5.2'
+// ============================================================================
+// Parameters — AI Configuration
+// ============================================================================
 
-@description('Name of the Azure OpenAI embedding deployment')
-param embeddingDeploymentName string = 'text-embedding-3-small'
+@allowed(['Standard', 'GlobalStandard'])
+@description('Optional. GPT model deployment type.')
+param deploymentType string = 'GlobalStandard'
 
-@description('GPT model version')
+@description('Optional. Name of the GPT model to deploy.')
+param gptModelName string = 'gpt-5.2'
+
+@description('Optional. Version of the GPT model to deploy.')
 param gptModelVersion string = '2025-12-11'
 
-@description('Azure AD tenant ID for authentication')
-param azureAdTenantId string = ''
+@minValue(10)
+@description('Optional. Capacity of the GPT deployment (TPM in thousands).')
+param gptDeploymentCapacity int = 150
 
-@description('Azure AD client ID for authentication')
-param azureAdClientId string = ''
+@allowed(['text-embedding-3-small'])
+@description('Optional. Name of the Text Embedding model to deploy.')
+param embeddingModel string = 'text-embedding-3-small'
 
-@description('Optional. The tags to apply to all deployed Azure resources.')
-param tags resourceInput<'Microsoft.Resources/resourceGroups@2025-04-01'>.tags = {}
+@minValue(10)
+@description('Optional. Capacity of the Embedding Model deployment.')
+param embeddingDeploymentCapacity int = 80
 
-// ── Existing AI Foundry Project (optional) ──
-@description('Set to true to reuse an existing Azure AI Foundry project instead of creating new AI resources')
-param useExistingAiProject bool = false
+// ============================================================================
+// Parameters — Compute
+// ============================================================================
 
-@description('Name of the existing AI Services account (parent of the project)')
-param existingAiFoundryServiceName string = ''
+@description('Optional. Name of the Azure Container Registry. Leave empty to auto-generate a globally unique name (cr<suffix>).')
+param containerRegistryName string = ''
 
-@description('Name of the existing AI Foundry project')
-param existingAiFoundryProjectName string = ''
+@description('Optional. Backend container image name.')
+param backendContainerImageName string = 'km-api'
 
-@description('Endpoint of the existing AI Foundry AI Services (for OpenAI + CU)')
-param existingAiFoundryEndpoint string = ''
+@description('Optional. Backend container image tag.')
+param backendContainerImageTag string = 'latest'
 
-@description('Name of the AI Search connection in the existing AI Foundry project')
-param existingAiSearchConnectionName string = ''
+@description('Optional. Frontend container image name.')
+param frontendContainerImageName string = 'km-app'
 
-@description('Set to true to also deploy Cosmos DB (not required — SQL is the primary database)')
-param deployCosmos bool = false
+@description('Optional. Frontend container image tag.')
+param frontendContainerImageTag string = 'latest'
+
+@allowed(['F1', 'D1', 'B1', 'B2', 'B3', 'S1', 'S2', 'S3', 'P1', 'P2', 'P3', 'P1v3', 'P1v4'])
+@description('Optional. App Service Plan SKU.')
+param appServicePlanSku string = 'B3'
+
+@description('Kind of web app.')
+param kind string = 'app,linux,container'
 
-@description('Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable.')
+// ============================================================================
+// Parameters — Authentication (matches infra_old/main.bicep)
+// ============================================================================
+
+@description('Optional. Azure AD tenant ID for authentication.')
+param azureAdTenantId string = ''
+
+@description('Optional. Azure AD client ID for authentication.')
+param azureAdClientId string = ''
+
+@description('Optional. Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable.')
 @secure()
 param adminApiKey string = ''
 
-// ── Container Image Configuration ──
-// Images are built and pushed to the dedicated ACR provisioned below by the
-// post-deployment script (infra/scripts/build/build_and_push_images.ps1). App Services boot on
-// a public hello-world image and are switched to these images by that script.
-@description('Backend container image name (repository) to build and push to the provisioned ACR')
-param backendContainerImageName string = 'km-api'
+// ============================================================================
+// Parameters — Existing Resources
+// ============================================================================
 
-@description('Backend container image tag')
-param backendContainerImageTag string = 'latest'
+@description('Optional. Resource ID of an existing Log Analytics workspace. Empty creates a new one.')
+param existingLogAnalyticsWorkspaceId string = ''
 
-@description('Frontend container image name (repository) to build and push to the provisioned ACR')
-param frontendContainerImageName string = 'km-app'
+@description('Optional. Resource ID of an existing AI Foundry project. Empty creates a new one.')
+param existingFoundryProjectResourceId string = ''
 
-@description('Frontend container image tag')
-param frontendContainerImageTag string = 'latest'
+// ============================================================================
+// Parameters — Identity
+// ============================================================================
 
-var abbrs = loadJsonContent('abbreviations.json')
-var resourceToken = toLower(uniqueString(subscription().id, environmentName, location))
-
-var existingTags = resourceGroup().tags ?? {}
-
-// ========== Resource Group Tag ========== //
-resource resourceGroupTags 'Microsoft.Resources/tags@2025-04-01' = {
-  name: 'default'
-  properties: {
-    tags: union(
-      existingTags,
-      tags,
-      {
-        TemplateName: 'KM-Generic'
-        DeploymentName: deployment().name
-      }
-    )
-  }
-}
+@allowed(['User', 'ServicePrincipal'])
+@description('Optional. Principal type of the deploying user. Use ServicePrincipal for CI/CD pipelines with OIDC.')
+param deployingUserPrincipalType string = 'User'
 
-// ========== AI Foundry: AI Services ========== //
-module aiServices 'modules/ai-services.bicep' = if (!useExistingAiProject) {
-  name: 'ai-services'
-  params: {
-    name: '${abbrs.ai.aiFoundry}${resourceToken}'
-    location: location
-    kind: 'AIServices'
-    sku: 'S0'
-    customSubDomainName: '${abbrs.ai.aiFoundry}${resourceToken}'
-    projectName: '${abbrs.ai.aiFoundryProject}${resourceToken}'
-    projectDescription: 'Knowledge Mining AI Foundry Project'
-    publicNetworkAccess: 'Enabled'
-    restrictOutboundNetworkAccess: false
-    disableLocalAuth: false
-    restore: false
-    deployments: [
-      {
-        name: chatDeploymentName
-        model: {
-          format: 'OpenAI'
-          name: chatDeploymentName
-          version: gptModelVersion
-        }
-        sku: {
-          name: 'GlobalStandard'
-          capacity: 150
-        }
-      }
-      {
-        name: embeddingDeploymentName
-        model: {
-          format: 'OpenAI'
-          name: embeddingDeploymentName
-          version: '1'
-        }
-        sku: {
-          name: 'GlobalStandard'
-          capacity: 80
-        }
-      }
-    ]
-  }
-}
+// ============================================================================
+// Parameters — AVM-specific (ignored when deploymentFlavor = 'bicep')
+// ============================================================================
 
-// use existing or newly created
-var aiServicesEndpoint = useExistingAiProject ? existingAiFoundryEndpoint : aiServices!.outputs.endpoint
-var aiServicesName = useExistingAiProject ? existingAiFoundryServiceName : aiServices!.outputs.name
+@description('Optional. Tags to apply to all resources (AVM only).')
+param tags object = {}
 
-// ========== AI Search ========== //
-var aiSearchName = '${abbrs.ai.aiSearch}${resourceToken}'
-var aiSearchConnectionName = 'search-connection-${resourceToken}'
+@description('Optional. Enable/Disable usage telemetry for AVM modules.')
+param enableTelemetry bool = true
 
-module search 'modules/search.bicep' = {
-  name: 'search'
-  params: {
-    name: aiSearchName
-    location: location
-    tags: tags
-  }
-}
+@description('Optional. Enable monitoring (Log Analytics, App Insights, diagnostic settings).')
+param enableMonitoring bool = false
 
-// ========== AI Search → AI Foundry Connection ========== //
-module searchConnection 'modules/deploy_aifp_aisearch_connection.bicep' = if (!useExistingAiProject) {
-  name: 'ai-search-connection'
-  params: {
-    existingAIProjectName: '${abbrs.ai.aiFoundryProject}${resourceToken}'
-    existingAIFoundryName: '${abbrs.ai.aiFoundry}${resourceToken}'
-    aiSearchName: aiSearchName
-    aiSearchResourceId: search.outputs.id
-    aiSearchLocation: location
-    aiSearchConnectionName: aiSearchConnectionName
-  }
-  dependsOn: [
-    aiServices
-  ]
-}
+@description('Optional. Enable private networking (VNet, private endpoints, DNS zones).')
+param enablePrivateNetworking bool = false
 
-// ========== Storage Account ========== //
-module storage 'modules/storage.bicep' = {
-  name: 'storage'
-  params: {
-    name: '${abbrs.storage.storageAccount}${resourceToken}'
-    location: location
-    tags: tags
-  }
-}
+@description('Optional. Enable scalability features (zone redundant App Service Plan).')
+param enableScalability bool = false
 
-// ========== SQL Database ========== //
-module sql 'modules/sql.bicep' = {
-  name: 'sql'
-  params: {
-    serverName: '${abbrs.databases.sqlDatabaseServer}${resourceToken}'
-    databaseName: '${abbrs.databases.sqlDatabase}${resourceToken}'
-    location: location
-    tags: tags
-    adminObjectId: deployer().objectId
-  }
-}
+@description('Optional. Enable redundancy (zone redundant Cosmos DB, multi-region failover).')
+param enableRedundancy bool = false
 
-// ========== Cosmos DB (optional) ========== //
-module cosmos 'modules/cosmos.bicep' = if (deployCosmos) {
-  name: 'cosmos'
-  params: {
-    name: '${abbrs.databases.cosmosDBDatabase}${resourceToken}'
-    location: location
-    tags: tags
-    databaseName: 'km-db'
-  }
-}
+@secure()
+@description('Optional. VM admin username (AVM-WAF only, when private networking is enabled).')
+param vmAdminUsername string?
 
-// ========== Azure Container Registry ========== //
-var acrName = 'cr${resourceToken}'
-module containerRegistry 'modules/container-registry.bicep' = {
-  name: 'container-registry'
-  params: {
-    name: acrName
-    location: location
-    tags: tags
-  }
-}
-var acrLoginServer = containerRegistry.outputs.loginServer
+@secure()
+@description('Optional. VM admin password (AVM-WAF only, when private networking is enabled).')
+param vmAdminPassword string?
+
+@description('Optional. VM size for jumpbox (AVM-WAF only). Defaults to Standard_D2s_v5.')
+param vmSize string = 'Standard_D2s_v5'
+
+// ============================================================================
+// Derived Variables
+// ============================================================================
 
-// ========== App Service Plan ========== //
-var webServerFarmResourceName = '${abbrs.compute.appServicePlan}${resourceToken}'
-module webServerFarm 'modules/app-service-plan.bicep' = {
-  name: 'deploy_app_service_plan_serverfarm'
+var isAvm = deploymentFlavor == 'avm' || deploymentFlavor == 'avm-waf'
+var isBicep = deploymentFlavor == 'bicep'
+
+// ============================================================================
+// Module: AVM Deployment (non-WAF and WAF)
+// Activated when deploymentFlavor = 'avm' or 'avm-waf'
+// WAF features (monitoring, private networking, scalability, redundancy)
+// are enabled automatically for 'avm-waf'.
+// ============================================================================
+
+module avmDeployment './avm/main.bicep' = if (isAvm) {
+  name: take('module.avm.${solutionName}', 64)
   params: {
-    name: webServerFarmResourceName
+    solutionName: solutionName
+    solutionUniqueText: solutionUniqueText
     location: location
+    azureAiServiceLocation: azureAiServiceLocation
     tags: tags
+    enableTelemetry: enableTelemetry
+    enableMonitoring: enableMonitoring
+    enablePrivateNetworking: enablePrivateNetworking
+    enableScalability: enableScalability
+    enableRedundancy: enableRedundancy
+    vmAdminUsername: vmAdminUsername
+    vmAdminPassword: vmAdminPassword
+    vmSize: vmSize
+    deployCosmos: deployCosmos
+    deploymentType: deploymentType
+    gptModelName: gptModelName
+    gptModelVersion: gptModelVersion
+    gptDeploymentCapacity: gptDeploymentCapacity
+    embeddingModel: embeddingModel
+    embeddingDeploymentCapacity: embeddingDeploymentCapacity
+    kind: kind
+    containerRegistryName: containerRegistryName
+    appServicePlanSku: appServicePlanSku
+    backendContainerImageName: backendContainerImageName
+    backendContainerImageTag: backendContainerImageTag
+    frontendContainerImageName: frontendContainerImageName
+    frontendContainerImageTag: frontendContainerImageTag
+    azureAdTenantId: azureAdTenantId
+    azureAdClientId: azureAdClientId
+    adminApiKey: adminApiKey
+    existingLogAnalyticsWorkspaceId: existingLogAnalyticsWorkspaceId
+    existingFoundryProjectResourceId: existingFoundryProjectResourceId
+    deployingUserPrincipalType: deployingUserPrincipalType
   }
 }
 
-// ========== Backend Web App ========== //
-var backendWebSiteResourceName = 'api-${resourceToken}'
-module webSiteBackend 'modules/web-sites.bicep' = {
-  name: take('module.web-sites.${backendWebSiteResourceName}', 64)
-  params: {
-    name: backendWebSiteResourceName
-    tags: union(tags, { 'azd-service-name': 'backend' })
-    location: location
-    kind: 'app,linux'
-    serverFarmResourceId: webServerFarm.outputs.id
-    managedIdentities: {
-      systemAssigned: true
-    }
-    siteConfig: {
-      linuxFxVersion: 'DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
-      acrUseManagedIdentityCreds: true
-      appCommandLine: ''
-      minTlsVersion: '1.2'
-    }
-    configs: [
-      {
-        name: 'appsettings'
-        properties: {
-          DOCKER_REGISTRY_SERVER_URL: 'https://${acrLoginServer}'
-          WEBSITES_PORT: '8000'
-          AZURE_OPENAI_ENDPOINT: aiServicesEndpoint
-          AZURE_OPENAI_CHAT_DEPLOYMENT: chatDeploymentName
-          AZURE_OPENAI_EMBEDDING_DEPLOYMENT: embeddingDeploymentName
-          AZURE_SEARCH_ENDPOINT: search.outputs.endpoint
-          AZURE_SEARCH_INDEX_NAME: 'knowledge-mining-index'
-          AZURE_CONTENT_UNDERSTANDING_ENDPOINT: aiServices!.outputs.endpoints['Content Understanding']
-          AZURE_STORAGE_ACCOUNT: storage.outputs.accountName
-          AZURE_SQL_SERVER: sql.outputs.serverFqdn
-          AZURE_SQL_DATABASE: '${abbrs.databases.sqlDatabase}${resourceToken}'
-          AZURE_COSMOS_ENDPOINT: deployCosmos ? cosmos!.outputs.endpoint : ''
-          AZURE_COSMOS_DATABASE: deployCosmos ? 'km-db' : ''
-          AZURE_AD_TENANT_ID: azureAdTenantId
-          AZURE_AD_CLIENT_ID: azureAdClientId
-          AZURE_AI_AGENT_ENDPOINT: useExistingAiProject ? existingAiFoundryEndpoint : aiServices!.outputs.aiProjectInfo.apiEndpoint
-          AZURE_AI_SEARCH_CONNECTION_NAME: useExistingAiProject ? existingAiSearchConnectionName : aiSearchConnectionName
-          API_APP_NAME: backendWebSiteResourceName
-          APP_FRONTEND_HOSTNAME: 'https://${frontendWebSiteResourceName}.azurewebsites.net'
-          APP_ENV: 'Prod'
-          ADMIN_API_KEY: adminApiKey
-          SOLUTION_SUFFIX: resourceToken
-        }
-      }
-    ]
-  }
-}
+// ============================================================================
+// Module: Vanilla Bicep Deployment (Docker)
+// Activated when deploymentFlavor = 'bicep'
+// ============================================================================
 
-// ========== Frontend Web App ========== //
-var frontendWebSiteResourceName = 'app-${resourceToken}'
-module webSiteFrontend 'modules/web-sites.bicep' = {
-  name: take('module.web-sites.${frontendWebSiteResourceName}', 64)
+module bicepDeployment './bicep/main.bicep' = if (isBicep) {
+  name: take('module.bicep.${solutionName}', 64)
   params: {
-    name: frontendWebSiteResourceName
-    tags: union(tags, { 'azd-service-name': 'frontend' })
+    solutionName: solutionName
+    solutionUniqueText: solutionUniqueText
     location: location
-    kind: 'app,linux'
-    serverFarmResourceId: webServerFarm.outputs.id
-    managedIdentities: {
-      systemAssigned: true
-    }
-    siteConfig: {
-      linuxFxVersion: 'DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
-      acrUseManagedIdentityCreds: true
-      appCommandLine: ''
-      minTlsVersion: '1.2'
-    }
-    configs: [
-      {
-        name: 'appsettings'
-        properties: {
-          DOCKER_REGISTRY_SERVER_URL: 'https://${acrLoginServer}'
-          APP_API_BASE_URL: 'https://${webSiteBackend.outputs.defaultHostname}'
-          WEBSITES_PORT: '80'
-        }
-      }
-    ]
+    azureAiServiceLocation: azureAiServiceLocation
+    tags: tags
+    deployCosmos: deployCosmos
+    deploymentType: deploymentType  
+    gptModelName: gptModelName
+    gptModelVersion: gptModelVersion
+    gptDeploymentCapacity: gptDeploymentCapacity
+    embeddingModel: embeddingModel
+    embeddingDeploymentCapacity: embeddingDeploymentCapacity
+    kind: kind
+    containerRegistryName: containerRegistryName
+    appServicePlanSku: appServicePlanSku
+    backendContainerImageName: backendContainerImageName
+    backendContainerImageTag: backendContainerImageTag
+    frontendContainerImageName: frontendContainerImageName
+    frontendContainerImageTag: frontendContainerImageTag
+    azureAdTenantId: azureAdTenantId
+    azureAdClientId: azureAdClientId
+    adminApiKey: adminApiKey
+    existingLogAnalyticsWorkspaceId: existingLogAnalyticsWorkspaceId
+    existingFoundryProjectResourceId: existingFoundryProjectResourceId
+    deployingUserPrincipalType: deployingUserPrincipalType
   }
 }
 
-// ========== Role Assignments ========== //
-module roles 'modules/roles.bicep' = {
-  name: 'roles'
-  params: {
-    openaiName: aiServicesName
-    searchName: search.outputs.name
-    storageName: storage.outputs.accountName
-    cosmosName: deployCosmos ? cosmos!.outputs.name : ''
-    backendPrincipalId: webSiteBackend.outputs.systemAssignedMIPrincipalId!
-    frontendPrincipalId: webSiteFrontend.outputs.systemAssignedMIPrincipalId!
-    acrName: containerRegistry.outputs.name
-    deployerPrincipalId: deployer().objectId
-    aiProjectPrincipalId: useExistingAiProject ? '' : aiServices!.outputs.aiProjectInfo.aiprojectSystemAssignedMIPrincipalId
-  }
-}
+// ============================================================================
+// Outputs — Coalesced from whichever flavor was deployed (matches infra_old/main.bicep)
+// ============================================================================
 
-// ========== Outputs ========== //
 @description('Azure OpenAI endpoint URL.')
-output AZURE_OPENAI_ENDPOINT string = aiServicesEndpoint
+output AZURE_OPENAI_ENDPOINT string = isAvm ? avmDeployment!.outputs.AZURE_OPENAI_ENDPOINT : bicepDeployment!.outputs.AZURE_OPENAI_ENDPOINT
 
 @description('Azure AI Search endpoint URL.')
-output AZURE_SEARCH_ENDPOINT string = search.outputs.endpoint
+output AZURE_SEARCH_ENDPOINT string = isAvm ? avmDeployment!.outputs.AZURE_SEARCH_ENDPOINT : bicepDeployment!.outputs.AZURE_SEARCH_ENDPOINT
 
 @description('Azure Content Understanding endpoint URL.')
-output AZURE_CONTENT_UNDERSTANDING_ENDPOINT string = aiServices!.outputs.endpoints['Content Understanding']
+output AZURE_CONTENT_UNDERSTANDING_ENDPOINT string = isAvm ? avmDeployment!.outputs.AZURE_CONTENT_UNDERSTANDING_ENDPOINT : bicepDeployment!.outputs.AZURE_CONTENT_UNDERSTANDING_ENDPOINT
 
 @description('Azure Storage account name.')
-output AZURE_STORAGE_ACCOUNT string = storage.outputs.accountName
+output AZURE_STORAGE_ACCOUNT string = isAvm ? avmDeployment!.outputs.AZURE_STORAGE_ACCOUNT : bicepDeployment!.outputs.AZURE_STORAGE_ACCOUNT
 
 @description('Azure SQL Server FQDN.')
-output AZURE_SQL_SERVER string = sql.outputs.serverFqdn
+output AZURE_SQL_SERVER string = isAvm ? avmDeployment!.outputs.AZURE_SQL_SERVER : bicepDeployment!.outputs.AZURE_SQL_SERVER
 
 @description('Azure SQL Database name.')
-output AZURE_SQL_DATABASE string = '${abbrs.databases.sqlDatabase}${resourceToken}'
+output AZURE_SQL_DATABASE string = isAvm ? avmDeployment!.outputs.AZURE_SQL_DATABASE : bicepDeployment!.outputs.AZURE_SQL_DATABASE
 
 @description('Backend API application (and SQL contained user) name.')
-output API_APP_NAME string = backendWebSiteResourceName
+output API_APP_NAME string = isAvm ? avmDeployment!.outputs.API_APP_NAME : bicepDeployment!.outputs.API_APP_NAME
 
 @description('Backend API system-assigned managed identity principal ID.')
-output AZURE_API_PRINCIPAL_ID string = webSiteBackend.outputs.systemAssignedMIPrincipalId!
+output AZURE_API_PRINCIPAL_ID string = isAvm ? avmDeployment!.outputs.AZURE_API_PRINCIPAL_ID : bicepDeployment!.outputs.AZURE_API_PRINCIPAL_ID
 
-@description('Azure Cosmos DB endpoint (empty if not deployed).')
-output AZURE_COSMOS_ENDPOINT string = deployCosmos ? cosmos!.outputs.endpoint : ''
+@description('Azure Cosmos DB endpoint.')
+output AZURE_COSMOS_ENDPOINT string = isAvm ? avmDeployment!.outputs.AZURE_COSMOS_ENDPOINT : bicepDeployment!.outputs.AZURE_COSMOS_ENDPOINT
 
 @description('Azure AI Agent endpoint URL.')
-output AZURE_AI_AGENT_ENDPOINT string = useExistingAiProject ? '${existingAiFoundryEndpoint}/projects/${existingAiFoundryProjectName}' : aiServices!.outputs.aiProjectInfo.apiEndpoint
+output AZURE_AI_AGENT_ENDPOINT string = isAvm ? avmDeployment!.outputs.AZURE_AI_AGENT_ENDPOINT : bicepDeployment!.outputs.AZURE_AI_AGENT_ENDPOINT
 
 @description('Backend API application URL.')
-output API_APP_URL string = 'https://${webSiteBackend.outputs.defaultHostname}'
+output API_APP_URL string = isAvm ? avmDeployment!.outputs.API_APP_URL : bicepDeployment!.outputs.API_APP_URL
 
 @description('Frontend web application URL.')
-output WEB_APP_URL string = 'https://${webSiteFrontend.outputs.defaultHostname}'
+output WEB_APP_URL string = isAvm ? avmDeployment!.outputs.WEB_APP_URL : bicepDeployment!.outputs.WEB_APP_URL
 
 @description('Backend service URI (used by azd).')
-output SERVICE_BACKEND_URI string = 'https://${webSiteBackend.outputs.defaultHostname}'
+output SERVICE_BACKEND_URI string = isAvm ? avmDeployment!.outputs.SERVICE_BACKEND_URI : bicepDeployment!.outputs.SERVICE_BACKEND_URI
 
 @description('Frontend service URI (used by azd).')
-output SERVICE_FRONTEND_URI string = 'https://${webSiteFrontend.outputs.defaultHostname}'
+output SERVICE_FRONTEND_URI string = isAvm ? avmDeployment!.outputs.SERVICE_FRONTEND_URI : bicepDeployment!.outputs.SERVICE_FRONTEND_URI
 
 @description('AI Search connection name in AI Foundry.')
-output AZURE_AI_SEARCH_CONNECTION_NAME string = useExistingAiProject ? existingAiSearchConnectionName : aiSearchConnectionName
+output AZURE_AI_SEARCH_CONNECTION_NAME string = isAvm ? avmDeployment!.outputs.AZURE_AI_SEARCH_CONNECTION_NAME : bicepDeployment!.outputs.AZURE_AI_SEARCH_CONNECTION_NAME
 
 @description('Azure Container Registry name.')
-output ACR_NAME string = containerRegistry.outputs.name
+output ACR_NAME string = isAvm ? avmDeployment!.outputs.ACR_NAME : bicepDeployment!.outputs.ACR_NAME
 
 @description('Azure Container Registry login server URL.')
-output ACR_LOGIN_SERVER string = containerRegistry.outputs.loginServer
+output ACR_LOGIN_SERVER string = isAvm ? avmDeployment!.outputs.ACR_LOGIN_SERVER : bicepDeployment!.outputs.ACR_LOGIN_SERVER
 
 @description('Backend container image repository name to build and push to ACR.')
-output BACKEND_CONTAINER_IMAGE_NAME string = backendContainerImageName
+output BACKEND_CONTAINER_IMAGE_NAME string = isAvm ? avmDeployment!.outputs.BACKEND_CONTAINER_IMAGE_NAME : bicepDeployment!.outputs.BACKEND_CONTAINER_IMAGE_NAME
 
 @description('Backend container image tag to build and push to ACR.')
-output BACKEND_CONTAINER_IMAGE_TAG string = backendContainerImageTag
+output BACKEND_CONTAINER_IMAGE_TAG string = isAvm ? avmDeployment!.outputs.BACKEND_CONTAINER_IMAGE_TAG : bicepDeployment!.outputs.BACKEND_CONTAINER_IMAGE_TAG
 
 @description('Frontend container image repository name to build and push to ACR.')
-output FRONTEND_CONTAINER_IMAGE_NAME string = frontendContainerImageName
+output FRONTEND_CONTAINER_IMAGE_NAME string = isAvm ? avmDeployment!.outputs.FRONTEND_CONTAINER_IMAGE_NAME : bicepDeployment!.outputs.FRONTEND_CONTAINER_IMAGE_NAME
 
 @description('Frontend container image tag to build and push to ACR.')
-output FRONTEND_CONTAINER_IMAGE_TAG string = frontendContainerImageTag
+output FRONTEND_CONTAINER_IMAGE_TAG string = isAvm ? avmDeployment!.outputs.FRONTEND_CONTAINER_IMAGE_TAG : bicepDeployment!.outputs.FRONTEND_CONTAINER_IMAGE_TAG
 
 @description('Frontend web application (App Service) name.')
-output FRONTEND_APP_NAME string = frontendWebSiteResourceName
+output FRONTEND_APP_NAME string = isAvm ? avmDeployment!.outputs.FRONTEND_APP_NAME : bicepDeployment!.outputs.FRONTEND_APP_NAME
 
 @description('Resource group name.')
 output RESOURCE_GROUP_NAME string = resourceGroup().name
 
 @description('Solution resource token suffix used in resource names.')
-output SOLUTION_SUFFIX string = resourceToken
+output SOLUTION_SUFFIX string = isAvm ? avmDeployment!.outputs.SOLUTION_SUFFIX : bicepDeployment!.outputs.SOLUTION_SUFFIX
+
+@description('Whether the deployment uses private endpoints. Post-provision scripts gate ACR admin-credential image pull on this.')
+output ENABLE_PRIVATE_NETWORKING bool = enablePrivateNetworking
diff --git a/infra/main.json b/infra/main.json
index bcc2428f4..e9d02df23 100644
--- a/infra/main.json
+++ b/infra/main.json
@@ -1,268 +1,417 @@
 {
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
   "contentVersion": "1.0.0.0",
   "metadata": {
     "_generator": {
       "name": "bicep",
-      "version": "0.44.1.10279",
-      "templateHash": "12204035765548162279"
+      "version": "0.46.1.21595",
+      "templateHash": "10337152692073035355"
     }
   },
   "parameters": {
-    "environmentName": {
+    "deploymentFlavor": {
       "type": "string",
-      "minLength": 1,
-      "maxLength": 64,
+      "allowedValues": [
+        "bicep",
+        "avm",
+        "avm-waf"
+      ],
       "metadata": {
-        "description": "Name of the environment (e.g., dev, prod)"
+        "description": "Required. Deployment flavor: bicep (vanilla Docker), avm (AVM non-WAF), or avm-waf (AVM WAF-aligned)."
+      }
+    },
+    "solutionName": {
+      "type": "string",
+      "defaultValue": "kmgen",
+      "minLength": 3,
+      "maxLength": 16,
+      "metadata": {
+        "description": "Optional. A unique application/solution name used as base for all resource naming."
+      }
+    },
+    "solutionUniqueText": {
+      "type": "string",
+      "defaultValue": "[substring(uniqueString(subscription().id, resourceGroup().name, parameters('solutionName')), 0, 5)]",
+      "maxLength": 5,
+      "metadata": {
+        "description": "Optional. A unique text suffix appended to resource names for uniqueness."
       }
     },
     "location": {
       "type": "string",
-      "minLength": 1,
+      "defaultValue": "[resourceGroup().location]",
       "metadata": {
-        "description": "Primary location for all resources"
+        "azd": {
+          "type": "location"
+        },
+        "description": "Optional. Primary Azure region for resource deployment."
       }
     },
-    "chatDeploymentName": {
+    "azureAiServiceLocation": {
       "type": "string",
-      "defaultValue": "gpt-5.2",
+      "allowedValues": [
+        "australiaeast",
+        "swedencentral",
+        "southeastasia"
+      ],
+      "metadata": {
+        "azd": {
+          "type": "location",
+          "usageName": [
+            "OpenAI.GlobalStandard.gpt-5.2,150",
+            "OpenAI.GlobalStandard.text-embedding-3-small,80"
+          ]
+        },
+        "description": "Required. Location for AI Foundry and model deployments."
+      }
+    },
+    "deployCosmos": {
+      "type": "bool",
+      "defaultValue": false,
       "metadata": {
-        "description": "Name of the Azure OpenAI chat deployment"
+        "description": "Optional. Set to true to also deploy Cosmos DB (not required — SQL is the primary database)."
       }
     },
-    "embeddingDeploymentName": {
+    "deploymentType": {
       "type": "string",
-      "defaultValue": "text-embedding-3-small",
+      "defaultValue": "GlobalStandard",
+      "allowedValues": [
+        "Standard",
+        "GlobalStandard"
+      ],
+      "metadata": {
+        "description": "Optional. GPT model deployment type."
+      }
+    },
+    "gptModelName": {
+      "type": "string",
+      "defaultValue": "gpt-5.2",
       "metadata": {
-        "description": "Name of the Azure OpenAI embedding deployment"
+        "description": "Optional. Name of the GPT model to deploy."
       }
     },
     "gptModelVersion": {
       "type": "string",
       "defaultValue": "2025-12-11",
       "metadata": {
-        "description": "GPT model version"
+        "description": "Optional. Version of the GPT model to deploy."
       }
     },
-    "azureAdTenantId": {
+    "gptDeploymentCapacity": {
+      "type": "int",
+      "defaultValue": 150,
+      "minValue": 10,
+      "metadata": {
+        "description": "Optional. Capacity of the GPT deployment (TPM in thousands)."
+      }
+    },
+    "embeddingModel": {
       "type": "string",
-      "defaultValue": "",
+      "defaultValue": "text-embedding-3-small",
+      "allowedValues": [
+        "text-embedding-3-small"
+      ],
       "metadata": {
-        "description": "Azure AD tenant ID for authentication"
+        "description": "Optional. Name of the Text Embedding model to deploy."
       }
     },
-    "azureAdClientId": {
+    "embeddingDeploymentCapacity": {
+      "type": "int",
+      "defaultValue": 80,
+      "minValue": 10,
+      "metadata": {
+        "description": "Optional. Capacity of the Embedding Model deployment."
+      }
+    },
+    "containerRegistryName": {
       "type": "string",
       "defaultValue": "",
       "metadata": {
-        "description": "Azure AD client ID for authentication"
+        "description": "Optional. Name of the Azure Container Registry. Leave empty to auto-generate a globally unique name (cr<suffix>)."
       }
     },
-    "tags": {
-      "type": "object",
+    "backendContainerImageName": {
+      "type": "string",
+      "defaultValue": "km-api",
       "metadata": {
-        "__bicep_resource_derived_type!": {
-          "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
-        },
-        "description": "Optional. The tags to apply to all deployed Azure resources."
-      },
-      "defaultValue": {}
+        "description": "Optional. Backend container image name."
+      }
     },
-    "useExistingAiProject": {
-      "type": "bool",
-      "defaultValue": false,
+    "backendContainerImageTag": {
+      "type": "string",
+      "defaultValue": "latest",
+      "metadata": {
+        "description": "Optional. Backend container image tag."
+      }
+    },
+    "frontendContainerImageName": {
+      "type": "string",
+      "defaultValue": "km-app",
       "metadata": {
-        "description": "Set to true to reuse an existing Azure AI Foundry project instead of creating new AI resources"
+        "description": "Optional. Frontend container image name."
       }
     },
-    "existingAiFoundryServiceName": {
+    "frontendContainerImageTag": {
       "type": "string",
-      "defaultValue": "",
+      "defaultValue": "latest",
       "metadata": {
-        "description": "Name of the existing AI Services account (parent of the project)"
+        "description": "Optional. Frontend container image tag."
       }
     },
-    "existingAiFoundryProjectName": {
+    "appServicePlanSku": {
       "type": "string",
-      "defaultValue": "",
+      "defaultValue": "B3",
+      "allowedValues": [
+        "F1",
+        "D1",
+        "B1",
+        "B2",
+        "B3",
+        "S1",
+        "S2",
+        "S3",
+        "P1",
+        "P2",
+        "P3",
+        "P1v3",
+        "P1v4"
+      ],
       "metadata": {
-        "description": "Name of the existing AI Foundry project"
+        "description": "Optional. App Service Plan SKU."
       }
     },
-    "existingAiFoundryEndpoint": {
+    "kind": {
       "type": "string",
-      "defaultValue": "",
+      "defaultValue": "app,linux,container",
       "metadata": {
-        "description": "Endpoint of the existing AI Foundry AI Services (for OpenAI + CU)"
+        "description": "Kind of web app."
       }
     },
-    "existingAiSearchConnectionName": {
+    "azureAdTenantId": {
       "type": "string",
       "defaultValue": "",
       "metadata": {
-        "description": "Name of the AI Search connection in the existing AI Foundry project"
+        "description": "Optional. Azure AD tenant ID for authentication."
       }
     },
-    "deployCosmos": {
-      "type": "bool",
-      "defaultValue": false,
+    "azureAdClientId": {
+      "type": "string",
+      "defaultValue": "",
       "metadata": {
-        "description": "Set to true to also deploy Cosmos DB (not required — SQL is the primary database)"
+        "description": "Optional. Azure AD client ID for authentication."
       }
     },
     "adminApiKey": {
       "type": "securestring",
       "defaultValue": "",
       "metadata": {
-        "description": "Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable."
+        "description": "Optional. Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable."
       }
     },
-    "backendContainerImageName": {
+    "existingLogAnalyticsWorkspaceId": {
       "type": "string",
-      "defaultValue": "km-api",
+      "defaultValue": "",
       "metadata": {
-        "description": "Backend container image name (repository) to build and push to the provisioned ACR"
+        "description": "Optional. Resource ID of an existing Log Analytics workspace. Empty creates a new one."
       }
     },
-    "backendContainerImageTag": {
+    "existingFoundryProjectResourceId": {
       "type": "string",
-      "defaultValue": "latest",
+      "defaultValue": "",
       "metadata": {
-        "description": "Backend container image tag"
+        "description": "Optional. Resource ID of an existing AI Foundry project. Empty creates a new one."
       }
     },
-    "frontendContainerImageName": {
+    "deployingUserPrincipalType": {
       "type": "string",
-      "defaultValue": "km-app",
+      "defaultValue": "User",
+      "allowedValues": [
+        "User",
+        "ServicePrincipal"
+      ],
       "metadata": {
-        "description": "Frontend container image name (repository) to build and push to the provisioned ACR"
+        "description": "Optional. Principal type of the deploying user. Use ServicePrincipal for CI/CD pipelines with OIDC."
       }
     },
-    "frontendContainerImageTag": {
+    "tags": {
+      "type": "object",
+      "defaultValue": {},
+      "metadata": {
+        "description": "Optional. Tags to apply to all resources (AVM only)."
+      }
+    },
+    "enableTelemetry": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Optional. Enable/Disable usage telemetry for AVM modules."
+      }
+    },
+    "enableMonitoring": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enable monitoring (Log Analytics, App Insights, diagnostic settings)."
+      }
+    },
+    "enablePrivateNetworking": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enable private networking (VNet, private endpoints, DNS zones)."
+      }
+    },
+    "enableScalability": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enable scalability features (zone redundant App Service Plan)."
+      }
+    },
+    "enableRedundancy": {
+      "type": "bool",
+      "defaultValue": false,
+      "metadata": {
+        "description": "Optional. Enable redundancy (zone redundant Cosmos DB, multi-region failover)."
+      }
+    },
+    "vmAdminUsername": {
+      "type": "securestring",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. VM admin username (AVM-WAF only, when private networking is enabled)."
+      }
+    },
+    "vmAdminPassword": {
+      "type": "securestring",
+      "nullable": true,
+      "metadata": {
+        "description": "Optional. VM admin password (AVM-WAF only, when private networking is enabled)."
+      }
+    },
+    "vmSize": {
       "type": "string",
-      "defaultValue": "latest",
+      "defaultValue": "Standard_D2s_v5",
       "metadata": {
-        "description": "Frontend container image tag"
+        "description": "Optional. VM size for jumpbox (AVM-WAF only). Defaults to Standard_D2s_v5."
       }
     }
   },
   "variables": {
-    "$fxv#0": {
-      "ai": {
-        "aiSearch": "srch-",
-        "aiServices": "aisa-",
-        "aiFoundry": "aif-",
-        "aiFoundryProject": "aifp-"
-      },
-      "compute": {
-        "appServicePlan": "asp-",
-        "webApp": "app-"
-      },
-      "databases": {
-        "cosmosDBDatabase": "cosmos-",
-        "sqlDatabaseServer": "sql-",
-        "sqlDatabase": "sqldb-"
-      },
-      "managementGovernance": {
-        "applicationInsights": "appi-",
-        "logAnalyticsWorkspace": "log-",
-        "resourceGroup": "rg-"
-      },
-      "storage": {
-        "storageAccount": "st"
-      }
-    },
-    "abbrs": "[variables('$fxv#0')]",
-    "resourceToken": "[toLower(uniqueString(subscription().id, parameters('environmentName'), parameters('location')))]",
-    "existingTags": "[coalesce(resourceGroup().tags, createObject())]",
-    "aiSearchName": "[format('{0}{1}', variables('abbrs').ai.aiSearch, variables('resourceToken'))]",
-    "aiSearchConnectionName": "[format('search-connection-{0}', variables('resourceToken'))]",
-    "acrName": "[format('cr{0}', variables('resourceToken'))]",
-    "webServerFarmResourceName": "[format('{0}{1}', variables('abbrs').compute.appServicePlan, variables('resourceToken'))]",
-    "backendWebSiteResourceName": "[format('api-{0}', variables('resourceToken'))]",
-    "frontendWebSiteResourceName": "[format('app-{0}', variables('resourceToken'))]"
+    "isAvm": "[or(equals(parameters('deploymentFlavor'), 'avm'), equals(parameters('deploymentFlavor'), 'avm-waf'))]",
+    "isBicep": "[equals(parameters('deploymentFlavor'), 'bicep')]"
   },
-  "resources": [
-    {
-      "type": "Microsoft.Resources/tags",
-      "apiVersion": "2025-04-01",
-      "name": "default",
-      "properties": {
-        "tags": "[union(variables('existingTags'), parameters('tags'), createObject('TemplateName', 'KM-Generic', 'DeploymentName', deployment().name))]"
-      }
-    },
-    {
-      "condition": "[not(parameters('useExistingAiProject'))]",
+  "resources": {
+    "avmDeployment": {
+      "condition": "[variables('isAvm')]",
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2025-04-01",
-      "name": "ai-services",
+      "name": "[take(format('module.avm.{0}', parameters('solutionName')), 64)]",
       "properties": {
         "expressionEvaluationOptions": {
           "scope": "inner"
         },
         "mode": "Incremental",
         "parameters": {
-          "name": {
-            "value": "[format('{0}{1}', variables('abbrs').ai.aiFoundry, variables('resourceToken'))]"
+          "solutionName": {
+            "value": "[parameters('solutionName')]"
+          },
+          "solutionUniqueText": {
+            "value": "[parameters('solutionUniqueText')]"
           },
           "location": {
             "value": "[parameters('location')]"
           },
+          "azureAiServiceLocation": {
+            "value": "[parameters('azureAiServiceLocation')]"
+          },
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "enableTelemetry": {
+            "value": "[parameters('enableTelemetry')]"
+          },
+          "enableMonitoring": {
+            "value": "[parameters('enableMonitoring')]"
+          },
+          "enablePrivateNetworking": {
+            "value": "[parameters('enablePrivateNetworking')]"
+          },
+          "enableScalability": {
+            "value": "[parameters('enableScalability')]"
+          },
+          "enableRedundancy": {
+            "value": "[parameters('enableRedundancy')]"
+          },
+          "vmAdminUsername": {
+            "value": "[parameters('vmAdminUsername')]"
+          },
+          "vmAdminPassword": {
+            "value": "[parameters('vmAdminPassword')]"
+          },
+          "vmSize": {
+            "value": "[parameters('vmSize')]"
+          },
+          "deployCosmos": {
+            "value": "[parameters('deployCosmos')]"
+          },
+          "deploymentType": {
+            "value": "[parameters('deploymentType')]"
+          },
+          "gptModelName": {
+            "value": "[parameters('gptModelName')]"
+          },
+          "gptModelVersion": {
+            "value": "[parameters('gptModelVersion')]"
+          },
+          "gptDeploymentCapacity": {
+            "value": "[parameters('gptDeploymentCapacity')]"
+          },
+          "embeddingModel": {
+            "value": "[parameters('embeddingModel')]"
+          },
+          "embeddingDeploymentCapacity": {
+            "value": "[parameters('embeddingDeploymentCapacity')]"
+          },
           "kind": {
-            "value": "AIServices"
+            "value": "[parameters('kind')]"
           },
-          "sku": {
-            "value": "S0"
+          "containerRegistryName": {
+            "value": "[parameters('containerRegistryName')]"
           },
-          "customSubDomainName": {
-            "value": "[format('{0}{1}', variables('abbrs').ai.aiFoundry, variables('resourceToken'))]"
+          "appServicePlanSku": {
+            "value": "[parameters('appServicePlanSku')]"
           },
-          "projectName": {
-            "value": "[format('{0}{1}', variables('abbrs').ai.aiFoundryProject, variables('resourceToken'))]"
+          "backendContainerImageName": {
+            "value": "[parameters('backendContainerImageName')]"
           },
-          "projectDescription": {
-            "value": "Knowledge Mining AI Foundry Project"
+          "backendContainerImageTag": {
+            "value": "[parameters('backendContainerImageTag')]"
           },
-          "publicNetworkAccess": {
-            "value": "Enabled"
+          "frontendContainerImageName": {
+            "value": "[parameters('frontendContainerImageName')]"
           },
-          "restrictOutboundNetworkAccess": {
-            "value": false
+          "frontendContainerImageTag": {
+            "value": "[parameters('frontendContainerImageTag')]"
           },
-          "disableLocalAuth": {
-            "value": false
+          "azureAdTenantId": {
+            "value": "[parameters('azureAdTenantId')]"
           },
-          "restore": {
-            "value": false
+          "azureAdClientId": {
+            "value": "[parameters('azureAdClientId')]"
           },
-          "deployments": {
-            "value": [
-              {
-                "name": "[parameters('chatDeploymentName')]",
-                "model": {
-                  "format": "OpenAI",
-                  "name": "[parameters('chatDeploymentName')]",
-                  "version": "[parameters('gptModelVersion')]"
-                },
-                "sku": {
-                  "name": "GlobalStandard",
-                  "capacity": 150
-                }
-              },
-              {
-                "name": "[parameters('embeddingDeploymentName')]",
-                "model": {
-                  "format": "OpenAI",
-                  "name": "[parameters('embeddingDeploymentName')]",
-                  "version": "1"
-                },
-                "sku": {
-                  "name": "GlobalStandard",
-                  "capacity": 80
-                }
-              }
-            ]
+          "adminApiKey": {
+            "value": "[parameters('adminApiKey')]"
+          },
+          "existingLogAnalyticsWorkspaceId": {
+            "value": "[parameters('existingLogAnalyticsWorkspaceId')]"
+          },
+          "existingFoundryProjectResourceId": {
+            "value": "[parameters('existingFoundryProjectResourceId')]"
+          },
+          "deployingUserPrincipalType": {
+            "value": "[parameters('deployingUserPrincipalType')]"
           }
         },
         "template": {
@@ -272,1149 +421,432 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "3004554606298273106"
-            },
-            "name": "Cognitive Services",
-            "description": "This module deploys a Cognitive Service."
+              "version": "0.46.1.21595",
+              "templateHash": "2674927175993199895"
+            }
           },
-          "definitions": {
-            "privateEndpointOutputType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The name of the private endpoint."
-                  }
-                },
-                "resourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "The resource ID of the private endpoint."
-                  }
-                },
-                "groupId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "The group Id for the private endpoint Group."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "fqdn": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "FQDN that resolves to private endpoint IP address."
-                        }
-                      },
-                      "ipAddresses": {
-                        "type": "array",
-                        "items": {
-                          "type": "string"
-                        },
-                        "metadata": {
-                          "description": "A list of private IP addresses of the private endpoint."
-                        }
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "The custom DNS configurations of the private endpoint."
-                  }
-                },
-                "networkInterfaceResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "The IDs of the network interfaces associated with the private endpoint."
-                  }
-                }
-              },
+          "parameters": {
+            "solutionName": {
+              "type": "string",
+              "defaultValue": "kmgen",
+              "minLength": 3,
+              "maxLength": 16,
               "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for the private endpoint output."
+                "description": "Optional. A unique application/solution name used as base for all resource naming."
               }
             },
-            "deploymentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of cognitive service account deployment."
-                  }
-                },
-                "model": {
-                  "type": "object",
-                  "properties": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of Cognitive Services account deployment model."
-                      }
-                    },
-                    "format": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The format of Cognitive Services account deployment model."
-                      }
-                    },
-                    "version": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The version of Cognitive Services account deployment model."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. Properties of Cognitive Services account deployment model."
-                  }
-                },
-                "sku": {
-                  "type": "object",
-                  "properties": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the resource model definition representing SKU."
-                      }
-                    },
-                    "capacity": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The capacity of the resource model definition representing SKU."
-                      }
-                    },
-                    "tier": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The tier of the resource model definition representing SKU."
-                      }
-                    },
-                    "size": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The size of the resource model definition representing SKU."
-                      }
-                    },
-                    "family": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The family of the resource model definition representing SKU."
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource model definition representing SKU."
-                  }
-                },
-                "raiPolicyName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of RAI policy."
-                  }
-                },
-                "versionUpgradeOption": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The version upgrade option."
-                  }
-                }
-              },
+            "solutionUniqueText": {
+              "type": "string",
+              "defaultValue": "[substring(uniqueString(subscription().id, resourceGroup().name, parameters('solutionName')), 0, 5)]",
+              "maxLength": 5,
               "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for a cognitive services account deployment."
+                "description": "Optional. A unique text suffix appended to resource names for uniqueness."
               }
             },
-            "endpointType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Type of the endpoint."
-                  }
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "azd": {
+                  "type": "location"
                 },
-                "endpoint": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "The endpoint URI."
-                  }
-                }
-              },
+                "description": "Optional. Primary Azure region for resource deployment."
+              }
+            },
+            "azureAiServiceLocation": {
+              "type": "string",
+              "allowedValues": [
+                "australiaeast",
+                "swedencentral",
+                "southeastasia"
+              ],
               "metadata": {
-                "__bicep_export!": true,
-                "description": "The type for a cognitive services account endpoint."
+                "azd": {
+                  "type": "location",
+                  "usageName": [
+                    "OpenAI.GlobalStandard.gpt-5.2,150",
+                    "OpenAI.GlobalStandard.text-embedding-3-small,80"
+                  ]
+                },
+                "description": "Required. Location for AI Foundry and model deployments."
               }
             },
-            "_1.privateEndpointCustomDnsConfigType": {
+            "tags": {
               "type": "object",
-              "properties": {
-                "fqdn": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                  }
-                },
-                "ipAddresses": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "Required. A list of private IP addresses of the private endpoint."
-                  }
-                }
-              },
+              "defaultValue": {},
               "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
+                "description": "Optional. Tags to apply to all resources."
               }
             },
-            "_1.privateEndpointIpConfigurationType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the resource that is unique within a resource group."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "groupId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
-                    },
-                    "memberName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
-                    },
-                    "privateIPAddress": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. Properties of private endpoint IP configurations."
-                  }
-                }
-              },
+            "enableTelemetry": {
+              "type": "bool",
+              "defaultValue": true,
               "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
+                "description": "Optional. Enable/Disable usage telemetry for AVM modules."
               }
             },
-            "_1.privateEndpointPrivateDnsZoneGroupType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private DNS Zone Group."
-                  }
-                },
-                "privateDnsZoneGroupConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "name": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The name of the private DNS Zone Group config."
-                        }
-                      },
-                      "privateDnsZoneResourceId": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The resource id of the private DNS zone."
-                        }
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                  }
-                }
-              },
+            "enableMonitoring": {
+              "type": "bool",
+              "defaultValue": false,
               "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
+                "description": "Optional. Enable monitoring for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
               }
             },
-            "aiProjectOutputType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Name of the AI project."
-                  }
-                },
-                "resourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Resource ID of the AI project."
-                  }
-                },
-                "apiEndpoint": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. API endpoint for the AI project."
-                  }
-                },
-                "aiprojectSystemAssignedMIPrincipalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. System Assigned Managed Identity Principal Id of the AI project."
-                  }
-                }
-              },
+            "enablePrivateNetworking": {
+              "type": "bool",
+              "defaultValue": false,
               "metadata": {
-                "description": "Output type representing AI project information.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "project.bicep"
-                }
+                "description": "Optional. Enable private networking for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
               }
             },
-            "customerManagedKeyType": {
-              "type": "object",
-              "properties": {
-                "keyVaultResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
-                  }
-                },
-                "keyName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the customer managed key to use for encryption."
-                  }
-                },
-                "keyVersion": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, the deployment will use the latest version available at deployment time."
-                  }
-                },
-                "userAssignedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
-                  }
-                }
-              },
+            "enableScalability": {
+              "type": "bool",
+              "defaultValue": false,
               "metadata": {
-                "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type does not support auto-rotation of the customer-managed key.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
+                "description": "Optional. Enable scalability for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
               }
             },
-            "diagnosticSettingFullType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
-                      },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
-                      },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
+            "enableRedundancy": {
+              "type": "bool",
+              "defaultValue": false,
               "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
+                "description": "Optional. Enable redundancy for applicable resources, aligned with the Well Architected Framework recommendations. Defaults to false."
               }
             },
-            "lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
+            "vmAdminUsername": {
+              "type": "securestring",
+              "nullable": true,
               "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
+                "description": "Optional. The user name for the administrator account of the virtual machine. Required by Azure at provisioning time but not used for login when Entra ID is enabled."
               }
             },
-            "managedIdentityAllType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                  }
-                }
-              },
+            "vmAdminPassword": {
+              "type": "securestring",
+              "nullable": true,
               "metadata": {
-                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
+                "description": "Optional. The password for the administrator account of the virtual machine. Auto-generated if not provided. Not used for login when Entra ID is enabled."
               }
             },
-            "privateEndpointSingleServiceType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private Endpoint."
-                  }
-                },
-                "location": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The location to deploy the Private Endpoint to."
-                  }
-                },
-                "privateLinkServiceConnectionName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the private link connection to create."
-                  }
-                },
-                "service": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                  }
-                },
-                "subnetResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                  }
-                },
-                "resourceGroupResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                  }
-                },
-                "privateDnsZoneGroup": {
-                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                  }
-                },
-                "isManualConnection": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If Manual Private Link Connection is required."
-                  }
-                },
-                "manualConnectionRequestMessage": {
-                  "type": "string",
-                  "nullable": true,
-                  "maxLength": 140,
-                  "metadata": {
-                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Custom DNS configurations."
-                  }
-                },
-                "ipConfigurations": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                  }
-                },
-                "applicationSecurityGroupResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                  }
-                },
-                "customNetworkInterfaceName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                  }
-                },
-                "lock": {
-                  "$ref": "#/definitions/lockType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/roleAssignmentType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "tags": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                  }
-                },
-                "enableTelemetry": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enable/Disable usage telemetry for module."
-                  }
-                }
-              },
+            "vmSize": {
+              "type": "string",
+              "defaultValue": "Standard_D2s_v5",
               "metadata": {
-                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
+                "description": "Optional. The size of the virtual machine. Defaults to Standard_D2s_v5."
               }
             },
-            "roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
+            "deployCosmos": {
+              "type": "bool",
+              "defaultValue": false,
               "metadata": {
-                "description": "Required. The name of Cognitive Services account."
+                "description": "Optional. Set to true to also deploy Cosmos DB (not required — SQL is the primary database)."
               }
             },
-            "kind": {
+            "deploymentType": {
               "type": "string",
+              "defaultValue": "GlobalStandard",
               "allowedValues": [
-                "AIServices",
-                "AnomalyDetector",
-                "CognitiveServices",
-                "ComputerVision",
-                "ContentModerator",
-                "ContentSafety",
-                "ConversationalLanguageUnderstanding",
-                "CustomVision.Prediction",
-                "CustomVision.Training",
-                "Face",
-                "FormRecognizer",
-                "HealthInsights",
-                "ImmersiveReader",
-                "Internal.AllInOne",
-                "LUIS",
-                "LUIS.Authoring",
-                "LanguageAuthoring",
-                "MetricsAdvisor",
-                "OpenAI",
-                "Personalizer",
-                "QnAMaker.v2",
-                "SpeechServices",
-                "TextAnalytics",
-                "TextTranslation"
+                "Standard",
+                "GlobalStandard"
               ],
               "metadata": {
-                "description": "Required. Kind of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
-              }
-            },
-            "projectName": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. The name of the AI Foundry project to create."
-              }
-            },
-            "projectDescription": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional. The description of the AI Foundry project to create."
+                "description": "Optional. GPT model deployment type."
               }
             },
-            "sku": {
+            "gptModelName": {
               "type": "string",
-              "defaultValue": "S0",
-              "allowedValues": [
-                "C2",
-                "C3",
-                "C4",
-                "F0",
-                "F1",
-                "S",
-                "S0",
-                "S1",
-                "S10",
-                "S2",
-                "S3",
-                "S4",
-                "S5",
-                "S6",
-                "S7",
-                "S8",
-                "S9"
-              ],
+              "defaultValue": "gpt-5.2",
               "metadata": {
-                "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+                "description": "Optional. Name of the GPT model to deploy."
               }
             },
-            "location": {
+            "gptModelVersion": {
               "type": "string",
-              "defaultValue": "[resourceGroup().location]",
+              "defaultValue": "2025-12-11",
               "metadata": {
-                "description": "Optional. Location for all Resources."
+                "description": "Optional. Version of the GPT model to deploy."
               }
             },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingFullType"
-              },
-              "nullable": true,
+            "gptDeploymentCapacity": {
+              "type": "int",
+              "defaultValue": 150,
+              "minValue": 10,
               "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
+                "description": "Optional. Capacity of the GPT deployment (TPM in thousands)."
               }
             },
-            "publicNetworkAccess": {
+            "embeddingModel": {
               "type": "string",
-              "nullable": true,
+              "defaultValue": "text-embedding-3-small",
               "allowedValues": [
-                "Enabled",
-                "Disabled"
+                "text-embedding-3-small"
               ],
               "metadata": {
-                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
-              }
-            },
-            "customSubDomainName": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Conditional. Subdomain name used for token-based authentication. Required if 'networkAcls' or 'privateEndpoints' are set."
+                "description": "Optional. Name of the embedding model to deploy."
               }
             },
-            "networkAcls": {
-              "type": "object",
-              "nullable": true,
+            "embeddingDeploymentCapacity": {
+              "type": "int",
+              "defaultValue": 80,
+              "minValue": 10,
               "metadata": {
-                "description": "Optional. A collection of rules governing the accessibility from specific network locations."
+                "description": "Optional. Capacity of the embedding model deployment."
               }
             },
-            "networkInjectionSubnetResourceId": {
+            "containerRegistryName": {
               "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The network injection subnet resource Id for the Cognitive Services account. This allows to use the AI Services account with a virtual network."
-              }
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointSingleServiceType"
-              },
-              "nullable": true,
+              "defaultValue": "",
               "metadata": {
-                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                "description": "Optional. Name of the Azure Container Registry. Leave empty to auto-generate a globally unique name (cr<suffix>)."
               }
             },
-            "lock": {
-              "$ref": "#/definitions/lockType",
-              "nullable": true,
+            "backendContainerImageName": {
+              "type": "string",
+              "defaultValue": "km-api",
               "metadata": {
-                "description": "Optional. The lock settings of the service."
+                "description": "Optional. Backend container image name."
               }
             },
-            "roleAssignments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/roleAssignmentType"
-              },
-              "nullable": true,
+            "backendContainerImageTag": {
+              "type": "string",
+              "defaultValue": "latest",
               "metadata": {
-                "description": "Optional. Array of role assignments to create."
+                "description": "Optional. Backend container image tag."
               }
             },
-            "tags": {
-              "type": "object",
-              "nullable": true,
+            "frontendContainerImageName": {
+              "type": "string",
+              "defaultValue": "km-app",
               "metadata": {
-                "description": "Optional. Tags of the resource."
+                "description": "Optional. Frontend container image name."
               }
             },
-            "allowedFqdnList": {
-              "type": "array",
-              "nullable": true,
+            "frontendContainerImageTag": {
+              "type": "string",
+              "defaultValue": "latest",
               "metadata": {
-                "description": "Optional. List of allowed FQDN."
+                "description": "Optional. Frontend container image tag."
               }
             },
-            "apiProperties": {
-              "type": "object",
-              "nullable": true,
+            "appServicePlanSku": {
+              "type": "string",
+              "defaultValue": "B3",
+              "allowedValues": [
+                "F1",
+                "D1",
+                "B1",
+                "B2",
+                "B3",
+                "S1",
+                "S2",
+                "S3",
+                "P1",
+                "P2",
+                "P3",
+                "P1v3",
+                "P1v4"
+              ],
               "metadata": {
-                "description": "Optional. The API properties for special APIs."
+                "description": "Optional. App Service Plan SKU."
               }
             },
-            "disableLocalAuth": {
-              "type": "bool",
-              "defaultValue": false,
+            "kind": {
+              "type": "string",
+              "defaultValue": "app,linux,container",
               "metadata": {
-                "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons."
+                "description": "Kind of web app."
               }
             },
-            "customerManagedKey": {
-              "$ref": "#/definitions/customerManagedKeyType",
-              "nullable": true,
+            "azureAdTenantId": {
+              "type": "string",
+              "defaultValue": "",
               "metadata": {
-                "description": "Optional. The customer managed key definition."
+                "description": "Optional. Azure AD tenant ID for authentication."
               }
             },
-            "dynamicThrottlingEnabled": {
-              "type": "bool",
-              "defaultValue": false,
+            "azureAdClientId": {
+              "type": "string",
+              "defaultValue": "",
               "metadata": {
-                "description": "Optional. The flag to enable dynamic throttling."
+                "description": "Optional. Azure AD client ID for authentication."
               }
             },
-            "migrationToken": {
+            "adminApiKey": {
               "type": "securestring",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Resource migration token."
-              }
-            },
-            "restore": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Restore a soft-deleted cognitive service at deployment time. Defaults to true so re-deployments succeed when a previous azd down left a soft-deleted resource."
-              }
-            },
-            "restrictOutboundNetworkAccess": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Restrict outbound network access."
-              }
-            },
-            "userOwnedStorage": {
-              "type": "array",
-              "nullable": true,
+              "defaultValue": "",
               "metadata": {
-                "description": "Optional. The storage accounts for this resource."
+                "description": "Optional. Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable."
               }
             },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentityAllType",
-              "nullable": true,
+            "existingLogAnalyticsWorkspaceId": {
+              "type": "string",
+              "defaultValue": "",
               "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
+                "description": "Optional. Resource ID of an existing Log Analytics workspace (empty = create new)."
               }
             },
-            "deployments": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/deploymentType"
-              },
-              "nullable": true,
+            "existingFoundryProjectResourceId": {
+              "type": "string",
+              "defaultValue": "",
               "metadata": {
-                "description": "Optional. Array of deployments about cognitive service accounts to create."
+                "description": "Optional. Resource ID of an existing AI Foundry project (empty = create new)."
               }
             },
-            "existingFoundryProjectResourceId": {
+            "deployingUserPrincipalType": {
               "type": "string",
-              "defaultValue": "",
+              "defaultValue": "User",
+              "allowedValues": [
+                "User",
+                "ServicePrincipal"
+              ],
               "metadata": {
-                "description": "Optional. The resource ID of an existing Foundry project to use."
+                "description": "Optional. Principal type of the deploying user."
               }
             }
           },
           "variables": {
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-            "useExistingService": "[not(empty(parameters('existingFoundryProjectResourceId')))]",
-            "existingCognitiveServiceDetails": "[split(parameters('existingFoundryProjectResourceId'), '/')]"
-          },
-          "resources": {
-            "cMKKeyVault::cMKKey": {
-              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
-              "existing": true,
-              "type": "Microsoft.KeyVault/vaults/keys",
-              "apiVersion": "2024-11-01",
-              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-              "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+            "solutionSuffix": "[toLower(trim(replace(replace(replace(replace(replace(replace(format('{0}{1}', parameters('solutionName'), parameters('solutionUniqueText')), '-', ''), '_', ''), '.', ''), '/', ''), ' ', ''), '*', '')))]",
+            "containerRegistryResourceName": "[if(not(empty(parameters('containerRegistryName'))), parameters('containerRegistryName'), format('acrkm{0}', variables('solutionSuffix')))]",
+            "deployerInfo": "[deployer()]",
+            "deployingUserPrincipalId": "[variables('deployerInfo').objectId]",
+            "deployingUserPrincipalName": "[coalesce(tryGet(variables('deployerInfo'), 'userPrincipalName'), variables('deployerInfo').objectId)]",
+            "createdBy": "[if(contains(variables('deployerInfo'), 'userPrincipalName'), split(variables('deployerInfo').userPrincipalName, '@')[0], variables('deployerInfo').objectId)]",
+            "useExistingAIProject": "[not(empty(parameters('existingFoundryProjectResourceId')))]",
+            "existingTags": "[coalesce(resourceGroup().tags, createObject())]",
+            "resourceTags": "[union(variables('existingTags'), parameters('tags'), createObject('TemplateName', 'KM-Generic', 'CreatedBy', variables('createdBy'), 'DeploymentName', deployment().name, 'Type', if(parameters('enablePrivateNetworking'), 'WAF', 'Non-WAF')))]",
+            "replicaRegionPairs": {
+              "australiaeast": "australiasoutheast",
+              "centralus": "westus",
+              "eastasia": "japaneast",
+              "eastus": "centralus",
+              "eastus2": "centralus",
+              "japaneast": "eastasia",
+              "northeurope": "westeurope",
+              "southeastasia": "eastasia",
+              "uksouth": "westeurope",
+              "westeurope": "northeurope"
             },
-            "cMKKeyVault": {
-              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
-              "existing": true,
-              "type": "Microsoft.KeyVault/vaults",
-              "apiVersion": "2024-11-01",
-              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+            "replicaLocation": "[variables('replicaRegionPairs')[parameters('location')]]",
+            "cosmosDbHaRegionPairs": {
+              "australiaeast": "uksouth",
+              "centralus": "eastus2",
+              "eastasia": "southeastasia",
+              "eastus": "centralus",
+              "eastus2": "centralus",
+              "japaneast": "australiaeast",
+              "northeurope": "westeurope",
+              "southeastasia": "eastasia",
+              "uksouth": "westeurope",
+              "westeurope": "northeurope"
             },
-            "cMKUserAssignedIdentity": {
-              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
-              "existing": true,
-              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-              "apiVersion": "2024-11-30",
-              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
-              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
-              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
-            },
-            "cognitiveServiceNew": {
-              "condition": "[not(variables('useExistingService'))]",
-              "type": "Microsoft.CognitiveServices/accounts",
-              "apiVersion": "2025-06-01",
-              "name": "[parameters('name')]",
-              "kind": "[parameters('kind')]",
-              "identity": "[variables('identity')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "sku": {
-                "name": "[parameters('sku')]"
+            "cosmosDbHaLocation": "[variables('cosmosDbHaRegionPairs')[parameters('location')]]",
+            "privateDnsZones": [
+              "privatelink.cognitiveservices.azure.com",
+              "privatelink.openai.azure.com",
+              "privatelink.services.ai.azure.com",
+              "[format('privatelink.blob.{0}', environment().suffixes.storage)]",
+              "[format('privatelink.queue.{0}', environment().suffixes.storage)]",
+              "[format('privatelink.file.{0}', environment().suffixes.storage)]",
+              "[format('privatelink.dfs.{0}', environment().suffixes.storage)]",
+              "privatelink.documents.azure.com",
+              "[format('privatelink{0}', environment().suffixes.sqlServerHostname)]",
+              "privatelink.search.windows.net",
+              "privatelink.azurewebsites.net",
+              "privatelink.azurecr.io"
+            ],
+            "dnsZoneIndex": {
+              "cognitiveServices": 0,
+              "openAI": 1,
+              "aiServices": 2,
+              "storageBlob": 3,
+              "storageQueue": 4,
+              "storageFile": 5,
+              "storageDfs": 6,
+              "cosmosDB": 7,
+              "sqlServer": 8,
+              "search": 9,
+              "webApp": 10,
+              "containerRegistry": 11
+            },
+            "aiModelDeployments": [
+              {
+                "name": "[parameters('gptModelName')]",
+                "model": "[parameters('gptModelName')]",
+                "sku": {
+                  "name": "[parameters('deploymentType')]",
+                  "capacity": "[parameters('gptDeploymentCapacity')]"
+                },
+                "version": "[parameters('gptModelVersion')]",
+                "raiPolicyName": "Microsoft.Default"
               },
+              {
+                "name": "[parameters('embeddingModel')]",
+                "model": "[parameters('embeddingModel')]",
+                "sku": {
+                  "name": "GlobalStandard",
+                  "capacity": "[parameters('embeddingDeploymentCapacity')]"
+                },
+                "version": "1",
+                "raiPolicyName": "Microsoft.Default"
+              }
+            ],
+            "useExistingLogAnalytics": "[not(empty(parameters('existingLogAnalyticsWorkspaceId')))]",
+            "virtualMachineAvailabilityZone": 1,
+            "aiFoundryResourceGroupName": "[if(variables('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], resourceGroup().name)]",
+            "aiFoundrySubscriptionId": "[if(variables('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], subscription().subscriptionId)]",
+            "placeholderImageName": "DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
+          },
+          "resources": {
+            "resourceGroupTags": {
+              "type": "Microsoft.Resources/tags",
+              "apiVersion": "2024-11-01",
+              "name": "default",
               "properties": {
-                "customSubDomainName": "[parameters('customSubDomainName')]",
-                "allowProjectManagement": true,
-                "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray()), 'bypass', coalesce(tryGet(parameters('networkAcls'), 'bypass'), 'None')), null())]",
-                "publicNetworkAccess": "[if(not(equals(parameters('publicNetworkAccess'), null())), parameters('publicNetworkAccess'), if(not(empty(parameters('networkAcls'))), 'Enabled', 'Disabled'))]",
-                "allowedFqdnList": "[parameters('allowedFqdnList')]",
-                "apiProperties": "[parameters('apiProperties')]",
-                "disableLocalAuth": "[parameters('disableLocalAuth')]",
-                "networkInjections": "[if(not(equals(parameters('networkInjectionSubnetResourceId'), null())), createArray(createObject('scenario', 'agent', 'subnetArmId', parameters('networkInjectionSubnetResourceId'), 'useMicrosoftManagedNetwork', false())), null())]",
-                "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keySource', 'Microsoft.KeyVault', 'keyVaultProperties', createObject('identityClientId', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyVaultUri', reference('cMKKeyVault').vaultUri, 'keyName', parameters('customerManagedKey').keyName, 'keyVersion', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), tryGet(parameters('customerManagedKey'), 'keyVersion'), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null())]",
-                "migrationToken": "[parameters('migrationToken')]",
-                "restore": "[parameters('restore')]",
-                "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]",
-                "userOwnedStorage": "[parameters('userOwnedStorage')]",
-                "dynamicThrottlingEnabled": "[parameters('dynamicThrottlingEnabled')]"
-              },
-              "dependsOn": [
-                "cMKKeyVault",
-                "cMKKeyVault::cMKKey",
-                "cMKUserAssignedIdentity"
-              ]
+                "tags": "[variables('resourceTags')]"
+              }
             },
-            "cognitiveServiceExisting": {
-              "condition": "[variables('useExistingService')]",
+            "existingLogAnalyticsWorkspace": {
+              "condition": "[variables('useExistingLogAnalytics')]",
               "existing": true,
-              "type": "Microsoft.CognitiveServices/accounts",
-              "apiVersion": "2025-06-01",
-              "subscriptionId": "[variables('existingCognitiveServiceDetails')[2]]",
-              "resourceGroup": "[variables('existingCognitiveServiceDetails')[4]]",
-              "name": "[variables('existingCognitiveServiceDetails')[8]]"
-            },
-            "cognitive_service_dependencies": {
-              "condition": "[and(not(variables('useExistingService')), not(empty(parameters('projectName'))))]",
+              "type": "Microsoft.OperationalInsights/workspaces",
+              "apiVersion": "2025-07-01",
+              "subscriptionId": "[split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2]]",
+              "resourceGroup": "[split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]]",
+              "name": "[split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]]"
+            },
+            "log_analytics": {
+              "condition": "[and(parameters('enableMonitoring'), not(variables('useExistingLogAnalytics')))]",
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2025-04-01",
-              "name": "[format('cognitive_service_dependencies-{0}', uniqueString('cognitive_service_dependencies', deployment().name))]",
+              "name": "[take(format('module.log-analytics.{0}', parameters('solutionName')), 64)]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "projectName": {
-                    "value": "[parameters('projectName')]"
-                  },
-                  "projectDescription": {
-                    "value": "[parameters('projectDescription')]"
-                  },
-                  "name": {
-                    "value": "[parameters('name')]"
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
                   },
                   "location": {
                     "value": "[parameters('location')]"
                   },
-                  "deployments": {
-                    "value": "[parameters('deployments')]"
-                  },
-                  "diagnosticSettings": {
-                    "value": "[parameters('diagnosticSettings')]"
-                  },
-                  "lock": {
-                    "value": "[parameters('lock')]"
+                  "tags": {
+                    "value": "[parameters('tags')]"
                   },
-                  "privateEndpoints": {
-                    "value": "[parameters('privateEndpoints')]"
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
                   },
-                  "roleAssignments": {
-                    "value": "[parameters('roleAssignments')]"
+                  "retentionInDays": {
+                    "value": 365
                   },
-                  "sku": {
-                    "value": "[parameters('sku')]"
+                  "publicNetworkAccessForIngestion": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                  "publicNetworkAccessForQuery": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                  "enableReplication": {
+                    "value": "[parameters('enableRedundancy')]"
                   },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  }
+                  "replicationLocation": "[if(parameters('enableRedundancy'), createObject('value', variables('replicaLocation')), createObject('value', ''))]",
+                  "dailyQuotaGb": "[if(parameters('enableRedundancy'), createObject('value', '150'), createObject('value', ''))]",
+                  "dataSources": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('tags', parameters('tags'), 'eventLogName', 'Application', 'eventTypes', createArray(createObject('eventType', 'Error'), createObject('eventType', 'Warning'), createObject('eventType', 'Information')), 'kind', 'WindowsEvent', 'name', 'applicationEvent'), createObject('counterName', '% Processor Time', 'instanceName', '*', 'intervalSeconds', 60, 'kind', 'WindowsPerformanceCounter', 'name', 'windowsPerfCounter1', 'objectName', 'Processor'))), createObject('value', createArray()))]"
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -1423,488 +855,74732 @@
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.44.1.10279",
-                      "templateHash": "15040137489848152723"
+                      "version": "0.46.1.21595",
+                      "templateHash": "5005969515455354504"
                     }
                   },
-                  "definitions": {
-                    "privateEndpointOutputType": {
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('log-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the Log Analytics workspace. Defaults to log-{solutionName}."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
                       "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The name of the private endpoint."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resource ID of the private endpoint."
-                          }
-                        },
-                        "groupId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "The group Id for the private endpoint Group."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "fqdn": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "FQDN that resolves to private endpoint IP address."
-                                }
-                              },
-                              "ipAddresses": {
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                },
-                                "metadata": {
-                                  "description": "A list of private IP addresses of the private endpoint."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "The custom DNS configurations of the private endpoint."
-                          }
-                        },
-                        "networkInterfaceResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                          }
-                        }
-                      },
+                      "defaultValue": {},
                       "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the private endpoint output."
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "retentionInDays": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "metadata": {
+                        "description": "Retention period in days. WAF recommends 365."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "PerGB2018",
+                      "metadata": {
+                        "description": "SKU name for the workspace."
                       }
                     },
-                    "deploymentType": {
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "publicNetworkAccessForIngestion": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access for ingestion."
+                      }
+                    },
+                    "publicNetworkAccessForQuery": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access for query."
+                      }
+                    },
+                    "enableReplication": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable workspace replication for redundancy."
+                      }
+                    },
+                    "replicationLocation": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Replication location (paired region)."
+                      }
+                    },
+                    "dailyQuotaGb": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Daily quota in GB. WAF recommends 150 GB/day as starting point."
+                      }
+                    },
+                    "dataSources": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Data sources for VM monitoring (Windows events, perf counters)."
+                      }
+                    },
+                    "managedIdentities": {
                       "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of cognitive service account deployment."
-                          }
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "workspace": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.operational-insights.workspace.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
                         },
-                        "model": {
-                          "type": "object",
-                          "properties": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of Cognitive Services account deployment model."
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "dataRetention": {
+                            "value": "[parameters('retentionInDays')]"
+                          },
+                          "skuName": {
+                            "value": "[parameters('skuName')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          },
+                          "features": {
+                            "value": {
+                              "enableLogAccessUsingOnlyResourcePermissions": true
+                            }
+                          },
+                          "diagnosticSettings": {
+                            "value": [
+                              {
+                                "useThisWorkspace": true
                               }
+                            ]
+                          },
+                          "publicNetworkAccessForIngestion": {
+                            "value": "[parameters('publicNetworkAccessForIngestion')]"
+                          },
+                          "publicNetworkAccessForQuery": {
+                            "value": "[parameters('publicNetworkAccessForQuery')]"
+                          },
+                          "dailyQuotaGb": "[if(not(empty(parameters('dailyQuotaGb'))), createObject('value', parameters('dailyQuotaGb')), createObject('value', null()))]",
+                          "replication": "[if(parameters('enableReplication'), createObject('value', createObject('enabled', true(), 'location', parameters('replicationLocation'))), createObject('value', null()))]",
+                          "dataSources": "[if(not(empty(parameters('dataSources'))), createObject('value', parameters('dataSources')), createObject('value', null()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "14099489006827800075"
                             },
-                            "format": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The format of Cognitive Services account deployment model."
+                            "name": "Log Analytics Workspaces",
+                            "description": "This module deploys a Log Analytics Workspace."
+                          },
+                          "definitions": {
+                            "diagnosticSettingType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "useThisWorkspace": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
                               }
                             },
-                            "version": {
-                              "type": "string",
+                            "gallerySolutionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
+                                  }
+                                },
+                                "plan": {
+                                  "$ref": "#/definitions/solutionPlanType",
+                                  "metadata": {
+                                    "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Required. The version of Cognitive Services account deployment model."
+                                "__bicep_export!": true,
+                                "description": "Properties of the gallery solutions to be created in the log analytics workspace."
                               }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of Cognitive Services account deployment model."
-                          }
-                        },
-                        "sku": {
-                          "type": "object",
-                          "properties": {
-                            "name": {
-                              "type": "string",
+                            },
+                            "storageInsightsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the storage account to be linked."
+                                  }
+                                },
+                                "containers": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The names of the blob containers that the workspace should read."
+                                  }
+                                },
+                                "tables": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. List of tables to be read by the workspace."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Required. The name of the resource model definition representing SKU."
+                                "__bicep_export!": true,
+                                "description": "Properties of the storage insights configuration."
                               }
                             },
-                            "capacity": {
-                              "type": "int",
-                              "nullable": true,
+                            "linkedServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the linked service. E.g., 'Automation' for an automation account, or 'Cluster' for a Log Analytics Cluster."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require read access (e.g., Automation Accounts)."
+                                  }
+                                },
+                                "writeAccessResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require write access (e.g., Log Analytics Clusters)."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Optional. The capacity of the resource model definition representing SKU."
+                                "__bicep_export!": true,
+                                "description": "Properties of the linked service."
                               }
                             },
-                            "tier": {
-                              "type": "string",
-                              "nullable": true,
+                            "linkedStorageAccountType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the link."
+                                  }
+                                },
+                                "storageAccountIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "minLength": 1,
+                                  "metadata": {
+                                    "description": "Required. Linked storage accounts resources Ids."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Optional. The tier of the resource model definition representing SKU."
+                                "__bicep_export!": true,
+                                "description": "Properties of the linked storage account."
                               }
                             },
-                            "size": {
-                              "type": "string",
-                              "nullable": true,
+                            "savedSearchType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the saved search."
+                                  }
+                                },
+                                "etag": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
+                                  }
+                                },
+                                "category": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The category of the saved search. This helps the user to find a saved search faster."
+                                  }
+                                },
+                                "displayName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Display name for the search."
+                                  }
+                                },
+                                "functionAlias": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The function alias if query serves as a function."
+                                  }
+                                },
+                                "functionParameters": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
+                                  }
+                                },
+                                "query": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The query expression for the saved search."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "array",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The tags attached to the saved search."
+                                  }
+                                },
+                                "version": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The version number of the query language. The current version is 2 and is the default."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Optional. The size of the resource model definition representing SKU."
+                                "__bicep_export!": true,
+                                "description": "Properties of the saved search."
                               }
                             },
-                            "family": {
-                              "type": "string",
-                              "nullable": true,
+                            "dataExportType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the data export."
+                                  }
+                                },
+                                "destination": {
+                                  "$ref": "#/definitions/destinationType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The destination of the data export."
+                                  }
+                                },
+                                "enable": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable the data export."
+                                  }
+                                },
+                                "tableNames": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The list of table names to export."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Optional. The family of the resource model definition representing SKU."
+                                "__bicep_export!": true,
+                                "description": "Properties of the data export."
                               }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource model definition representing SKU."
-                          }
-                        },
-                        "raiPolicyName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of RAI policy."
-                          }
-                        },
-                        "versionUpgradeOption": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The version upgrade option."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a cognitive services account deployment."
-                      }
-                    },
-                    "endpointType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Type of the endpoint."
-                          }
-                        },
-                        "endpoint": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "The endpoint URI."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a cognitive services account endpoint."
-                      }
-                    },
-                    "_1.privateEndpointCustomDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointIpConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
+                            },
+                            "dataSourceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the data source."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The kind of data source."
+                                  }
+                                },
+                                "linkedResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource id of the resource that will be linked to the workspace."
+                                  }
+                                },
+                                "eventLogName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the event log to configure when kind is WindowsEvent."
+                                  }
+                                },
+                                "eventTypes": {
+                                  "type": "array",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The event types to configure when kind is WindowsEvent."
+                                  }
+                                },
+                                "objectName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                                  }
+                                },
+                                "instanceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                                  }
+                                },
+                                "intervalSeconds": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                                  }
+                                },
+                                "performanceCounters": {
+                                  "type": "array",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
+                                  }
+                                },
+                                "counterName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
+                                  }
+                                },
+                                "state": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
+                                  }
+                                },
+                                "syslogName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. System log to configure when kind is LinuxSyslog."
+                                  }
+                                },
+                                "syslogSeverities": {
+                                  "type": "array",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Severities to configure when kind is LinuxSyslog."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to configure in the resource."
+                                  },
+                                  "nullable": true
+                                }
+                              },
                               "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                "__bicep_export!": true,
+                                "description": "Properties of the data source."
                               }
                             },
-                            "memberName": {
-                              "type": "string",
+                            "tableType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the table."
+                                  }
+                                },
+                                "plan": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The plan for the table."
+                                  }
+                                },
+                                "restoredLogs": {
+                                  "$ref": "#/definitions/restoredLogsType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The restored logs for the table."
+                                  }
+                                },
+                                "schema": {
+                                  "$ref": "#/definitions/schemaType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The schema for the table."
+                                  }
+                                },
+                                "searchResults": {
+                                  "$ref": "#/definitions/searchResultsType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The search results for the table."
+                                  }
+                                },
+                                "retentionInDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "minValue": 4,
+                                  "maxValue": 730,
+                                  "metadata": {
+                                    "description": "Optional. The retention in days for the table. Don't provide to use the default workspace retention."
+                                  }
+                                },
+                                "totalRetentionInDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "minValue": 4,
+                                  "maxValue": 2555,
+                                  "metadata": {
+                                    "description": "Optional. The total retention in days for the table. Don't provide use the default table retention."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The role assignments for the table."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                "__bicep_export!": true,
+                                "description": "Properties of the custom table."
                               }
                             },
-                            "privateIPAddress": {
-                              "type": "string",
+                            "workspaceFeaturesType": {
+                              "type": "object",
+                              "properties": {
+                                "disableLocalAuth": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Disable Non-EntraID based Auth. Default is true."
+                                  }
+                                },
+                                "enableDataExport": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Flag that indicate if data should be exported."
+                                  }
+                                },
+                                "enableLogAccessUsingOnlyResourcePermissions": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable log access using only resource permissions. Default is false."
+                                  }
+                                },
+                                "immediatePurgeDataOn30Days": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Flag that describes if we want to remove the data after 30 days."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                "__bicep_export!": true,
+                                "description": "Features of the workspace."
                               }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointPrivateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "name": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. The name of the private DNS Zone Group config."
+                            },
+                            "workspaceReplicationType": {
+                              "type": "object",
+                              "properties": {
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether the replication is enabled or not. When true, workspace configuration and data is replicated to the specified location."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Conditional. The location to which the workspace is replicated. Required if replication is enabled."
+                                  }
                                 }
                               },
-                              "privateDnsZoneResourceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of the private DNS zone."
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "Replication properties of the workspace."
+                              }
+                            },
+                            "_1.columnType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The column name."
+                                  }
+                                },
+                                "type": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "boolean",
+                                    "dateTime",
+                                    "dynamic",
+                                    "guid",
+                                    "int",
+                                    "long",
+                                    "real",
+                                    "string"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The column type."
+                                  }
+                                },
+                                "dataTypeHint": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "armPath",
+                                    "guid",
+                                    "ip",
+                                    "uri"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The column data type logical hint."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The column description."
+                                  }
+                                },
+                                "displayName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Column display name."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The parameters of the table column.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "table/main.bicep"
                                 }
                               }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "aiProjectOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the AI project."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Resource ID of the AI project."
-                          }
-                        },
-                        "apiEndpoint": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. API endpoint for the AI project."
-                          }
-                        },
-                        "aiprojectSystemAssignedMIPrincipalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. System Assigned Managed Identity Principal Id of the AI project."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "Output type representing AI project information.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "project.bicep"
-                        }
-                      }
-                    },
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                            },
+                            "destinationType": {
+                              "type": "object",
+                              "properties": {
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The destination resource ID."
+                                  }
+                                },
+                                "metaData": {
+                                  "type": "object",
+                                  "properties": {
+                                    "eventHubName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The destination metadata."
+                                  }
                                 }
                               },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                              "metadata": {
+                                "description": "The data export destination properties.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "data-export/main.bicep"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
                                 }
                               },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
                                 }
                               }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
                                 }
                               },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
                                 }
                               }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                            },
+                            "restoredLogsType": {
+                              "type": "object",
+                              "properties": {
+                                "sourceTable": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The table to restore data from."
+                                  }
+                                },
+                                "startRestoreTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to start the restore from (UTC)."
+                                  }
+                                },
+                                "endRestoreTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to end the restore by (UTC)."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The parameters of the restore operation that initiated the table.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "table/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "schemaType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The table name."
+                                  }
+                                },
+                                "columns": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.columnType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of table custom columns."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The table description."
+                                  }
+                                },
+                                "displayName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The table display name."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The table schema.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "table/main.bicep"
+                                }
+                              }
+                            },
+                            "searchResultsType": {
+                              "type": "object",
+                              "properties": {
+                                "query": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The search job query."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The search description."
+                                  }
+                                },
+                                "limit": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Limit the search job to return up to specified number of rows."
+                                  }
+                                },
+                                "startSearchTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to start the search from (UTC)."
+                                  }
+                                },
+                                "endSearchTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to end the search by (UTC)."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The parameters of the search job that initiated the table.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "table/main.bicep"
+                                }
+                              }
+                            },
+                            "solutionPlanType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
+                                  }
+                                },
+                                "product": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
+                                  }
+                                },
+                                "publisher": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/operations-management/solution:0.3.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Log Analytics workspace."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "skuName": {
+                              "type": "string",
+                              "defaultValue": "PerGB2018",
+                              "allowedValues": [
+                                "CapacityReservation",
+                                "Free",
+                                "LACluster",
+                                "PerGB2018",
+                                "PerNode",
+                                "Premium",
+                                "Standalone",
+                                "Standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The name of the SKU. Must be 'LACluster' to be linked to a Log Analytics cluster."
+                              }
+                            },
+                            "skuCapacityReservationLevel": {
+                              "type": "int",
+                              "defaultValue": 100,
+                              "minValue": 100,
+                              "maxValue": 5000,
+                              "metadata": {
+                                "description": "Optional. The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. Must be in increments of 100 between 100 and 5000."
+                              }
+                            },
+                            "storageInsightsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/storageInsightsConfigType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of storage accounts to be read by the workspace."
+                              }
+                            },
+                            "linkedServices": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/linkedServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of services to be linked."
+                              }
+                            },
+                            "linkedStorageAccounts": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/linkedStorageAccountType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. List of Storage Accounts to be linked. Required if 'forceCmkForQuery' is set to 'true' and 'savedSearches' is not empty."
+                              }
+                            },
+                            "savedSearches": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/savedSearchType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Kusto Query Language searches to save."
+                              }
+                            },
+                            "dataExports": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/dataExportType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. LAW data export instances to be deployed."
+                              }
+                            },
+                            "dataSources": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/dataSourceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. LAW data sources to configure."
+                              }
+                            },
+                            "tables": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/tableType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. LAW custom tables to be deployed."
+                              }
+                            },
+                            "gallerySolutions": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/gallerySolutionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of gallerySolutions to be created in the log analytics workspace."
+                              }
+                            },
+                            "onboardWorkspaceToSentinel": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Onboard the Log Analytics Workspace to Sentinel. Requires 'SecurityInsights' solution to be in gallerySolutions."
+                              }
+                            },
+                            "dataRetention": {
+                              "type": "int",
+                              "defaultValue": 365,
+                              "minValue": 0,
+                              "maxValue": 730,
+                              "metadata": {
+                                "description": "Optional. Number of days data will be retained for."
+                              }
+                            },
+                            "dailyQuotaGb": {
+                              "type": "string",
+                              "defaultValue": "-1",
+                              "metadata": {
+                                "description": "Optional. The workspace daily quota for ingestion in GB. Supports decimal values. Example: '0.5' for 0.5 GB, '2' for 2 GB. Default is '-1' (no limit)."
+                              }
+                            },
+                            "defaultDataCollectionRuleResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the default Data Collection Rule to use for this workspace. Note: the default DCR is not applicable on workspace creation and the workspace must be listed as a destination in the DCR."
+                              }
+                            },
+                            "publicNetworkAccessForIngestion": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled",
+                                "SecuredByPerimeter"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The network access type for accessing Log Analytics ingestion."
+                              }
+                            },
+                            "publicNetworkAccessForQuery": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled",
+                                "SecuredByPerimeter"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The network access type for accessing Log Analytics query."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource. Only one type of identity is supported: system-assigned or user-assigned, but not both."
+                              }
+                            },
+                            "features": {
+                              "$ref": "#/definitions/workspaceFeaturesType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The workspace features."
+                              }
+                            },
+                            "replication": {
+                              "$ref": "#/definitions/workspaceReplicationType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The workspace replication properties."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "forceCmkForQuery": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Indicates whether customer managed storage is mandatory for query management."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.OperationalInsights/workspaces@2025-07-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                              "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                              "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "Security Admin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb1c8493-542b-48eb-b624-b4c8fea62acd')]",
+                              "Security Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '39bc4728-0917-49c7-9d2c-d95423bc2eb4')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.operationalinsights-workspace.{0}.{1}', replace('0.15.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "logAnalyticsWorkspace": {
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-07-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "features": {
+                                  "searchVersion": 1,
+                                  "enableLogAccessUsingOnlyResourcePermissions": "[coalesce(tryGet(parameters('features'), 'enableLogAccessUsingOnlyResourcePermissions'), false())]",
+                                  "disableLocalAuth": "[coalesce(tryGet(parameters('features'), 'disableLocalAuth'), true())]",
+                                  "enableDataExport": "[tryGet(parameters('features'), 'enableDataExport')]",
+                                  "immediatePurgeDataOn30Days": "[tryGet(parameters('features'), 'immediatePurgeDataOn30Days')]"
+                                },
+                                "sku": {
+                                  "name": "[parameters('skuName')]",
+                                  "capacityReservationLevel": "[if(equals(parameters('skuName'), 'CapacityReservation'), parameters('skuCapacityReservationLevel'), null())]"
+                                },
+                                "retentionInDays": "[parameters('dataRetention')]",
+                                "workspaceCapping": {
+                                  "dailyQuotaGb": "[json(parameters('dailyQuotaGb'))]"
+                                },
+                                "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                                "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                                "forceCmkForQuery": "[parameters('forceCmkForQuery')]",
+                                "replication": "[parameters('replication')]",
+                                "defaultDataCollectionRuleResourceId": "[parameters('defaultDataCollectionRuleResourceId')]"
+                              },
+                              "identity": "[variables('identity')]"
+                            },
+                            "logAnalyticsWorkspace_diagnosticSettings": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[if(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'useThisWorkspace'), false()), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_sentinelOnboarding": {
+                              "condition": "[and(not(empty(filter(coalesce(parameters('gallerySolutions'), createArray()), lambda('item', startsWith(lambdaVariables('item').name, 'SecurityInsights'))))), parameters('onboardWorkspaceToSentinel'))]",
+                              "type": "Microsoft.SecurityInsights/onboardingStates",
+                              "apiVersion": "2025-09-01",
+                              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                              "name": "default",
+                              "properties": {},
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_roleAssignments": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_storageInsightConfigs": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_storageInsightConfigs",
+                                "count": "[length(coalesce(parameters('storageInsightsConfigs'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-LAW-StorageInsightsConfig-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "logAnalyticsWorkspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "containers": {
+                                    "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'containers')]"
+                                  },
+                                  "tables": {
+                                    "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'tables')]"
+                                  },
+                                  "storageAccountResourceId": {
+                                    "value": "[coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()].storageAccountResourceId]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "140290971998938797"
+                                    },
+                                    "name": "Log Analytics Workspace Storage Insight Configs",
+                                    "description": "This module deploys a Log Analytics Workspace Storage Insight Config."
+                                  },
+                                  "parameters": {
+                                    "logAnalyticsWorkspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[format('{0}-stinsconfig', last(split(parameters('storageAccountResourceId'), '/')))]",
+                                      "metadata": {
+                                        "description": "Optional. The name of the storage insights config."
+                                      }
+                                    },
+                                    "storageAccountResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The Azure Resource Manager ID of the storage account resource."
+                                      }
+                                    },
+                                    "containers": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The names of the blob containers that the workspace should read."
+                                      }
+                                    },
+                                    "tables": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The names of the Azure tables that the workspace should read."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs@2025-07-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to configure in the resource."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                    },
+                                    "workspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.OperationalInsights/workspaces",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                                    },
+                                    "storageinsightconfig": {
+                                      "type": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "containers": "[parameters('containers')]",
+                                        "tables": "[parameters('tables')]",
+                                        "storageAccount": {
+                                          "id": "[parameters('storageAccountResourceId')]",
+                                          "key": "[listKeys('storageAccount', '2025-06-01').keys[0].value]"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed storage insights configuration."
+                                      },
+                                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/storageInsightConfigs', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group where the storage insight configuration is deployed."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the storage insights configuration."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_linkedServices": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_linkedServices",
+                                "count": "[length(coalesce(parameters('linkedServices'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-LAW-LinkedService-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "logAnalyticsWorkspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('linkedServices'), createArray())[copyIndex()].name]"
+                                  },
+                                  "resourceId": {
+                                    "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'resourceId')]"
+                                  },
+                                  "writeAccessResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'writeAccessResourceId')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "14482465616812596213"
+                                    },
+                                    "name": "Log Analytics Workspace Linked Services",
+                                    "description": "This module deploys a Log Analytics Workspace Linked Service."
+                                  },
+                                  "parameters": {
+                                    "logAnalyticsWorkspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the link."
+                                      }
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
+                                      }
+                                    },
+                                    "writeAccessResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.OperationalInsights/workspaces/linkedServices@2025-07-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to configure in the resource."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "workspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.OperationalInsights/workspaces",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                                    },
+                                    "linkedService": {
+                                      "type": "Microsoft.OperationalInsights/workspaces/linkedServices",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "resourceId": "[parameters('resourceId')]",
+                                        "writeAccessResourceId": "[parameters('writeAccessResourceId')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed linked service."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed linked service."
+                                      },
+                                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedServices', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group where the linked service is deployed."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_linkedStorageAccounts": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_linkedStorageAccounts",
+                                "count": "[length(coalesce(parameters('linkedStorageAccounts'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-LAW-LinkedStorageAccount-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "logAnalyticsWorkspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].name]"
+                                  },
+                                  "storageAccountIds": {
+                                    "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].storageAccountIds]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "14864721709229272590"
+                                    },
+                                    "name": "Log Analytics Workspace Linked Storage Accounts",
+                                    "description": "This module deploys a Log Analytics Workspace Linked Storage Account."
+                                  },
+                                  "parameters": {
+                                    "logAnalyticsWorkspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Query",
+                                        "Alerts",
+                                        "CustomLogs",
+                                        "AzureWatson"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Name of the link."
+                                      }
+                                    },
+                                    "storageAccountIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "minLength": 1,
+                                      "metadata": {
+                                        "description": "Required. Linked storage accounts resources Ids."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "workspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.OperationalInsights/workspaces",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                                    },
+                                    "linkedStorageAccount": {
+                                      "type": "Microsoft.OperationalInsights/workspaces/linkedStorageAccounts",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                                      "properties": {
+                                        "storageAccountIds": "[parameters('storageAccountIds')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed linked storage account."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed linked storage account."
+                                      },
+                                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedStorageAccounts', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group where the linked storage account is deployed."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_savedSearches": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_savedSearches",
+                                "count": "[length(coalesce(parameters('savedSearches'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-LAW-SavedSearch-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "logAnalyticsWorkspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[format('{0}{1}', coalesce(parameters('savedSearches'), createArray())[copyIndex()].name, uniqueString(subscription().id, resourceGroup().id))]"
+                                  },
+                                  "etag": {
+                                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'etag')]"
+                                  },
+                                  "displayName": {
+                                    "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].displayName]"
+                                  },
+                                  "category": {
+                                    "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].category]"
+                                  },
+                                  "query": {
+                                    "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].query]"
+                                  },
+                                  "functionAlias": {
+                                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionAlias')]"
+                                  },
+                                  "functionParameters": {
+                                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionParameters')]"
+                                  },
+                                  "tags": {
+                                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'tags')]"
+                                  },
+                                  "version": {
+                                    "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'version')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "17904092372918022238"
+                                    },
+                                    "name": "Log Analytics Workspace Saved Searches",
+                                    "description": "This module deploys a Log Analytics Workspace Saved Search."
+                                  },
+                                  "parameters": {
+                                    "logAnalyticsWorkspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the saved search."
+                                      }
+                                    },
+                                    "displayName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Display name for the search."
+                                      }
+                                    },
+                                    "category": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Query category."
+                                      }
+                                    },
+                                    "query": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Kusto Query to be stored."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.OperationalInsights/workspaces/savedSearches@2025-07-01#properties/properties/properties/tags"
+                                        },
+                                        "description": "Optional. Tags to configure in the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "functionAlias": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The function alias if query serves as a function."
+                                      }
+                                    },
+                                    "functionParameters": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: \"param-name1:type1 = default_value1, param-name2:type2 = default_value2\". For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
+                                      }
+                                    },
+                                    "version": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The version number of the query language."
+                                      }
+                                    },
+                                    "etag": {
+                                      "type": "string",
+                                      "defaultValue": "*",
+                                      "metadata": {
+                                        "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "workspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.OperationalInsights/workspaces",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                                    },
+                                    "savedSearch": {
+                                      "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                                      "properties": {
+                                        "etag": "[parameters('etag')]",
+                                        "tags": "[coalesce(parameters('tags'), createArray())]",
+                                        "displayName": "[parameters('displayName')]",
+                                        "category": "[parameters('category')]",
+                                        "query": "[parameters('query')]",
+                                        "functionAlias": "[parameters('functionAlias')]",
+                                        "functionParameters": "[parameters('functionParameters')]",
+                                        "version": "[parameters('version')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed saved search."
+                                      },
+                                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group where the saved search is deployed."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed saved search."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace",
+                                "logAnalyticsWorkspace_linkedStorageAccounts"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_dataExports": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_dataExports",
+                                "count": "[length(coalesce(parameters('dataExports'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-LAW-DataExport-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "workspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('dataExports'), createArray())[copyIndex()].name]"
+                                  },
+                                  "destination": {
+                                    "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'destination')]"
+                                  },
+                                  "enable": {
+                                    "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'enable')]"
+                                  },
+                                  "tableNames": {
+                                    "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'tableNames')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "17943947755417749524"
+                                    },
+                                    "name": "Log Analytics Workspace Data Exports",
+                                    "description": "This module deploys a Log Analytics Workspace Data Export."
+                                  },
+                                  "definitions": {
+                                    "destinationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The destination resource ID."
+                                          }
+                                        },
+                                        "metaData": {
+                                          "type": "object",
+                                          "properties": {
+                                            "eventHubName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The destination metadata."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The data export destination properties."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "minLength": 4,
+                                      "maxLength": 63,
+                                      "metadata": {
+                                        "description": "Required. The data export rule name."
+                                      }
+                                    },
+                                    "workspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "destination": {
+                                      "$ref": "#/definitions/destinationType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Destination properties."
+                                      }
+                                    },
+                                    "enable": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Active when enabled."
+                                      }
+                                    },
+                                    "tableNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "minLength": 1,
+                                      "metadata": {
+                                        "description": "Required. An array of tables to export, for example: ['Heartbeat', 'SecurityEvent']."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "workspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.OperationalInsights/workspaces",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[parameters('workspaceName')]"
+                                    },
+                                    "dataExport": {
+                                      "type": "Microsoft.OperationalInsights/workspaces/dataExports",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                                      "properties": {
+                                        "destination": "[parameters('destination')]",
+                                        "enable": "[parameters('enable')]",
+                                        "tableNames": "[parameters('tableNames')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the data export."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the data export."
+                                      },
+                                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataExports', parameters('workspaceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the data export was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_dataSources": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_dataSources",
+                                "count": "[length(coalesce(parameters('dataSources'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-LAW-DataSource-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "logAnalyticsWorkspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].name]"
+                                  },
+                                  "kind": {
+                                    "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].kind]"
+                                  },
+                                  "linkedResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'linkedResourceId')]"
+                                  },
+                                  "eventLogName": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventLogName')]"
+                                  },
+                                  "eventTypes": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventTypes')]"
+                                  },
+                                  "objectName": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'objectName')]"
+                                  },
+                                  "instanceName": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'instanceName')]"
+                                  },
+                                  "intervalSeconds": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'intervalSeconds')]"
+                                  },
+                                  "counterName": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'counterName')]"
+                                  },
+                                  "state": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'state')]"
+                                  },
+                                  "syslogName": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogName')]"
+                                  },
+                                  "syslogSeverities": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogSeverities')]"
+                                  },
+                                  "performanceCounters": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'performanceCounters')]"
+                                  },
+                                  "tags": {
+                                    "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'tags')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "15360290236166491819"
+                                    },
+                                    "name": "Log Analytics Workspace Datasources",
+                                    "description": "This module deploys a Log Analytics Workspace Data Source."
+                                  },
+                                  "parameters": {
+                                    "logAnalyticsWorkspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the data source."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "defaultValue": "AzureActivityLog",
+                                      "allowedValues": [
+                                        "AzureActivityLog",
+                                        "WindowsEvent",
+                                        "WindowsPerformanceCounter",
+                                        "IISLogs",
+                                        "LinuxSyslog",
+                                        "LinuxSyslogCollection",
+                                        "LinuxPerformanceObject",
+                                        "LinuxPerformanceCollection"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The kind of the data source."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-07-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to configure in the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "linkedResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource ID of the resource to be linked."
+                                      }
+                                    },
+                                    "eventLogName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Windows event log name to configure when kind is WindowsEvent."
+                                      }
+                                    },
+                                    "eventTypes": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. Windows event types to configure when kind is WindowsEvent."
+                                      }
+                                    },
+                                    "objectName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                                      }
+                                    },
+                                    "instanceName": {
+                                      "type": "string",
+                                      "defaultValue": "*",
+                                      "metadata": {
+                                        "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                                      }
+                                    },
+                                    "intervalSeconds": {
+                                      "type": "int",
+                                      "defaultValue": 60,
+                                      "metadata": {
+                                        "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                                      }
+                                    },
+                                    "performanceCounters": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
+                                      }
+                                    },
+                                    "counterName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
+                                      }
+                                    },
+                                    "state": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
+                                      }
+                                    },
+                                    "syslogName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. System log to configure when kind is LinuxSyslog."
+                                      }
+                                    },
+                                    "syslogSeverities": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. Severities to configure when kind is LinuxSyslog."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "workspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.OperationalInsights/workspaces",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                                    },
+                                    "dataSource": {
+                                      "type": "Microsoft.OperationalInsights/workspaces/dataSources",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                                      "kind": "[parameters('kind')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "linkedResourceId": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'AzureActivityLog')), parameters('linkedResourceId'), null())]",
+                                        "eventLogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventLogName'), null())]",
+                                        "eventTypes": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventTypes'), null())]",
+                                        "objectName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('objectName'), null())]",
+                                        "instanceName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('instanceName'), null())]",
+                                        "intervalSeconds": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('intervalSeconds'), null())]",
+                                        "counterName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsPerformanceCounter')), parameters('counterName'), null())]",
+                                        "state": "[if(and(not(empty(parameters('kind'))), or(or(equals(parameters('kind'), 'IISLogs'), equals(parameters('kind'), 'LinuxSyslogCollection')), equals(parameters('kind'), 'LinuxPerformanceCollection'))), parameters('state'), null())]",
+                                        "syslogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxSyslog')), parameters('syslogName'), null())]",
+                                        "syslogSeverities": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'LinuxSyslog'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('syslogSeverities'), null())]",
+                                        "performanceCounters": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxPerformanceObject')), parameters('performanceCounters'), null())]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed data source."
+                                      },
+                                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataSources', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group where the data source is deployed."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed data source."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_tables": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_tables",
+                                "count": "[length(coalesce(parameters('tables'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-LAW-Table-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "workspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                                  },
+                                  "plan": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'plan')]"
+                                  },
+                                  "schema": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'schema')]"
+                                  },
+                                  "retentionInDays": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'retentionInDays')]"
+                                  },
+                                  "totalRetentionInDays": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'totalRetentionInDays')]"
+                                  },
+                                  "restoredLogs": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'restoredLogs')]"
+                                  },
+                                  "searchResults": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'searchResults')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "18383178824663161801"
+                                    },
+                                    "name": "Log Analytics Workspace Tables",
+                                    "description": "This module deploys a Log Analytics Workspace Table."
+                                  },
+                                  "definitions": {
+                                    "restoredLogsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "sourceTable": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The table to restore data from."
+                                          }
+                                        },
+                                        "startRestoreTime": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The timestamp to start the restore from (UTC)."
+                                          }
+                                        },
+                                        "endRestoreTime": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The timestamp to end the restore by (UTC)."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The parameters of the restore operation that initiated the table."
+                                      }
+                                    },
+                                    "schemaType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The table name."
+                                          }
+                                        },
+                                        "columns": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/columnType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of table custom columns."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The table description."
+                                          }
+                                        },
+                                        "displayName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The table display name."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The table schema."
+                                      }
+                                    },
+                                    "columnType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The column name."
+                                          }
+                                        },
+                                        "type": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "boolean",
+                                            "dateTime",
+                                            "dynamic",
+                                            "guid",
+                                            "int",
+                                            "long",
+                                            "real",
+                                            "string"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The column type."
+                                          }
+                                        },
+                                        "dataTypeHint": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "armPath",
+                                            "guid",
+                                            "ip",
+                                            "uri"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The column data type logical hint."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The column description."
+                                          }
+                                        },
+                                        "displayName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Column display name."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The parameters of the table column."
+                                      }
+                                    },
+                                    "searchResultsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "query": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The search job query."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The search description."
+                                          }
+                                        },
+                                        "limit": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Limit the search job to return up to specified number of rows."
+                                          }
+                                        },
+                                        "startSearchTime": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The timestamp to start the search from (UTC)."
+                                          }
+                                        },
+                                        "endSearchTime": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The timestamp to end the search by (UTC)."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The parameters of the search job that initiated the table."
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the table."
+                                      }
+                                    },
+                                    "workspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "plan": {
+                                      "type": "string",
+                                      "defaultValue": "Analytics",
+                                      "allowedValues": [
+                                        "Basic",
+                                        "Analytics"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Instruct the system how to handle and charge the logs ingested to this table."
+                                      }
+                                    },
+                                    "restoredLogs": {
+                                      "$ref": "#/definitions/restoredLogsType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Restore parameters."
+                                      }
+                                    },
+                                    "retentionInDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 4,
+                                      "maxValue": 730,
+                                      "metadata": {
+                                        "description": "Optional. The table retention in days, between 4 and 730. Don't provide to use the default workspace retention."
+                                      }
+                                    },
+                                    "schema": {
+                                      "$ref": "#/definitions/schemaType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Table's schema."
+                                      }
+                                    },
+                                    "searchResults": {
+                                      "$ref": "#/definitions/searchResultsType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Parameters of the search job that initiated this table."
+                                      }
+                                    },
+                                    "totalRetentionInDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 4,
+                                      "maxValue": 2555,
+                                      "metadata": {
+                                        "description": "Optional. The table total retention in days, between 4 and 2555. Don't provide use the default table retention."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                                      "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                                      "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "workspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.OperationalInsights/workspaces",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[parameters('workspaceName')]"
+                                    },
+                                    "table": {
+                                      "type": "Microsoft.OperationalInsights/workspaces/tables",
+                                      "apiVersion": "2025-07-01",
+                                      "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                                      "properties": {
+                                        "plan": "[parameters('plan')]",
+                                        "restoredLogs": "[parameters('restoredLogs')]",
+                                        "retentionInDays": "[coalesce(parameters('retentionInDays'), -1)]",
+                                        "schema": "[parameters('schema')]",
+                                        "searchResults": "[parameters('searchResults')]",
+                                        "totalRetentionInDays": "[coalesce(parameters('totalRetentionInDays'), -1)]"
+                                      }
+                                    },
+                                    "table_roleAssignments": {
+                                      "copy": {
+                                        "name": "table_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}/tables/{1}', parameters('workspaceName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "table"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the table."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the table."
+                                      },
+                                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the table was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            },
+                            "logAnalyticsWorkspace_solutions": {
+                              "copy": {
+                                "name": "logAnalyticsWorkspace_solutions",
+                                "count": "[length(coalesce(parameters('gallerySolutions'), createArray()))]"
+                              },
+                              "condition": "[not(empty(parameters('gallerySolutions')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-LAW-Solution-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].name]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "logAnalyticsWorkspaceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "plan": {
+                                    "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].plan]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.32.4.45862",
+                                      "templateHash": "10255889523646649592"
+                                    },
+                                    "name": "Operations Management Solutions",
+                                    "description": "This module deploys an Operations Management Solution.",
+                                    "owner": "Azure/module-maintainers"
+                                  },
+                                  "definitions": {
+                                    "solutionPlanType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
+                                          }
+                                        },
+                                        "product": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
+                                          }
+                                        },
+                                        "publisher": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
+                                      }
+                                    },
+                                    "plan": {
+                                      "$ref": "#/definitions/solutionPlanType",
+                                      "metadata": {
+                                        "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
+                                      }
+                                    },
+                                    "logAnalyticsWorkspaceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the Log Analytics workspace where the solution will be deployed/enabled."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.operationsmanagement-solution.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "logAnalyticsWorkspace": {
+                                      "existing": true,
+                                      "type": "Microsoft.OperationalInsights/workspaces",
+                                      "apiVersion": "2021-06-01",
+                                      "name": "[parameters('logAnalyticsWorkspaceName')]"
+                                    },
+                                    "solution": {
+                                      "type": "Microsoft.OperationsManagement/solutions",
+                                      "apiVersion": "2015-11-01-preview",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "properties": {
+                                        "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
+                                      },
+                                      "plan": {
+                                        "name": "[coalesce(tryGet(parameters('plan'), 'name'), parameters('name'))]",
+                                        "promotionCode": "",
+                                        "product": "[parameters('plan').product]",
+                                        "publisher": "[coalesce(tryGet(parameters('plan'), 'publisher'), 'Microsoft')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed solution."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed solution."
+                                      },
+                                      "value": "[resourceId('Microsoft.OperationsManagement/solutions', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group where the solution is deployed."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('solution', '2015-11-01-preview', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "logAnalyticsWorkspace"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed log analytics workspace."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed log analytics workspace."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed log analytics workspace."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "logAnalyticsWorkspaceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The ID associated with the workspace."
+                              },
+                              "value": "[reference('logAnalyticsWorkspace').customerId]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('logAnalyticsWorkspace', '2025-07-01', 'full').location]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('logAnalyticsWorkspace', '2025-07-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "primarySharedKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The primary shared key of the log analytics workspace."
+                              },
+                              "value": "[listKeys('logAnalyticsWorkspace', '2025-07-01').primarySharedKey]"
+                            },
+                            "secondarySharedKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The secondary shared key of the log analytics workspace."
+                              },
+                              "value": "[listKeys('logAnalyticsWorkspace', '2025-07-01').secondarySharedKey]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Log Analytics workspace."
+                      },
+                      "value": "[reference('workspace').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the Log Analytics workspace."
+                      },
+                      "value": "[reference('workspace').outputs.name.value]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Location of the workspace."
+                      },
+                      "value": "[parameters('location')]"
+                    },
+                    "logAnalyticsWorkspaceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Log Analytics workspace customer ID."
+                      },
+                      "value": "[reference('workspace').outputs.logAnalyticsWorkspaceId.value]"
+                    }
+                  }
+                }
+              }
+            },
+            "app_insights": {
+              "condition": "[parameters('enableMonitoring')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.app-insights.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "workspaceResourceId": "[if(variables('useExistingLogAnalytics'), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8])), if(parameters('enableMonitoring'), createObject('value', reference('log_analytics').outputs.resourceId.value), createObject('value', '')))]",
+                  "retentionInDays": {
+                    "value": 365
+                  },
+                  "disableIpMasking": {
+                    "value": false
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1077806126224374403"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('appi-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the Application Insights instance. Defaults to appi-{solutionName}."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "workspaceResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Log Analytics workspace to link to."
+                      }
+                    },
+                    "applicationType": {
+                      "type": "string",
+                      "defaultValue": "web",
+                      "metadata": {
+                        "description": "Application type."
+                      }
+                    },
+                    "retentionInDays": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "metadata": {
+                        "description": "Retention period in days. WAF recommends 365."
+                      }
+                    },
+                    "disableIpMasking": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Disable IP masking for security. WAF recommends false."
+                      }
+                    },
+                    "flowType": {
+                      "type": "string",
+                      "defaultValue": "Bluefield",
+                      "metadata": {
+                        "description": "Flow type for Application Insights."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "web",
+                      "metadata": {
+                        "description": "Kind of Application Insights resource."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.insights.component.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "workspaceResourceId": {
+                            "value": "[parameters('workspaceResourceId')]"
+                          },
+                          "kind": {
+                            "value": "[parameters('kind')]"
+                          },
+                          "applicationType": {
+                            "value": "[parameters('applicationType')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "retentionInDays": {
+                            "value": "[parameters('retentionInDays')]"
+                          },
+                          "disableIpMasking": {
+                            "value": "[parameters('disableIpMasking')]"
+                          },
+                          "flowType": {
+                            "value": "[parameters('flowType')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "17358780145253914698"
+                            },
+                            "name": "Application Insights",
+                            "description": "This component deploys an Application Insights instance."
+                          },
+                          "definitions": {
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Application Insights."
+                              }
+                            },
+                            "applicationType": {
+                              "type": "string",
+                              "defaultValue": "web",
+                              "allowedValues": [
+                                "web",
+                                "other"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Application type."
+                              }
+                            },
+                            "workspaceResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property."
+                              }
+                            },
+                            "disableIpMasking": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Disable IP masking. Default value is set to true."
+                              }
+                            },
+                            "disableLocalAuth": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Disable Non-AAD based Auth. Default value is set to false."
+                              }
+                            },
+                            "forceCustomerStorageForProfiler": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Force users to create their own storage account for profiler and debugger."
+                              }
+                            },
+                            "linkedStorageAccountResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Linked storage account resource ID."
+                              }
+                            },
+                            "publicNetworkAccessForIngestion": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled."
+                              }
+                            },
+                            "publicNetworkAccessForQuery": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled."
+                              }
+                            },
+                            "retentionInDays": {
+                              "type": "int",
+                              "defaultValue": 365,
+                              "allowedValues": [
+                                30,
+                                60,
+                                90,
+                                120,
+                                180,
+                                270,
+                                365,
+                                550,
+                                730
+                              ],
+                              "metadata": {
+                                "description": "Optional. Retention period in days."
+                              }
+                            },
+                            "samplingPercentage": {
+                              "type": "int",
+                              "defaultValue": 100,
+                              "minValue": 0,
+                              "maxValue": 100,
+                              "metadata": {
+                                "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry."
+                              }
+                            },
+                            "flowType": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Used by the Application Insights system to determine what kind of flow this component was created by. This is to be set to 'Bluefield' when creating/updating a component via the REST API."
+                              }
+                            },
+                            "requestSource": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Describes what tool created this Application Insights component. Customers using this API should set this to the default 'rest'."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone."
+                              }
+                            },
+                            "immediatePurgeDataOn30Days": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Purge data immediately after 30 days."
+                              }
+                            },
+                            "ingestionMode": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "ApplicationInsights",
+                                "ApplicationInsightsWithDiagnosticSettings",
+                                "LogAnalytics"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Indicates the flow of the ingestion."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Insights/components@2020-02-02#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                              "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+                              "Application Insights Component Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e')]",
+                              "Application Insights Snapshot Debugger": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08954f03-6346-4c2e-81c0-ec3a5cfae23b')]",
+                              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.7.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "appInsights": {
+                              "type": "Microsoft.Insights/components",
+                              "apiVersion": "2020-02-02",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "kind": "[parameters('kind')]",
+                              "properties": {
+                                "Application_Type": "[parameters('applicationType')]",
+                                "DisableIpMasking": "[parameters('disableIpMasking')]",
+                                "DisableLocalAuth": "[parameters('disableLocalAuth')]",
+                                "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]",
+                                "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
+                                "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                                "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                                "RetentionInDays": "[parameters('retentionInDays')]",
+                                "SamplingPercentage": "[parameters('samplingPercentage')]",
+                                "Flow_Type": "[parameters('flowType')]",
+                                "Request_Source": "[parameters('requestSource')]",
+                                "ImmediatePurgeDataOn30Days": "[parameters('immediatePurgeDataOn30Days')]",
+                                "IngestionMode": "[parameters('ingestionMode')]"
+                              }
+                            },
+                            "appInsights_roleAssignments": {
+                              "copy": {
+                                "name": "appInsights_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "appInsights"
+                              ]
+                            },
+                            "appInsights_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "appInsights"
+                              ]
+                            },
+                            "appInsights_diagnosticSettings": {
+                              "copy": {
+                                "name": "appInsights_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "appInsights"
+                              ]
+                            },
+                            "linkedStorageAccount": {
+                              "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appInsightsName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "storageAccountResourceId": {
+                                    "value": "[coalesce(parameters('linkedStorageAccountResourceId'), '')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "5059808225314360251"
+                                    },
+                                    "name": "Application Insights Linked Storage Account",
+                                    "description": "This component deploys an Application Insights Linked Storage Account."
+                                  },
+                                  "parameters": {
+                                    "appInsightsName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "storageAccountResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Linked storage account resource ID."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "microsoft.insights/components/linkedStorageAccounts",
+                                      "apiVersion": "2020-03-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]",
+                                      "properties": {
+                                        "linkedStorageAccount": "[parameters('storageAccountResourceId')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Linked Storage Account."
+                                      },
+                                      "value": "ServiceProfiler"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Linked Storage Account."
+                                      },
+                                      "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the agent pool was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "appInsights"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the application insights component."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the application insights component."
+                              },
+                              "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the application insights component was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "applicationId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The application ID of the application insights component."
+                              },
+                              "value": "[reference('appInsights').AppId]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('appInsights', '2020-02-02', 'full').location]"
+                            },
+                            "instrumentationKey": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component."
+                              },
+                              "value": "[reference('appInsights').InstrumentationKey]"
+                            },
+                            "connectionString": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Application Insights Connection String."
+                              },
+                              "value": "[reference('appInsights').ConnectionString]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Application Insights instance."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the Application Insights instance."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+                    },
+                    "instrumentationKey": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Instrumentation key for the Application Insights instance."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.instrumentationKey.value]"
+                    },
+                    "connectionString": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Connection string for the Application Insights instance."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.connectionString.value]"
+                    },
+                    "applicationId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Application ID of the Application Insights instance."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.component.{0}', parameters('name')), 64)), '2025-04-01').outputs.applicationId.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "log_analytics"
+              ]
+            },
+            "virtualNetwork": {
+              "condition": "[parameters('enablePrivateNetworking')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.virtual-network.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "addressPrefixes": {
+                    "value": [
+                      "10.0.0.0/20"
+                    ]
+                  },
+                  "logAnalyticsWorkspaceId": "[if(variables('useExistingLogAnalytics'), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8])), if(parameters('enableMonitoring'), createObject('value', reference('log_analytics').outputs.resourceId.value), createObject('value', '')))]",
+                  "resourceSuffix": {
+                    "value": "[variables('solutionSuffix')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "14375623146044395014"
+                    }
+                  },
+                  "definitions": {
+                    "subnetOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the subnet."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the subnet."
+                          }
+                        },
+                        "nsgName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The name of the associated NSG, if any."
+                          }
+                        },
+                        "nsgResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The resource ID of the associated NSG, if any."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Subnet output type"
+                      }
+                    },
+                    "subnetType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the subnet."
+                          }
+                        },
+                        "addressPrefixes": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. Address prefixes for the subnet."
+                          }
+                        },
+                        "delegation": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Delegation for the subnet."
+                          }
+                        },
+                        "privateEndpointNetworkPolicies": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled",
+                            "NetworkSecurityGroupEnabled",
+                            "RouteTableEnabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Private endpoint network policies."
+                          }
+                        },
+                        "privateLinkServiceNetworkPolicies": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Private link service network policies."
+                          }
+                        },
+                        "networkSecurityGroup": {
+                          "$ref": "#/definitions/networkSecurityGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. NSG configuration for the subnet."
+                          }
+                        },
+                        "routeTableResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Route table resource ID."
+                          }
+                        },
+                        "serviceEndpointPolicies": {
+                          "type": "array",
+                          "items": {
+                            "type": "object"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Service endpoint policies."
+                          }
+                        },
+                        "serviceEndpoints": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Service endpoints to enable."
+                          }
+                        },
+                        "defaultOutboundAccess": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Disable default outbound connectivity."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Subnet configuration type"
+                      }
+                    },
+                    "networkSecurityGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the NSG."
+                          }
+                        },
+                        "securityRules": {
+                          "type": "array",
+                          "items": {
+                            "type": "object"
+                          },
+                          "metadata": {
+                            "description": "Required. Security rules for the NSG."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "NSG configuration type"
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "addressPrefixes": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "Address prefixes for the virtual network."
+                      }
+                    },
+                    "subnets": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/subnetType"
+                      },
+                      "defaultValue": [
+                        {
+                          "name": "backend",
+                          "addressPrefixes": [
+                            "10.0.0.0/27"
+                          ],
+                          "networkSecurityGroup": {
+                            "name": "nsg-backend",
+                            "securityRules": [
+                              {
+                                "name": "deny-hop-outbound",
+                                "properties": {
+                                  "access": "Deny",
+                                  "destinationAddressPrefix": "*",
+                                  "destinationPortRanges": [
+                                    "22",
+                                    "3389"
+                                  ],
+                                  "direction": "Outbound",
+                                  "priority": 200,
+                                  "protocol": "Tcp",
+                                  "sourceAddressPrefix": "VirtualNetwork",
+                                  "sourcePortRange": "*"
+                                }
+                              }
+                            ]
+                          }
+                        },
+                        {
+                          "name": "containers",
+                          "addressPrefixes": [
+                            "10.0.2.0/23"
+                          ],
+                          "delegation": "Microsoft.App/environments",
+                          "privateEndpointNetworkPolicies": "Enabled",
+                          "privateLinkServiceNetworkPolicies": "Enabled",
+                          "networkSecurityGroup": {
+                            "name": "nsg-containers",
+                            "securityRules": [
+                              {
+                                "name": "deny-hop-outbound",
+                                "properties": {
+                                  "access": "Deny",
+                                  "destinationAddressPrefix": "*",
+                                  "destinationPortRanges": [
+                                    "22",
+                                    "3389"
+                                  ],
+                                  "direction": "Outbound",
+                                  "priority": 200,
+                                  "protocol": "Tcp",
+                                  "sourceAddressPrefix": "VirtualNetwork",
+                                  "sourcePortRange": "*"
+                                }
+                              }
+                            ]
+                          }
+                        },
+                        {
+                          "name": "webserverfarm",
+                          "addressPrefixes": [
+                            "10.0.4.0/27"
+                          ],
+                          "delegation": "Microsoft.Web/serverfarms",
+                          "privateEndpointNetworkPolicies": "Enabled",
+                          "privateLinkServiceNetworkPolicies": "Enabled",
+                          "networkSecurityGroup": {
+                            "name": "nsg-webserverfarm",
+                            "securityRules": [
+                              {
+                                "name": "deny-hop-outbound",
+                                "properties": {
+                                  "access": "Deny",
+                                  "destinationAddressPrefix": "*",
+                                  "destinationPortRanges": [
+                                    "22",
+                                    "3389"
+                                  ],
+                                  "direction": "Outbound",
+                                  "priority": 200,
+                                  "protocol": "Tcp",
+                                  "sourceAddressPrefix": "VirtualNetwork",
+                                  "sourcePortRange": "*"
+                                }
+                              }
+                            ]
+                          }
+                        },
+                        {
+                          "name": "administration",
+                          "addressPrefixes": [
+                            "10.0.0.32/27"
+                          ],
+                          "networkSecurityGroup": {
+                            "name": "nsg-administration",
+                            "securityRules": [
+                              {
+                                "name": "deny-hop-outbound",
+                                "properties": {
+                                  "access": "Deny",
+                                  "destinationAddressPrefix": "*",
+                                  "destinationPortRanges": [
+                                    "22",
+                                    "3389"
+                                  ],
+                                  "direction": "Outbound",
+                                  "priority": 200,
+                                  "protocol": "Tcp",
+                                  "sourceAddressPrefix": "VirtualNetwork",
+                                  "sourcePortRange": "*"
+                                }
+                              }
+                            ]
+                          }
+                        },
+                        {
+                          "name": "AzureBastionSubnet",
+                          "addressPrefixes": [
+                            "10.0.0.64/26"
+                          ],
+                          "networkSecurityGroup": {
+                            "name": "nsg-bastion",
+                            "securityRules": [
+                              {
+                                "name": "AllowGatewayManager",
+                                "properties": {
+                                  "access": "Allow",
+                                  "direction": "Inbound",
+                                  "priority": 2702,
+                                  "protocol": "*",
+                                  "sourcePortRange": "*",
+                                  "destinationPortRange": "443",
+                                  "sourceAddressPrefix": "GatewayManager",
+                                  "destinationAddressPrefix": "*"
+                                }
+                              },
+                              {
+                                "name": "AllowHttpsInBound",
+                                "properties": {
+                                  "access": "Allow",
+                                  "direction": "Inbound",
+                                  "priority": 2703,
+                                  "protocol": "*",
+                                  "sourcePortRange": "*",
+                                  "destinationPortRange": "443",
+                                  "sourceAddressPrefix": "Internet",
+                                  "destinationAddressPrefix": "*"
+                                }
+                              },
+                              {
+                                "name": "AllowSshRdpOutbound",
+                                "properties": {
+                                  "access": "Allow",
+                                  "direction": "Outbound",
+                                  "priority": 100,
+                                  "protocol": "*",
+                                  "sourcePortRange": "*",
+                                  "destinationPortRanges": [
+                                    "22",
+                                    "3389"
+                                  ],
+                                  "sourceAddressPrefix": "*",
+                                  "destinationAddressPrefix": "VirtualNetwork"
+                                }
+                              },
+                              {
+                                "name": "AllowAzureCloudOutbound",
+                                "properties": {
+                                  "access": "Allow",
+                                  "direction": "Outbound",
+                                  "priority": 110,
+                                  "protocol": "Tcp",
+                                  "sourcePortRange": "*",
+                                  "destinationPortRange": "443",
+                                  "sourceAddressPrefix": "*",
+                                  "destinationAddressPrefix": "AzureCloud"
+                                }
+                              }
+                            ]
+                          }
+                        }
+                      ],
+                      "metadata": {
+                        "description": "Subnet configurations."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resources."
+                      }
+                    },
+                    "logAnalyticsWorkspaceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Log Analytics Workspace for diagnostics."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "resourceSuffix": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Suffix for resource naming."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "name": "[format('vnet-{0}', parameters('solutionName'))]"
+                  },
+                  "resources": {
+                    "nsgs": {
+                      "copy": {
+                        "name": "nsgs",
+                        "count": "[length(parameters('subnets'))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "condition": "[not(empty(tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.network.nsg.{0}.{1}', tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup', 'name'), parameters('resourceSuffix')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[format('{0}-{1}', tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup', 'name'), parameters('resourceSuffix'))]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "securityRules": {
+                            "value": "[tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup', 'securityRules')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "7311263652424030280"
+                            },
+                            "name": "Network Security Groups",
+                            "description": "This module deploys a Network security Group (NSG)."
+                          },
+                          "definitions": {
+                            "securityRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the security rule."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "access": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Whether network traffic is allowed or denied."
+                                      }
+                                    },
+                                    "description": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The description of the security rule."
+                                      }
+                                    },
+                                    "destinationAddressPrefix": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Optional. The destination address prefix. CIDR or destination IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used."
+                                      }
+                                    },
+                                    "destinationAddressPrefixes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The destination address prefixes. CIDR or destination IP ranges."
+                                      }
+                                    },
+                                    "destinationApplicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource IDs of the application security groups specified as destination."
+                                      }
+                                    },
+                                    "destinationPortRange": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The destination port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                                      }
+                                    },
+                                    "destinationPortRanges": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The destination port ranges."
+                                      }
+                                    },
+                                    "direction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Inbound",
+                                        "Outbound"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The direction of the rule. The direction specifies if rule will be evaluated on incoming or outgoing traffic."
+                                      }
+                                    },
+                                    "priority": {
+                                      "type": "int",
+                                      "minValue": 100,
+                                      "maxValue": 4096,
+                                      "metadata": {
+                                        "description": "Required. Required. The priority of the rule. The value can be between 100 and 4096. The priority number must be unique for each rule in the collection. The lower the priority number, the higher the priority of the rule."
+                                      }
+                                    },
+                                    "protocol": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "*",
+                                        "Ah",
+                                        "Esp",
+                                        "Icmp",
+                                        "Tcp",
+                                        "Udp"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Network protocol this rule applies to."
+                                      }
+                                    },
+                                    "sourceAddressPrefix": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The CIDR or source IP range. Asterisk \"*\" can also be used to match all source IPs. Default tags such as \"VirtualNetwork\", \"AzureLoadBalancer\" and \"Internet\" can also be used. If this is an ingress rule, specifies where network traffic originates from."
+                                      }
+                                    },
+                                    "sourceAddressPrefixes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The CIDR or source IP ranges."
+                                      }
+                                    },
+                                    "sourceApplicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource IDs of the application security groups specified as source."
+                                      }
+                                    },
+                                    "sourcePortRange": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The source port or range. Integer or range between 0 and 65535. Asterisk \"*\" can also be used to match all ports."
+                                      }
+                                    },
+                                    "sourcePortRanges": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The source port ranges."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The properties of the security rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a security rule."
+                              }
+                            },
+                            "diagnosticSettingLogsOnlyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Network Security Group."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "securityRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/securityRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of Security Rules to deploy to the Network Security Group. When not provided, an NSG including only the built-in roles will be deployed."
+                              }
+                            },
+                            "flushConnection": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. When enabled, flows created from Network Security Group connections will be re-evaluated when rules are updates. Initial enablement will trigger re-evaluation. Network Security Group connection flushing is not available in all regions."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/networkSecurityGroups@2025-05-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the NSG resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-networksecuritygroup.{0}.{1}', replace('0.5.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "networkSecurityGroup": {
+                              "type": "Microsoft.Network/networkSecurityGroups",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "securityRules",
+                                    "count": "[length(coalesce(parameters('securityRules'), createArray()))]",
+                                    "input": {
+                                      "name": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].name]",
+                                      "properties": {
+                                        "access": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.access]",
+                                        "description": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'description'), '')]",
+                                        "destinationAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefix'), '')]",
+                                        "destinationAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationAddressPrefixes'), createArray())]",
+                                        "destinationApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationApplicationSecurityGroupResourceIds'), createArray()), lambda('destinationApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('destinationApplicationSecurityGroupResourceId'))))]",
+                                        "destinationPortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRange'), '')]",
+                                        "destinationPortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'destinationPortRanges'), createArray())]",
+                                        "direction": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.direction]",
+                                        "priority": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.priority]",
+                                        "protocol": "[coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties.protocol]",
+                                        "sourceAddressPrefix": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefix'), '')]",
+                                        "sourceAddressPrefixes": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceAddressPrefixes'), createArray())]",
+                                        "sourceApplicationSecurityGroups": "[map(coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourceApplicationSecurityGroupResourceIds'), createArray()), lambda('sourceApplicationSecurityGroupResourceId', createObject('id', lambdaVariables('sourceApplicationSecurityGroupResourceId'))))]",
+                                        "sourcePortRange": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRange'), '')]",
+                                        "sourcePortRanges": "[coalesce(tryGet(coalesce(parameters('securityRules'), createArray())[copyIndex('securityRules')].properties, 'sourcePortRanges'), createArray())]"
+                                      }
+                                    }
+                                  }
+                                ],
+                                "flushConnection": "[parameters('flushConnection')]"
+                              }
+                            },
+                            "networkSecurityGroup_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            },
+                            "networkSecurityGroup_diagnosticSettings": {
+                              "copy": {
+                                "name": "networkSecurityGroup_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            },
+                            "networkSecurityGroup_roleAssignments": {
+                              "copy": {
+                                "name": "networkSecurityGroup_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkSecurityGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "networkSecurityGroup"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the network security group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the network security group."
+                              },
+                              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the network security group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('networkSecurityGroup', '2025-05-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "virtualNetwork": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.network.virtual-network.{0}', variables('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[variables('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "addressPrefixes": {
+                            "value": "[parameters('addressPrefixes')]"
+                          },
+                          "subnets": {
+                            "copy": [
+                              {
+                                "name": "value",
+                                "count": "[length(parameters('subnets'))]",
+                                "input": "[createObject('name', parameters('subnets')[copyIndex('value')].name, 'addressPrefixes', tryGet(parameters('subnets')[copyIndex('value')], 'addressPrefixes'), 'networkSecurityGroupResourceId', if(not(empty(tryGet(parameters('subnets')[copyIndex('value')], 'networkSecurityGroup'))), reference(format('nsgs[{0}]', copyIndex('value'))).outputs.resourceId.value, null()), 'privateEndpointNetworkPolicies', tryGet(parameters('subnets')[copyIndex('value')], 'privateEndpointNetworkPolicies'), 'privateLinkServiceNetworkPolicies', tryGet(parameters('subnets')[copyIndex('value')], 'privateLinkServiceNetworkPolicies'), 'delegation', tryGet(parameters('subnets')[copyIndex('value')], 'delegation'))]"
+                              }
+                            ]
+                          },
+                          "diagnosticSettings": {
+                            "value": [
+                              {
+                                "name": "vnetDiagnostics",
+                                "workspaceResourceId": "[parameters('logAnalyticsWorkspaceId')]",
+                                "logCategoriesAndGroups": [
+                                  {
+                                    "categoryGroup": "allLogs",
+                                    "enabled": true
+                                  }
+                                ],
+                                "metricCategories": [
+                                  {
+                                    "category": "AllMetrics",
+                                    "enabled": true
+                                  }
+                                ]
+                              }
+                            ]
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "11272001757446231867"
+                            },
+                            "name": "Virtual Networks",
+                            "description": "This module deploys a Virtual Network (vNet)."
+                          },
+                          "definitions": {
+                            "peeringType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be peer-localVnetName-remoteVnetName."
+                                  }
+                                },
+                                "remoteVirtualNetworkResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                                  }
+                                },
+                                "allowForwardedTraffic": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                                  }
+                                },
+                                "allowGatewayTransit": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                                  }
+                                },
+                                "allowVirtualNetworkAccess": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                                  }
+                                },
+                                "doNotVerifyRemoteGateways": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Do not verify the provisioning state of the remote gateway. Default is true."
+                                  }
+                                },
+                                "useRemoteGateways": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                                  }
+                                },
+                                "remotePeeringEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Deploy the outbound and the inbound peering."
+                                  }
+                                },
+                                "remotePeeringName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the VNET Peering resource in the remove Virtual Network. If not provided, default value will be peer-remoteVnetName-localVnetName."
+                                  }
+                                },
+                                "remotePeeringAllowForwardedTraffic": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                                  }
+                                },
+                                "remotePeeringAllowGatewayTransit": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                                  }
+                                },
+                                "remotePeeringAllowVirtualNetworkAccess": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                                  }
+                                },
+                                "remotePeeringDoNotVerifyRemoteGateways": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Do not verify the provisioning state of the remote gateway. Default is true."
+                                  }
+                                },
+                                "remotePeeringUseRemoteGateways": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "subnetType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The Name of the subnet resource."
+                                  }
+                                },
+                                "addressPrefix": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
+                                  }
+                                },
+                                "addressPrefixes": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
+                                  }
+                                },
+                                "ipamPoolPrefixAllocations": {
+                                  "type": "array",
+                                  "prefixItems": [
+                                    {
+                                      "type": "object",
+                                      "properties": {
+                                        "pool": {
+                                          "type": "object",
+                                          "properties": {
+                                            "id": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The Resource ID of the IPAM pool."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The Resource ID of the IPAM pool."
+                                          }
+                                        },
+                                        "numberOfIpAddresses": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Number of IP addresses allocated from the pool."
+                                          }
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "items": false,
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Conditional. The address space for the subnet, deployed from IPAM Pool. Required if `addressPrefixes` and `addressPrefix` is empty and the VNet address space configured to use IPAM Pool."
+                                  }
+                                },
+                                "applicationGatewayIPConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application gateway IP configurations of virtual network resource."
+                                  }
+                                },
+                                "delegation": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The delegation to enable on the subnet."
+                                  }
+                                },
+                                "natGatewayResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
+                                  }
+                                },
+                                "networkSecurityGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the network security group to assign to the subnet."
+                                  }
+                                },
+                                "privateEndpointNetworkPolicies": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "Enabled",
+                                    "NetworkSecurityGroupEnabled",
+                                    "RouteTableEnabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. enable or disable apply network policies on private endpoint in the subnet."
+                                  }
+                                },
+                                "privateLinkServiceNetworkPolicies": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "Enabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. enable or disable apply network policies on private link service in the subnet."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "routeTableResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the route table to assign to the subnet."
+                                  }
+                                },
+                                "serviceEndpointPolicies": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. An array of service endpoint policies."
+                                  }
+                                },
+                                "serviceEndpoints": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The service endpoints to enable on the subnet."
+                                  }
+                                },
+                                "defaultOutboundAccess": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
+                                  }
+                                },
+                                "sharingScope": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "DelegatedServices",
+                                    "Tenant"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set this property to Tenant to allow sharing subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if subnet is empty."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Virtual Network (vNet)."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "addressPrefixes": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "Required. An Array of 1 or more IP Address Prefixes OR the resource ID of the IPAM pool to be used for the Virtual Network. When specifying an IPAM pool resource ID you must also set a value for the parameter called `ipamPoolNumberOfIpAddresses`."
+                              }
+                            },
+                            "ipamPoolNumberOfIpAddresses": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Number of IP addresses allocated from the pool. To be used only when the addressPrefix param is defined with a resource ID of an IPAM pool."
+                              }
+                            },
+                            "virtualNetworkBgpCommunity": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The BGP community associated with the virtual network."
+                              }
+                            },
+                            "subnets": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/subnetType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. An Array of subnets to deploy to the Virtual Network."
+                              }
+                            },
+                            "dnsServers": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. DNS Servers associated to the Virtual Network."
+                              }
+                            },
+                            "ddosProtectionPlanResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource ID of the DDoS protection plan to assign the VNET to. If it's left blank, DDoS protection will not be configured. If it's provided, the VNET created by this template will be attached to the referenced DDoS protection plan. The DDoS protection plan can exist in the same or in a different subscription."
+                              }
+                            },
+                            "peerings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/peeringType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Virtual Network Peering configurations."
+                              }
+                            },
+                            "vnetEncryption": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates if encryption is enabled on virtual network and if VM without encryption is allowed in encrypted VNet. Requires the EnableVNetEncryption feature to be registered for the subscription and a supported region to use this property."
+                              }
+                            },
+                            "vnetEncryptionEnforcement": {
+                              "type": "string",
+                              "defaultValue": "AllowUnencrypted",
+                              "allowedValues": [
+                                "AllowUnencrypted",
+                                "DropUnencrypted"
+                              ],
+                              "metadata": {
+                                "description": "Optional. If the encrypted VNet allows VM that does not support encryption. Can only be used when vnetEncryption is enabled."
+                              }
+                            },
+                            "flowTimeoutInMinutes": {
+                              "type": "int",
+                              "defaultValue": 0,
+                              "maxValue": 30,
+                              "metadata": {
+                                "description": "Optional. The flow timeout in minutes for the Virtual Network, which is used to enable connection tracking for intra-VM flows. Possible values are between 4 and 30 minutes. Default value 0 will set the property to null."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "enableVmProtection": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Indicates if VM protection is enabled for all the subnets in the virtual network."
+                              }
+                            },
+                            "enablePrivateEndpointVNetPolicies": {
+                              "type": "string",
+                              "defaultValue": "Disabled",
+                              "allowedValues": [
+                                "Basic",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Enables high scale private endpoints for the virtual network. This is necessary if the virtual network requires more than 1000 private endpoints or is peered to virtual networks with a total of more than 4000 private endpoints."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-virtualnetwork.{0}.{1}', replace('0.8.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "virtualNetwork": {
+                              "type": "Microsoft.Network/virtualNetworks",
+                              "apiVersion": "2024-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "addressSpace": "[if(contains(parameters('addressPrefixes')[0], '/Microsoft.Network/networkManagers/'), createObject('ipamPoolPrefixAllocations', createArray(createObject('pool', createObject('id', parameters('addressPrefixes')[0]), 'numberOfIpAddresses', parameters('ipamPoolNumberOfIpAddresses')))), createObject('addressPrefixes', parameters('addressPrefixes')))]",
+                                "bgpCommunities": "[if(not(empty(parameters('virtualNetworkBgpCommunity'))), createObject('virtualNetworkCommunity', parameters('virtualNetworkBgpCommunity')), null())]",
+                                "ddosProtectionPlan": "[if(not(empty(parameters('ddosProtectionPlanResourceId'))), createObject('id', parameters('ddosProtectionPlanResourceId')), null())]",
+                                "dhcpOptions": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', array(parameters('dnsServers'))), null())]",
+                                "enableDdosProtection": "[not(empty(parameters('ddosProtectionPlanResourceId')))]",
+                                "encryption": "[if(equals(parameters('vnetEncryption'), true()), createObject('enabled', parameters('vnetEncryption'), 'enforcement', parameters('vnetEncryptionEnforcement')), null())]",
+                                "flowTimeoutInMinutes": "[if(not(equals(parameters('flowTimeoutInMinutes'), 0)), parameters('flowTimeoutInMinutes'), null())]",
+                                "enableVmProtection": "[parameters('enableVmProtection')]",
+                                "privateEndpointVNetPolicies": "[parameters('enablePrivateEndpointVNetPolicies')]"
+                              }
+                            },
+                            "virtualNetwork_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "virtualNetwork"
+                              ]
+                            },
+                            "virtualNetwork_diagnosticSettings": {
+                              "copy": {
+                                "name": "virtualNetwork_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "virtualNetwork"
+                              ]
+                            },
+                            "virtualNetwork_roleAssignments": {
+                              "copy": {
+                                "name": "virtualNetwork_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "virtualNetwork"
+                              ]
+                            },
+                            "virtualNetwork_subnets": {
+                              "copy": {
+                                "name": "virtualNetwork_subnets",
+                                "count": "[length(coalesce(parameters('subnets'), createArray()))]",
+                                "mode": "serial",
+                                "batchSize": 1
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-subnet-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualNetworkName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('subnets'), createArray())[copyIndex()].name]"
+                                  },
+                                  "addressPrefix": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'addressPrefix')]"
+                                  },
+                                  "addressPrefixes": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'addressPrefixes')]"
+                                  },
+                                  "ipamPoolPrefixAllocations": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'ipamPoolPrefixAllocations')]"
+                                  },
+                                  "applicationGatewayIPConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'applicationGatewayIPConfigurations')]"
+                                  },
+                                  "delegation": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'delegation')]"
+                                  },
+                                  "natGatewayResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'natGatewayResourceId')]"
+                                  },
+                                  "networkSecurityGroupResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'networkSecurityGroupResourceId')]"
+                                  },
+                                  "privateEndpointNetworkPolicies": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'privateEndpointNetworkPolicies')]"
+                                  },
+                                  "privateLinkServiceNetworkPolicies": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'privateLinkServiceNetworkPolicies')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "routeTableResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'routeTableResourceId')]"
+                                  },
+                                  "serviceEndpointPolicies": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'serviceEndpointPolicies')]"
+                                  },
+                                  "serviceEndpoints": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'serviceEndpoints')]"
+                                  },
+                                  "defaultOutboundAccess": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'defaultOutboundAccess')]"
+                                  },
+                                  "sharingScope": {
+                                    "value": "[tryGet(coalesce(parameters('subnets'), createArray())[copyIndex()], 'sharingScope')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "13992200806189615656"
+                                    },
+                                    "name": "Virtual Network Subnets",
+                                    "description": "This module deploys a Virtual Network Subnet."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.2.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The Name of the subnet resource."
+                                      }
+                                    },
+                                    "virtualNetworkName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual network. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "addressPrefix": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. The address prefix for the subnet. Required if `addressPrefixes` is empty."
+                                      }
+                                    },
+                                    "ipamPoolPrefixAllocations": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. The address space for the subnet, deployed from IPAM Pool. Required if `addressPrefixes` and `addressPrefix` is empty."
+                                      }
+                                    },
+                                    "networkSecurityGroupResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the network security group to assign to the subnet."
+                                      }
+                                    },
+                                    "routeTableResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the route table to assign to the subnet."
+                                      }
+                                    },
+                                    "serviceEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The service endpoints to enable on the subnet."
+                                      }
+                                    },
+                                    "delegation": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The delegation to enable on the subnet."
+                                      }
+                                    },
+                                    "natGatewayResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the NAT Gateway to use for the subnet."
+                                      }
+                                    },
+                                    "privateEndpointNetworkPolicies": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled",
+                                        "NetworkSecurityGroupEnabled",
+                                        "RouteTableEnabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Enable or disable apply network policies on private endpoint in the subnet."
+                                      }
+                                    },
+                                    "privateLinkServiceNetworkPolicies": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Enable or disable apply network policies on private link service in the subnet."
+                                      }
+                                    },
+                                    "addressPrefixes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. List of address prefixes for the subnet. Required if `addressPrefix` is empty."
+                                      }
+                                    },
+                                    "defaultOutboundAccess": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set this property to false to disable default outbound connectivity for all VMs in the subnet. This property can only be set at the time of subnet creation and cannot be updated for an existing subnet."
+                                      }
+                                    },
+                                    "sharingScope": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "DelegatedServices",
+                                        "Tenant"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set this property to Tenant to allow sharing the subnet with other subscriptions in your AAD tenant. This property can only be set if defaultOutboundAccess is set to false, both properties can only be set if the subnet is empty."
+                                      }
+                                    },
+                                    "applicationGatewayIPConfigurations": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. Application gateway IP configurations of virtual network resource."
+                                      }
+                                    },
+                                    "serviceEndpointPolicies": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. An array of service endpoint policies."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.network-virtualnetworksubnet.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "virtualNetwork": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/virtualNetworks",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[parameters('virtualNetworkName')]"
+                                    },
+                                    "subnet": {
+                                      "type": "Microsoft.Network/virtualNetworks/subnets",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualNetworkName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "serviceEndpoints",
+                                            "count": "[length(parameters('serviceEndpoints'))]",
+                                            "input": {
+                                              "service": "[parameters('serviceEndpoints')[copyIndex('serviceEndpoints')]]"
+                                            }
+                                          }
+                                        ],
+                                        "addressPrefix": "[parameters('addressPrefix')]",
+                                        "addressPrefixes": "[parameters('addressPrefixes')]",
+                                        "ipamPoolPrefixAllocations": "[parameters('ipamPoolPrefixAllocations')]",
+                                        "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]",
+                                        "routeTable": "[if(not(empty(parameters('routeTableResourceId'))), createObject('id', parameters('routeTableResourceId')), null())]",
+                                        "natGateway": "[if(not(empty(parameters('natGatewayResourceId'))), createObject('id', parameters('natGatewayResourceId')), null())]",
+                                        "delegations": "[if(not(empty(parameters('delegation'))), createArray(createObject('name', parameters('delegation'), 'properties', createObject('serviceName', parameters('delegation')))), createArray())]",
+                                        "privateEndpointNetworkPolicies": "[parameters('privateEndpointNetworkPolicies')]",
+                                        "privateLinkServiceNetworkPolicies": "[parameters('privateLinkServiceNetworkPolicies')]",
+                                        "applicationGatewayIPConfigurations": "[parameters('applicationGatewayIPConfigurations')]",
+                                        "serviceEndpointPolicies": "[parameters('serviceEndpointPolicies')]",
+                                        "defaultOutboundAccess": "[parameters('defaultOutboundAccess')]",
+                                        "sharingScope": "[parameters('sharingScope')]"
+                                      }
+                                    },
+                                    "subnet_roleAssignments": {
+                                      "copy": {
+                                        "name": "subnet_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "subnet"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the virtual network peering was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the virtual network peering."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the virtual network peering."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), parameters('name'))]"
+                                    },
+                                    "addressPrefix": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The address prefix for the subnet."
+                                      },
+                                      "value": "[coalesce(tryGet(reference('subnet'), 'addressPrefix'), '')]"
+                                    },
+                                    "addressPrefixes": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "description": "List of address prefixes for the subnet."
+                                      },
+                                      "value": "[coalesce(tryGet(reference('subnet'), 'addressPrefixes'), createArray())]"
+                                    },
+                                    "ipamPoolPrefixAllocations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "description": "The IPAM pool prefix allocations for the subnet."
+                                      },
+                                      "value": "[coalesce(tryGet(reference('subnet'), 'ipamPoolPrefixAllocations'), createArray())]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "virtualNetwork"
+                              ]
+                            },
+                            "virtualNetwork_peering_local": {
+                              "copy": {
+                                "name": "virtualNetwork_peering_local",
+                                "count": "[length(coalesce(parameters('peerings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-virtualNetworkPeering-local-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "localVnetName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "remoteVirtualNetworkResourceId": {
+                                    "value": "[coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "allowForwardedTraffic": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowForwardedTraffic')]"
+                                  },
+                                  "allowGatewayTransit": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowGatewayTransit')]"
+                                  },
+                                  "allowVirtualNetworkAccess": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'allowVirtualNetworkAccess')]"
+                                  },
+                                  "doNotVerifyRemoteGateways": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'doNotVerifyRemoteGateways')]"
+                                  },
+                                  "useRemoteGateways": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'useRemoteGateways')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "6939030350004475953"
+                                    },
+                                    "name": "Virtual Network Peerings",
+                                    "description": "This module deploys a Virtual Network Peering."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[format('peer-{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkResourceId'), '/')))]",
+                                      "metadata": {
+                                        "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
+                                      }
+                                    },
+                                    "localVnetName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "remoteVirtualNetworkResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                                      }
+                                    },
+                                    "allowForwardedTraffic": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                                      }
+                                    },
+                                    "allowGatewayTransit": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                                      }
+                                    },
+                                    "allowVirtualNetworkAccess": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                                      }
+                                    },
+                                    "doNotVerifyRemoteGateways": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
+                                      }
+                                    },
+                                    "useRemoteGateways": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
+                                      "properties": {
+                                        "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
+                                        "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
+                                        "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
+                                        "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
+                                        "useRemoteGateways": "[parameters('useRemoteGateways')]",
+                                        "remoteVirtualNetwork": {
+                                          "id": "[parameters('remoteVirtualNetworkResourceId')]"
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the virtual network peering was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the virtual network peering."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the virtual network peering."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "virtualNetwork",
+                                "virtualNetwork_subnets"
+                              ]
+                            },
+                            "virtualNetwork_peering_remote": {
+                              "copy": {
+                                "name": "virtualNetwork_peering_remote",
+                                "count": "[length(coalesce(parameters('peerings'), createArray()))]"
+                              },
+                              "condition": "[coalesce(tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringEnabled'), false())]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-virtualNetworkPeering-remote-{1}', uniqueString(subscription().id, resourceGroup().id, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/')[2]]",
+                              "resourceGroup": "[split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "localVnetName": {
+                                    "value": "[last(split(coalesce(parameters('peerings'), createArray())[copyIndex()].remoteVirtualNetworkResourceId, '/'))]"
+                                  },
+                                  "remoteVirtualNetworkResourceId": {
+                                    "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringName')]"
+                                  },
+                                  "allowForwardedTraffic": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowForwardedTraffic')]"
+                                  },
+                                  "allowGatewayTransit": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowGatewayTransit')]"
+                                  },
+                                  "allowVirtualNetworkAccess": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringAllowVirtualNetworkAccess')]"
+                                  },
+                                  "doNotVerifyRemoteGateways": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringDoNotVerifyRemoteGateways')]"
+                                  },
+                                  "useRemoteGateways": {
+                                    "value": "[tryGet(coalesce(parameters('peerings'), createArray())[copyIndex()], 'remotePeeringUseRemoteGateways')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "6939030350004475953"
+                                    },
+                                    "name": "Virtual Network Peerings",
+                                    "description": "This module deploys a Virtual Network Peering."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[format('peer-{0}-{1}', parameters('localVnetName'), last(split(parameters('remoteVirtualNetworkResourceId'), '/')))]",
+                                      "metadata": {
+                                        "description": "Optional. The Name of VNET Peering resource. If not provided, default value will be localVnetName-remoteVnetName."
+                                      }
+                                    },
+                                    "localVnetName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Virtual Network to add the peering to. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "remoteVirtualNetworkResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The Resource ID of the VNet that is this Local VNet is being peered to. Should be in the format of a Resource ID."
+                                      }
+                                    },
+                                    "allowForwardedTraffic": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether the forwarded traffic from the VMs in the local virtual network will be allowed/disallowed in remote virtual network. Default is true."
+                                      }
+                                    },
+                                    "allowGatewayTransit": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If gateway links can be used in remote virtual networking to link to this virtual network. Default is false."
+                                      }
+                                    },
+                                    "allowVirtualNetworkAccess": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether the VMs in the local virtual network space would be able to access the VMs in remote virtual network space. Default is true."
+                                      }
+                                    },
+                                    "doNotVerifyRemoteGateways": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. If we need to verify the provisioning state of the remote gateway. Default is true."
+                                      }
+                                    },
+                                    "useRemoteGateways": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If remote gateways can be used on this virtual network. If the flag is set to true, and allowGatewayTransit on remote peering is also true, virtual network will use gateways of remote virtual network for transit. Only one peering can have this flag set to true. This flag cannot be set if virtual network already has a gateway. Default is false."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[format('{0}/{1}', parameters('localVnetName'), parameters('name'))]",
+                                      "properties": {
+                                        "allowForwardedTraffic": "[parameters('allowForwardedTraffic')]",
+                                        "allowGatewayTransit": "[parameters('allowGatewayTransit')]",
+                                        "allowVirtualNetworkAccess": "[parameters('allowVirtualNetworkAccess')]",
+                                        "doNotVerifyRemoteGateways": "[parameters('doNotVerifyRemoteGateways')]",
+                                        "useRemoteGateways": "[parameters('useRemoteGateways')]",
+                                        "remoteVirtualNetwork": {
+                                          "id": "[parameters('remoteVirtualNetworkResourceId')]"
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the virtual network peering was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the virtual network peering."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the virtual network peering."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/virtualNetworks/virtualNetworkPeerings', parameters('localVnetName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "virtualNetwork",
+                                "virtualNetwork_subnets"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the virtual network was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the virtual network."
+                              },
+                              "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the virtual network."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "subnetNames": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "The names of the deployed subnets."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('subnets'), createArray()))]",
+                                "input": "[reference(format('virtualNetwork_subnets[{0}]', copyIndex())).outputs.name.value]"
+                              }
+                            },
+                            "subnetResourceIds": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "The resource IDs of the deployed subnets."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('subnets'), createArray()))]",
+                                "input": "[reference(format('virtualNetwork_subnets[{0}]', copyIndex())).outputs.resourceId.value]"
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('virtualNetwork', '2024-05-01', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "nsgs"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "value": "[reference('virtualNetwork').outputs.name.value]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "value": "[reference('virtualNetwork').outputs.resourceId.value]"
+                    },
+                    "subnets": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/subnetOutputType"
+                      },
+                      "copy": {
+                        "count": "[length(parameters('subnets'))]",
+                        "input": {
+                          "name": "[parameters('subnets')[copyIndex()].name]",
+                          "resourceId": "[reference('virtualNetwork').outputs.subnetResourceIds.value[copyIndex()]]",
+                          "nsgName": "[if(not(empty(tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup'))), tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup', 'name'), null())]",
+                          "nsgResourceId": "[if(not(empty(tryGet(parameters('subnets')[copyIndex()], 'networkSecurityGroup'))), reference(format('nsgs[{0}]', copyIndex())).outputs.resourceId.value, null())]"
+                        }
+                      }
+                    },
+                    "backendSubnetResourceId": {
+                      "type": "string",
+                      "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'backend'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'backend')], '')]"
+                    },
+                    "containerSubnetResourceId": {
+                      "type": "string",
+                      "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'containers'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'containers')], '')]"
+                    },
+                    "webserverfarmSubnetResourceId": {
+                      "type": "string",
+                      "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'webserverfarm'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'webserverfarm')], '')]"
+                    },
+                    "administrationSubnetResourceId": {
+                      "type": "string",
+                      "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'administration'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'administration')], '')]"
+                    },
+                    "bastionSubnetResourceId": {
+                      "type": "string",
+                      "value": "[if(contains(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'AzureBastionSubnet'), reference('virtualNetwork').outputs.subnetResourceIds.value[indexOf(map(parameters('subnets'), lambda('subnet', lambdaVariables('subnet').name)), 'AzureBastionSubnet')], '')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "log_analytics"
+              ]
+            },
+            "bastionHost": {
+              "condition": "[parameters('enablePrivateNetworking')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.bastion-host.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "virtualNetworkResourceId": {
+                    "value": "[reference('virtualNetwork').outputs.resourceId.value]"
+                  },
+                  "publicIPDiagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', null()))]",
+                  "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', null()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "4613446280405157854"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "virtualNetworkResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the virtual network."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Diagnostic settings for the resource."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "metadata": {
+                        "description": "SKU name for the Bastion Host."
+                      }
+                    },
+                    "scaleUnits": {
+                      "type": "int",
+                      "defaultValue": 4,
+                      "metadata": {
+                        "description": "Number of scale units."
+                      }
+                    },
+                    "disableCopyPaste": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Disable copy/paste functionality."
+                      }
+                    },
+                    "enableFileCopy": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable file copy functionality."
+                      }
+                    },
+                    "enableIpConnect": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable IP Connect functionality."
+                      }
+                    },
+                    "enableShareableLink": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable shareable link functionality."
+                      }
+                    },
+                    "availabilityZones": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Availability zones for the Bastion Host public IP. Pass empty array to disable zone redundancy."
+                      }
+                    },
+                    "publicIPDiagnosticSettings": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Diagnostic settings for the public IP address."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "name": "[format('bas-{0}', parameters('solutionName'))]"
+                  },
+                  "resources": {
+                    "bastionHost": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.network.bastion-host.{0}', variables('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[variables('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "skuName": {
+                            "value": "[parameters('skuName')]"
+                          },
+                          "virtualNetworkResourceId": {
+                            "value": "[parameters('virtualNetworkResourceId')]"
+                          },
+                          "availabilityZones": {
+                            "value": "[parameters('availabilityZones')]"
+                          },
+                          "publicIPAddressObject": {
+                            "value": {
+                              "name": "[format('pip-{0}', variables('name'))]",
+                              "diagnosticSettings": "[parameters('publicIPDiagnosticSettings')]",
+                              "tags": "[parameters('tags')]"
+                            }
+                          },
+                          "disableCopyPaste": {
+                            "value": "[parameters('disableCopyPaste')]"
+                          },
+                          "enableFileCopy": {
+                            "value": "[parameters('enableFileCopy')]"
+                          },
+                          "enableIpConnect": {
+                            "value": "[parameters('enableIpConnect')]"
+                          },
+                          "enableShareableLink": {
+                            "value": "[parameters('enableShareableLink')]"
+                          },
+                          "scaleUnits": {
+                            "value": "[parameters('scaleUnits')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[parameters('diagnosticSettings')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "7741601918225805390"
+                            },
+                            "name": "Bastion Hosts",
+                            "description": "This module deploys a Bastion Host."
+                          },
+                          "definitions": {
+                            "publicIPAddressObjectType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the Public IP Address."
+                                  }
+                                },
+                                "publicIpPrefixResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                                  }
+                                },
+                                "publicIPAllocationMethod": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Dynamic",
+                                    "Static"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The public IP address allocation method."
+                                  }
+                                },
+                                "availabilityZones": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "int"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                                  }
+                                },
+                                "publicIPAddressVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "IPv4",
+                                    "IPv6"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP address version."
+                                  }
+                                },
+                                "dnsSettings": {
+                                  "$ref": "#/definitions/dnsSettingsType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DNS settings of the public IP address."
+                                  }
+                                },
+                                "ipTags": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/ipTagType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The list of tags associated with the public IP address."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The lock settings of the service."
+                                  }
+                                },
+                                "skuName": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Basic",
+                                    "Standard"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of a public IP address SKU."
+                                  }
+                                },
+                                "skuTier": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Global",
+                                    "Regional"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Tier of a public IP address SKU."
+                                  }
+                                },
+                                "ddosSettings": {
+                                  "$ref": "#/definitions/ddosSettingsType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location for the Public IP resource."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create for the Public IP resource."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable usage telemetry for the Public IP module."
+                                  }
+                                },
+                                "idleTimeoutInMinutes": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Idle timeout in minutes for the Public IP resource."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/publicIPAddresses@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to apply to the Public IP resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Diagnostic settings for the Public IP resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the properties of the Public IP to create and be used by Azure Bastion, if no existing public IP was provided."
+                              }
+                            },
+                            "ddosSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "ddosProtectionPlan": {
+                                  "type": "object",
+                                  "properties": {
+                                    "id": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                  }
+                                },
+                                "protectionMode": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Enabled"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The DDoS protection policy customizations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.10.0"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "diagnosticSettingLogsOnlyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if only logs are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "dnsSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "domainNameLabel": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                  }
+                                },
+                                "domainNameLabelScope": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "NoReuse",
+                                    "ResourceGroupReuse",
+                                    "SubscriptionReuse",
+                                    "TenantReuse"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                  }
+                                },
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                  }
+                                },
+                                "reverseFqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.10.0"
+                                }
+                              }
+                            },
+                            "ipTagType": {
+                              "type": "object",
+                              "properties": {
+                                "ipTagType": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IP tag type."
+                                  }
+                                },
+                                "tag": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IP tag."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.10.0"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Azure Bastion resource."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "virtualNetworkResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Shared services Virtual Network resource Id."
+                              }
+                            },
+                            "bastionSubnetPublicIpResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The Public IP resource ID to associate to the azureBastionSubnet. If empty, then the Public IP that is created as part of this module will be applied to the azureBastionSubnet. This parameter is ignored when enablePrivateOnlyBastion is true."
+                              }
+                            },
+                            "publicIPAddressObject": {
+                              "$ref": "#/definitions/publicIPAddressObjectType",
+                              "defaultValue": {
+                                "name": "[format('{0}-pip', parameters('name'))]"
+                              },
+                              "metadata": {
+                                "description": "Optional. Specifies the properties of the Public IP to create and be used by Azure Bastion, if no existing public IP was provided. This parameter is ignored when enablePrivateOnlyBastion is true."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingLogsOnlyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "skuName": {
+                              "type": "string",
+                              "defaultValue": "Basic",
+                              "allowedValues": [
+                                "Basic",
+                                "Developer",
+                                "Premium",
+                                "Standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The SKU of this Bastion Host."
+                              }
+                            },
+                            "disableCopyPaste": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Choose to disable or enable Copy Paste. For Basic and Developer SKU Copy/Paste is always enabled."
+                              }
+                            },
+                            "enableFileCopy": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Choose to disable or enable File Copy. Not supported for Basic and Developer SKU."
+                              }
+                            },
+                            "enableIpConnect": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Choose to disable or enable IP Connect. Not supported for Basic and Developer SKU."
+                              }
+                            },
+                            "enableKerberos": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Choose to disable or enable Kerberos authentication. Not supported for Developer SKU."
+                              }
+                            },
+                            "enableShareableLink": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Choose to disable or enable Shareable Link. Not supported for Basic and Developer SKU."
+                              }
+                            },
+                            "enableSessionRecording": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Choose to disable or enable Session Recording feature. The Premium SKU is required for this feature. If Session Recording is enabled, the Native client support will be disabled."
+                              }
+                            },
+                            "enablePrivateOnlyBastion": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Choose to disable or enable Private-only Bastion deployment. The Premium SKU is required for this feature."
+                              }
+                            },
+                            "scaleUnits": {
+                              "type": "int",
+                              "defaultValue": 2,
+                              "metadata": {
+                                "description": "Optional. The scale units for the Bastion Host resource. The Basic and Developer SKU only support 2 scale units."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/bastionHosts@2024-07-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "availabilityZones": {
+                              "type": "array",
+                              "items": {
+                                "type": "int"
+                              },
+                              "defaultValue": [],
+                              "allowedValues": [
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Optional. The list of Availability zones to use for the zone-redundant resources."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-bastionhost.{0}.{1}', replace('0.8.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "azureBastion": {
+                              "type": "Microsoft.Network/bastionHosts",
+                              "apiVersion": "2025-01-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[coalesce(parameters('tags'), createObject())]",
+                              "sku": {
+                                "name": "[parameters('skuName')]"
+                              },
+                              "zones": "[if(equals(parameters('skuName'), 'Developer'), createArray(), map(parameters('availabilityZones'), lambda('zone', format('{0}', lambdaVariables('zone')))))]",
+                              "properties": "[union(createObject('scaleUnits', if(or(equals(parameters('skuName'), 'Basic'), equals(parameters('skuName'), 'Developer')), 2, parameters('scaleUnits')), 'ipConfigurations', if(equals(parameters('skuName'), 'Developer'), createArray(), createArray(createObject('name', 'IpConfAzureBastionSubnet', 'properties', union(createObject('subnet', createObject('id', format('{0}/subnets/AzureBastionSubnet', parameters('virtualNetworkResourceId')))), if(not(parameters('enablePrivateOnlyBastion')), createObject('publicIPAddress', createObject('id', if(not(empty(parameters('bastionSubnetPublicIpResourceId'))), parameters('bastionSubnetPublicIpResourceId'), reference('publicIPAddress').outputs.resourceId.value))), createObject())))))), if(equals(parameters('skuName'), 'Developer'), createObject('virtualNetwork', createObject('id', parameters('virtualNetworkResourceId'))), createObject()), if(or(or(equals(parameters('skuName'), 'Basic'), equals(parameters('skuName'), 'Standard')), equals(parameters('skuName'), 'Premium')), createObject('enableKerberos', parameters('enableKerberos')), createObject()), if(or(equals(parameters('skuName'), 'Standard'), equals(parameters('skuName'), 'Premium')), createObject('enableTunneling', if(equals(parameters('skuName'), 'Standard'), true(), if(parameters('enableSessionRecording'), false(), true())), 'disableCopyPaste', parameters('disableCopyPaste'), 'enableFileCopy', parameters('enableFileCopy'), 'enableIpConnect', parameters('enableIpConnect'), 'enableShareableLink', parameters('enableShareableLink')), createObject()), if(equals(parameters('skuName'), 'Premium'), createObject('enableSessionRecording', parameters('enableSessionRecording'), 'enablePrivateOnlyBastion', parameters('enablePrivateOnlyBastion')), createObject()))]",
+                              "dependsOn": [
+                                "publicIPAddress"
+                              ]
+                            },
+                            "azureBastion_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "azureBastion"
+                              ]
+                            },
+                            "azureBastion_diagnosticSettings": {
+                              "copy": {
+                                "name": "azureBastion_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "azureBastion"
+                              ]
+                            },
+                            "azureBastion_roleAssignments": {
+                              "copy": {
+                                "name": "azureBastion_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/bastionHosts/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/bastionHosts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "azureBastion"
+                              ]
+                            },
+                            "publicIPAddress": {
+                              "condition": "[and(and(empty(parameters('bastionSubnetPublicIpResourceId')), not(equals(parameters('skuName'), 'Developer'))), not(parameters('enablePrivateOnlyBastion')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Bastion-PIP', uniqueString(subscription().id, resourceGroup().id, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('publicIPAddressObject').name]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "lock": {
+                                    "value": "[parameters('lock')]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'diagnosticSettings')]"
+                                  },
+                                  "ddosSettings": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'ddosSettings')]"
+                                  },
+                                  "dnsSettings": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'dnsSettings')]"
+                                  },
+                                  "idleTimeoutInMinutes": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'idleTimeoutInMinutes')]"
+                                  },
+                                  "ipTags": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'ipTags')]"
+                                  },
+                                  "publicIPAddressVersion": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAddressVersion')]"
+                                  },
+                                  "publicIPAllocationMethod": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIPAllocationMethod')]"
+                                  },
+                                  "publicIpPrefixResourceId": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'publicIpPrefixResourceId')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'roleAssignments')]"
+                                  },
+                                  "skuName": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'skuName')]"
+                                  },
+                                  "skuTier": {
+                                    "value": "[tryGet(parameters('publicIPAddressObject'), 'skuTier')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('publicIPAddressObject'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "availabilityZones": {
+                                    "value": "[coalesce(tryGet(parameters('publicIPAddressObject'), 'availabilityZones'), if(not(empty(parameters('availabilityZones'))), parameters('availabilityZones'), null()))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "16564959277054027786"
+                                    },
+                                    "name": "Public IP Addresses",
+                                    "description": "This module deploys a Public IP Address."
+                                  },
+                                  "definitions": {
+                                    "dnsSettingsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "domainNameLabel": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                          }
+                                        },
+                                        "domainNameLabelScope": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "NoReuse",
+                                            "ResourceGroupReuse",
+                                            "SubscriptionReuse",
+                                            "TenantReuse"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                          }
+                                        },
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                          }
+                                        },
+                                        "reverseFqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "ddosSettingsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ddosProtectionPlan": {
+                                          "type": "object",
+                                          "properties": {
+                                            "id": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                          }
+                                        },
+                                        "protectionMode": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Enabled"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The DDoS protection policy customizations."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "ipTagType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ipTagType": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The IP tag type."
+                                          }
+                                        },
+                                        "tag": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The IP tag."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Public IP Address."
+                                      }
+                                    },
+                                    "publicIpPrefixResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                                      }
+                                    },
+                                    "publicIPAllocationMethod": {
+                                      "type": "string",
+                                      "defaultValue": "Static",
+                                      "allowedValues": [
+                                        "Dynamic",
+                                        "Static"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The public IP address allocation method."
+                                      }
+                                    },
+                                    "availabilityZones": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "int"
+                                      },
+                                      "defaultValue": [
+                                        1,
+                                        2,
+                                        3
+                                      ],
+                                      "allowedValues": [
+                                        1,
+                                        2,
+                                        3
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                                      }
+                                    },
+                                    "publicIPAddressVersion": {
+                                      "type": "string",
+                                      "defaultValue": "IPv4",
+                                      "allowedValues": [
+                                        "IPv4",
+                                        "IPv6"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. IP address version."
+                                      }
+                                    },
+                                    "dnsSettings": {
+                                      "$ref": "#/definitions/dnsSettingsType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The DNS settings of the public IP address."
+                                      }
+                                    },
+                                    "ipTags": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/ipTagType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The list of tags associated with the public IP address."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "skuName": {
+                                      "type": "string",
+                                      "defaultValue": "Standard",
+                                      "allowedValues": [
+                                        "Basic",
+                                        "Standard"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Name of a public IP address SKU."
+                                      }
+                                    },
+                                    "skuTier": {
+                                      "type": "string",
+                                      "defaultValue": "Regional",
+                                      "allowedValues": [
+                                        "Global",
+                                        "Regional"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Tier of a public IP address SKU."
+                                      }
+                                    },
+                                    "ddosSettings": {
+                                      "$ref": "#/definitions/ddosSettingsType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                                      }
+                                    },
+                                    "deleteOption": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Delete",
+                                        "Detach"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The delete option for the public IP address."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "idleTimeoutInMinutes": {
+                                      "type": "int",
+                                      "defaultValue": 4,
+                                      "metadata": {
+                                        "description": "Optional. The idle timeout of the public IP address."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.10.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "publicIpAddress": {
+                                      "type": "Microsoft.Network/publicIPAddresses",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "sku": {
+                                        "name": "[parameters('skuName')]",
+                                        "tier": "[parameters('skuTier')]"
+                                      },
+                                      "zones": "[map(parameters('availabilityZones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                                      "properties": {
+                                        "ddosSettings": "[parameters('ddosSettings')]",
+                                        "dnsSettings": "[parameters('dnsSettings')]",
+                                        "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                                        "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                                        "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                                        "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                                        "ipTags": "[parameters('ipTags')]",
+                                        "deleteOption": "[parameters('deleteOption')]"
+                                      }
+                                    },
+                                    "publicIpAddress_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "publicIpAddress"
+                                      ]
+                                    },
+                                    "publicIpAddress_roleAssignments": {
+                                      "copy": {
+                                        "name": "publicIpAddress_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "publicIpAddress"
+                                      ]
+                                    },
+                                    "publicIpAddress_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "publicIpAddress_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "publicIpAddress"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the public IP address was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the public IP address."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the public IP address."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                                    },
+                                    "ipAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The public IP address of the public IP address resource."
+                                      },
+                                      "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('publicIpAddress', '2025-01-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the Azure Bastion was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name the Azure Bastion."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID the Azure Bastion."
+                              },
+                              "value": "[resourceId('Microsoft.Network/bastionHosts', parameters('name'))]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('azureBastion', '2025-01-01', 'full').location]"
+                            },
+                            "ipConfAzureBastionSubnet": {
+                              "type": "object",
+                              "metadata": {
+                                "description": "The Public IPconfiguration object for the AzureBastionSubnet."
+                              },
+                              "value": "[if(equals(parameters('skuName'), 'Developer'), createObject(), reference('azureBastion').ipConfigurations[0])]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Bastion Host."
+                      },
+                      "value": "[reference('bastionHost').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the Bastion Host."
+                      },
+                      "value": "[reference('bastionHost').outputs.name.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "log_analytics",
+                "virtualNetwork"
+              ]
+            },
+            "maintenanceConfiguration": {
+              "condition": "[parameters('enablePrivateNetworking')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.maintenance-configuration.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "8420279536133240728"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('mc-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the maintenance configuration."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "maintenanceScope": {
+                      "type": "string",
+                      "defaultValue": "InGuestPatch",
+                      "metadata": {
+                        "description": "Maintenance scope."
+                      }
+                    },
+                    "visibility": {
+                      "type": "string",
+                      "defaultValue": "Custom",
+                      "metadata": {
+                        "description": "Visibility of the configuration."
+                      }
+                    },
+                    "extensionProperties": {
+                      "type": "object",
+                      "defaultValue": {
+                        "InGuestPatchMode": "User"
+                      },
+                      "metadata": {
+                        "description": "Extension properties."
+                      }
+                    },
+                    "maintenanceWindow": {
+                      "type": "object",
+                      "defaultValue": {
+                        "startDateTime": "2024-06-16 00:00",
+                        "duration": "03:55",
+                        "timeZone": "W. Europe Standard Time",
+                        "recurEvery": "1Day"
+                      },
+                      "metadata": {
+                        "description": "Maintenance window configuration."
+                      }
+                    },
+                    "installPatches": {
+                      "type": "object",
+                      "defaultValue": {
+                        "rebootSetting": "IfRequired",
+                        "windowsParameters": {
+                          "classificationsToInclude": [
+                            "Critical",
+                            "Security"
+                          ]
+                        },
+                        "linuxParameters": {
+                          "classificationsToInclude": [
+                            "Critical",
+                            "Security"
+                          ]
+                        }
+                      },
+                      "metadata": {
+                        "description": "Install patches configuration."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Enable Azure telemetry collection."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.maintenance.maintenance-configuration.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "extensionProperties": {
+                            "value": "[parameters('extensionProperties')]"
+                          },
+                          "maintenanceScope": {
+                            "value": "[parameters('maintenanceScope')]"
+                          },
+                          "maintenanceWindow": {
+                            "value": "[parameters('maintenanceWindow')]"
+                          },
+                          "visibility": {
+                            "value": "[parameters('visibility')]"
+                          },
+                          "installPatches": {
+                            "value": "[parameters('installPatches')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "14895287194406877557"
+                            },
+                            "name": "Maintenance Configurations",
+                            "description": "This module deploys a Maintenance Configuration."
+                          },
+                          "definitions": {
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Maintenance Configuration Name."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "extensionProperties": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/extensionProperties"
+                                },
+                                "description": "Optional. Gets or sets extensionProperties of the maintenanceConfiguration."
+                              },
+                              "defaultValue": {}
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "maintenanceScope": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/maintenanceScope"
+                                },
+                                "description": "Optional. Gets or sets maintenanceScope of the configuration."
+                              },
+                              "defaultValue": "Host"
+                            },
+                            "maintenanceWindow": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/maintenanceWindow"
+                                },
+                                "description": "Optional. Definition of a MaintenanceWindow."
+                              },
+                              "defaultValue": {}
+                            },
+                            "namespace": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Gets or sets namespace of the resource."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/tags"
+                                },
+                                "description": "Optional. Gets or sets tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "visibility": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/visibility"
+                                },
+                                "description": "Optional. Gets or sets the visibility of the configuration. The default value is 'Custom'."
+                              },
+                              "nullable": true
+                            },
+                            "installPatches": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Maintenance/maintenanceConfigurations@2023-04-01#properties/properties/properties/installPatches"
+                                },
+                                "description": "Optional. Configuration settings for VM guest patching with Azure Update Manager."
+                              },
+                              "defaultValue": {}
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "Scheduled Patching Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cd08ab90-6b14-449c-ad9a-8f8e549482c6')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.maintenance-maintenanceconfiguration.{0}.{1}', replace('0.4.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "maintenanceConfiguration": {
+                              "type": "Microsoft.Maintenance/maintenanceConfigurations",
+                              "apiVersion": "2023-04-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "extensionProperties": "[parameters('extensionProperties')]",
+                                "maintenanceScope": "[parameters('maintenanceScope')]",
+                                "maintenanceWindow": "[parameters('maintenanceWindow')]",
+                                "namespace": "[parameters('namespace')]",
+                                "visibility": "[parameters('visibility')]",
+                                "installPatches": "[if(equals(parameters('maintenanceScope'), 'InGuestPatch'), parameters('installPatches'), null())]"
+                              }
+                            },
+                            "maintenanceConfiguration_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "maintenanceConfiguration"
+                              ]
+                            },
+                            "maintenanceConfiguration_roleAssignments": {
+                              "copy": {
+                                "name": "maintenanceConfiguration_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Maintenance/maintenanceConfigurations', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "maintenanceConfiguration"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Maintenance Configuration."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Maintenance Configuration."
+                              },
+                              "value": "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the Maintenance Configuration was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the Maintenance Configuration was created in."
+                              },
+                              "value": "[reference('maintenanceConfiguration', '2023-04-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the maintenance configuration."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.maintenance.maintenance-configuration.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the maintenance configuration."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.maintenance.maintenance-configuration.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+                    }
+                  }
+                }
+              }
+            },
+            "windowsVmDataCollectionRules": {
+              "condition": "[and(parameters('enablePrivateNetworking'), parameters('enableMonitoring'))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.data-collection-rule.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": "[if(variables('useExistingLogAnalytics'), createObject('value', reference('existingLogAnalyticsWorkspace', '2025-07-01', 'full').location), if(parameters('enableMonitoring'), createObject('value', reference('log_analytics').outputs.location.value), createObject('value', parameters('location'))))]",
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "logAnalyticsWorkspaceResourceId": "[if(variables('useExistingLogAnalytics'), createObject('value', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8])), if(parameters('enableMonitoring'), createObject('value', reference('log_analytics').outputs.resourceId.value), createObject('value', '')))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "14701803776432038764"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('dcr-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the data collection rule. Defaults to dcr-{solutionName}."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "logAnalyticsWorkspaceResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Log Analytics workspace destination."
+                      }
+                    },
+                    "logAnalyticsWorkspaceName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the Log Analytics workspace (used for destination naming)."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "dcrLogAnalyticsDestinationName": "[if(not(empty(parameters('logAnalyticsWorkspaceName'))), format('la-{0}-destination', parameters('logAnalyticsWorkspaceName')), format('la-{0}-destination', parameters('name')))]"
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.insights.data-collection-rule.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          },
+                          "dataCollectionRuleProperties": {
+                            "value": {
+                              "kind": "Windows",
+                              "dataSources": {
+                                "performanceCounters": [
+                                  {
+                                    "streams": [
+                                      "Microsoft-Perf"
+                                    ],
+                                    "samplingFrequencyInSeconds": 60,
+                                    "counterSpecifiers": [
+                                      "\\Processor Information(_Total)\\% Processor Time",
+                                      "\\Processor Information(_Total)\\% Privileged Time",
+                                      "\\Processor Information(_Total)\\% User Time",
+                                      "\\Processor Information(_Total)\\Processor Frequency",
+                                      "\\System\\Processes",
+                                      "\\Process(_Total)\\Thread Count",
+                                      "\\Process(_Total)\\Handle Count",
+                                      "\\System\\System Up Time",
+                                      "\\System\\Context Switches/sec",
+                                      "\\System\\Processor Queue Length",
+                                      "\\Memory\\% Committed Bytes In Use",
+                                      "\\Memory\\Available Bytes",
+                                      "\\Memory\\Committed Bytes",
+                                      "\\Memory\\Cache Bytes",
+                                      "\\Memory\\Pool Paged Bytes",
+                                      "\\Memory\\Pool Nonpaged Bytes",
+                                      "\\Memory\\Pages/sec",
+                                      "\\Memory\\Page Faults/sec",
+                                      "\\Process(_Total)\\Working Set",
+                                      "\\Process(_Total)\\Working Set - Private",
+                                      "\\LogicalDisk(_Total)\\% Disk Time",
+                                      "\\LogicalDisk(_Total)\\% Disk Read Time",
+                                      "\\LogicalDisk(_Total)\\% Disk Write Time",
+                                      "\\LogicalDisk(_Total)\\% Idle Time",
+                                      "\\LogicalDisk(_Total)\\Disk Bytes/sec",
+                                      "\\LogicalDisk(_Total)\\Disk Read Bytes/sec",
+                                      "\\LogicalDisk(_Total)\\Disk Write Bytes/sec",
+                                      "\\LogicalDisk(_Total)\\Disk Transfers/sec",
+                                      "\\LogicalDisk(_Total)\\Disk Reads/sec",
+                                      "\\LogicalDisk(_Total)\\Disk Writes/sec",
+                                      "\\LogicalDisk(_Total)\\Avg. Disk sec/Transfer",
+                                      "\\LogicalDisk(_Total)\\Avg. Disk sec/Read",
+                                      "\\LogicalDisk(_Total)\\Avg. Disk sec/Write",
+                                      "\\LogicalDisk(_Total)\\Avg. Disk Queue Length",
+                                      "\\LogicalDisk(_Total)\\Avg. Disk Read Queue Length",
+                                      "\\LogicalDisk(_Total)\\Avg. Disk Write Queue Length",
+                                      "\\LogicalDisk(_Total)\\% Free Space",
+                                      "\\LogicalDisk(_Total)\\Free Megabytes",
+                                      "\\Network Interface(*)\\Bytes Total/sec",
+                                      "\\Network Interface(*)\\Bytes Sent/sec",
+                                      "\\Network Interface(*)\\Bytes Received/sec",
+                                      "\\Network Interface(*)\\Packets/sec",
+                                      "\\Network Interface(*)\\Packets Sent/sec",
+                                      "\\Network Interface(*)\\Packets Received/sec",
+                                      "\\Network Interface(*)\\Packets Outbound Errors",
+                                      "\\Network Interface(*)\\Packets Received Errors"
+                                    ],
+                                    "name": "perfCounterDataSource60"
+                                  }
+                                ],
+                                "windowsEventLogs": [
+                                  {
+                                    "name": "SecurityAuditEvents",
+                                    "streams": [
+                                      "Microsoft-WindowsEvent"
+                                    ],
+                                    "xPathQueries": [
+                                      "Security!*[System[(EventID=4624 or EventID=4625)]]"
+                                    ]
+                                  },
+                                  {
+                                    "name": "AuditSuccessFailure",
+                                    "streams": [
+                                      "Microsoft-Event"
+                                    ],
+                                    "xPathQueries": [
+                                      "Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]"
+                                    ]
+                                  }
+                                ]
+                              },
+                              "destinations": {
+                                "logAnalytics": [
+                                  {
+                                    "workspaceResourceId": "[parameters('logAnalyticsWorkspaceResourceId')]",
+                                    "name": "[variables('dcrLogAnalyticsDestinationName')]"
+                                  }
+                                ]
+                              },
+                              "dataFlows": [
+                                {
+                                  "streams": [
+                                    "Microsoft-Perf"
+                                  ],
+                                  "destinations": [
+                                    "[variables('dcrLogAnalyticsDestinationName')]"
+                                  ],
+                                  "transformKql": "source",
+                                  "outputStream": "Microsoft-Perf"
+                                },
+                                {
+                                  "streams": [
+                                    "Microsoft-Event"
+                                  ],
+                                  "destinations": [
+                                    "[variables('dcrLogAnalyticsDestinationName')]"
+                                  ],
+                                  "transformKql": "source",
+                                  "outputStream": "Microsoft-Event"
+                                }
+                              ]
+                            }
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "2441324888126124697"
+                            },
+                            "name": "Data Collection Rules",
+                            "description": "This module deploys a Data Collection Rule."
+                          },
+                          "definitions": {
+                            "dataCollectionRulePropertiesType": {
+                              "type": "object",
+                              "discriminator": {
+                                "propertyName": "kind",
+                                "mapping": {
+                                  "Linux": {
+                                    "$ref": "#/definitions/linuxDcrPropertiesType"
+                                  },
+                                  "Windows": {
+                                    "$ref": "#/definitions/windowsDcrPropertiesType"
+                                  },
+                                  "All": {
+                                    "$ref": "#/definitions/allPlatformsDcrPropertiesType"
+                                  },
+                                  "AgentSettings": {
+                                    "$ref": "#/definitions/agentSettingsDcrPropertiesType"
+                                  },
+                                  "Direct": {
+                                    "$ref": "#/definitions/directDcrPropertiesType"
+                                  },
+                                  "WorkspaceTransforms": {
+                                    "$ref": "#/definitions/workspaceTransformsDcrPropertiesType"
+                                  },
+                                  "PlatformTelemetry": {
+                                    "$ref": "#/definitions/platformTelemetryDcrPropertiesType"
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "Required. The type for data collection rule properties. Depending on the kind, the properties will be different."
+                              }
+                            },
+                            "linuxDcrPropertiesType": {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Linux"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The kind of the resource."
+                                  }
+                                },
+                                "dataSources": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataSources"
+                                    },
+                                    "description": "Required. Specification of data sources that will be collected."
+                                  }
+                                },
+                                "dataFlows": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                                    },
+                                    "description": "Required. The specification of data flows."
+                                  }
+                                },
+                                "destinations": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                                    },
+                                    "description": "Required. Specification of destinations that can be used in data flows."
+                                  }
+                                },
+                                "dataCollectionEndpointResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+                                  }
+                                },
+                                "streamDeclarations": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/streamDeclarations"
+                                    },
+                                    "description": "Optional. Declaration of custom streams used in this rule."
+                                  },
+                                  "nullable": true
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description of the data collection rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the properties of the 'Linux' data collection rule."
+                              }
+                            },
+                            "windowsDcrPropertiesType": {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Windows"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The kind of the resource."
+                                  }
+                                },
+                                "dataSources": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataSources"
+                                    },
+                                    "description": "Required. Specification of data sources that will be collected."
+                                  }
+                                },
+                                "dataFlows": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                                    },
+                                    "description": "Required. The specification of data flows."
+                                  }
+                                },
+                                "destinations": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                                    },
+                                    "description": "Required. Specification of destinations that can be used in data flows."
+                                  }
+                                },
+                                "dataCollectionEndpointResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+                                  }
+                                },
+                                "streamDeclarations": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/streamDeclarations"
+                                    },
+                                    "description": "Optional. Declaration of custom streams used in this rule."
+                                  },
+                                  "nullable": true
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description of the data collection rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the properties of the 'Windows' data collection rule."
+                              }
+                            },
+                            "allPlatformsDcrPropertiesType": {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "All"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The kind of the resource."
+                                  }
+                                },
+                                "dataSources": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataSources"
+                                    },
+                                    "description": "Required. Specification of data sources that will be collected."
+                                  }
+                                },
+                                "dataFlows": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                                    },
+                                    "description": "Required. The specification of data flows."
+                                  }
+                                },
+                                "destinations": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                                    },
+                                    "description": "Required. Specification of destinations that can be used in data flows."
+                                  }
+                                },
+                                "dataCollectionEndpointResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+                                  }
+                                },
+                                "streamDeclarations": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/streamDeclarations"
+                                    },
+                                    "description": "Optional. Declaration of custom streams used in this rule."
+                                  },
+                                  "nullable": true
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description of the data collection rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the properties of the data collection rule of the kind 'All'."
+                              }
+                            },
+                            "agentSettingsDcrPropertiesType": {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AgentSettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The kind of the resource."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description of the data collection rule."
+                                  }
+                                },
+                                "agentSettings": {
+                                  "$ref": "#/definitions/agentSettingsType",
+                                  "metadata": {
+                                    "description": "Required. Agent settings used to modify agent behavior on a given host."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the properties of the 'AgentSettings' data collection rule."
+                              }
+                            },
+                            "agentSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "logs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/agentSettingType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. All the settings that are applicable to the logs agent (AMA)."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the agent settings."
+                              }
+                            },
+                            "agentSettingType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "MaxDiskQuotaInMB",
+                                    "UseTimeReceivedForForwardedEvents"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The name of the agent setting."
+                                  }
+                                },
+                                "value": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The value of the agent setting."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the (single) agent setting."
+                              }
+                            },
+                            "directDcrPropertiesType": {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Direct"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The kind of the resource."
+                                  }
+                                },
+                                "dataFlows": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                                    },
+                                    "description": "Required. The specification of data flows."
+                                  }
+                                },
+                                "destinations": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                                    },
+                                    "description": "Required. Specification of destinations that can be used in data flows."
+                                  }
+                                },
+                                "dataCollectionEndpointResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the data collection endpoint that this rule can be used with."
+                                  }
+                                },
+                                "streamDeclarations": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/streamDeclarations"
+                                    },
+                                    "description": "Required. Declaration of custom streams used in this rule."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description of the data collection rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the properties of the 'Direct' data collection rule."
+                              }
+                            },
+                            "workspaceTransformsDcrPropertiesType": {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "WorkspaceTransforms"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The kind of the resource."
+                                  }
+                                },
+                                "dataFlows": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                                    },
+                                    "description": "Required. The specification of data flows. Should include a separate dataflow for each table that will have a transformation. Use a where clause in the query if only certain records should be transformed."
+                                  }
+                                },
+                                "destinations": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations"
+                                    },
+                                    "description": "Required. Specification of destinations that can be used in data flows. For WorkspaceTransforms, only one Log Analytics workspace destination is supported."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description of the data collection rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the properties of the 'WorkspaceTransforms' data collection rule."
+                              }
+                            },
+                            "platformTelemetryDcrPropertiesType": {
+                              "type": "object",
+                              "properties": {
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "PlatformTelemetry"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The kind of the resource."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description of the data collection rule."
+                                  }
+                                },
+                                "dataSources": {
+                                  "type": "object",
+                                  "properties": {
+                                    "platformTelemetry": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataSources/properties/platformTelemetry"
+                                        },
+                                        "description": "Required. The list of platform telemetry configurations."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Specification of data sources that will be collected."
+                                  }
+                                },
+                                "destinations": {
+                                  "type": "object",
+                                  "properties": {
+                                    "logAnalytics": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations/properties/logAnalytics"
+                                        },
+                                        "description": "Optional. The list of Log Analytics destinations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "storageAccounts": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations/properties/storageAccounts"
+                                        },
+                                        "description": "Optional. The list of Storage Account destinations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "eventHubs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/destinations/properties/eventHubs"
+                                        },
+                                        "description": "Optional. The list of Event Hub destinations."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Specification of destinations. Choose a single destination type of either logAnalytics, storageAccounts, or eventHubs."
+                                  }
+                                },
+                                "dataFlows": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/dataFlows"
+                                    },
+                                    "description": "Required. The specification of data flows."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the properties of the 'PlatformTelemetry' data collection rule."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the data collection rule. The name is case insensitive."
+                              }
+                            },
+                            "dataCollectionRuleProperties": {
+                              "$ref": "#/definitions/dataCollectionRulePropertiesType",
+                              "metadata": {
+                                "description": "Required. The kind of data collection rule."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/tags"
+                                },
+                                "description": "Optional. Resource tags."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            },
+                            "dataCollectionRulePropertiesUnion": "[union(createObject('description', tryGet(parameters('dataCollectionRuleProperties'), 'description')), if(contains(createArray('Linux', 'Windows', 'All', 'PlatformTelemetry'), parameters('dataCollectionRuleProperties').kind), createObject('dataSources', parameters('dataCollectionRuleProperties').dataSources), createObject()), if(contains(createArray('Linux', 'Windows', 'All', 'Direct', 'WorkspaceTransforms', 'PlatformTelemetry'), parameters('dataCollectionRuleProperties').kind), createObject('dataFlows', parameters('dataCollectionRuleProperties').dataFlows, 'destinations', parameters('dataCollectionRuleProperties').destinations), createObject()), if(contains(createArray('Linux', 'Windows', 'All', 'Direct', 'WorkspaceTransforms'), parameters('dataCollectionRuleProperties').kind), createObject('dataCollectionEndpointId', tryGet(parameters('dataCollectionRuleProperties'), 'dataCollectionEndpointResourceId'), 'streamDeclarations', tryGet(parameters('dataCollectionRuleProperties'), 'streamDeclarations')), createObject()), if(equals(parameters('dataCollectionRuleProperties').kind, 'AgentSettings'), createObject('agentSettings', parameters('dataCollectionRuleProperties').agentSettings), createObject()))]",
+                            "enableReferencedModulesTelemetry": false
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.insights-datacollectionrule.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "dataCollectionRule": {
+                              "condition": "[not(equals(parameters('dataCollectionRuleProperties').kind, 'All'))]",
+                              "type": "Microsoft.Insights/dataCollectionRules",
+                              "apiVersion": "2024-03-11",
+                              "name": "[parameters('name')]",
+                              "kind": "[parameters('dataCollectionRuleProperties').kind]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "properties": "[variables('dataCollectionRulePropertiesUnion')]"
+                            },
+                            "dataCollectionRuleAll": {
+                              "condition": "[equals(parameters('dataCollectionRuleProperties').kind, 'All')]",
+                              "type": "Microsoft.Insights/dataCollectionRules",
+                              "apiVersion": "2024-03-11",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "properties": "[variables('dataCollectionRulePropertiesUnion')]"
+                            },
+                            "dataCollectionRule_conditionalScopeLock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-DCR-Lock', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "dataCollectionRuleName": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), createObject('value', parameters('name')), createObject('value', parameters('name')))]",
+                                  "lock": {
+                                    "value": "[parameters('lock')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "2876136109547890997"
+                                    }
+                                  },
+                                  "definitions": {
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "dataCollectionRuleName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the Data Collection Rule to assign the role(s) to."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "dataCollectionRule": {
+                                      "existing": true,
+                                      "type": "Microsoft.Insights/dataCollectionRules",
+                                      "apiVersion": "2024-03-11",
+                                      "name": "[parameters('dataCollectionRuleName')]"
+                                    },
+                                    "dataCollectionRule_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[resourceId('Microsoft.Insights/dataCollectionRules', parameters('dataCollectionRuleName'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('dataCollectionRuleName')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      }
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "dataCollectionRule",
+                                "dataCollectionRuleAll"
+                              ]
+                            },
+                            "dataCollectionRule_roleAssignments": {
+                              "copy": {
+                                "name": "dataCollectionRule_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-DCR-RoleAssignments-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "resourceId": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), createObject('value', resourceId('Microsoft.Insights/dataCollectionRules', parameters('name'))), createObject('value', resourceId('Microsoft.Insights/dataCollectionRules', parameters('name'))))]",
+                                  "name": {
+                                    "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "roleDefinitionId": {
+                                    "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                                  },
+                                  "principalId": {
+                                    "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                  },
+                                  "description": {
+                                    "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]"
+                                  },
+                                  "principalType": {
+                                    "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.32.4.45862",
+                                      "templateHash": "14634305923902101494"
+                                    },
+                                    "name": "Resource-scoped role assignment",
+                                    "description": "This module deploys a Role Assignment for a specific resource."
+                                  },
+                                  "parameters": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The scope for the role assignment, fully qualified resourceId."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[guid(parameters('resourceId'), parameters('principalId'), if(contains(parameters('roleDefinitionId'), '/providers/Microsoft.Authorization/roleDefinitions/'), parameters('roleDefinitionId'), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('roleDefinitionId'))))]",
+                                      "metadata": {
+                                        "description": "Optional. The unique guid name for the role assignment."
+                                      }
+                                    },
+                                    "roleDefinitionId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The role definition ID for the role assignment."
+                                      }
+                                    },
+                                    "roleName": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The name for the role, used for logging."
+                                      }
+                                    },
+                                    "principalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The Principal or Object ID of the Security Principal (User, Group, Service Principal, Managed Identity)."
+                                      }
+                                    },
+                                    "principalType": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "allowedValues": [
+                                        "ServicePrincipal",
+                                        "Group",
+                                        "User",
+                                        "ForeignGroup",
+                                        "Device",
+                                        ""
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The principal type of the assigned principal ID."
+                                      }
+                                    },
+                                    "description": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The description of role assignment."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "$fxv#0": {
+                                      "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                      "contentVersion": "1.0.0.0",
+                                      "parameters": {
+                                        "scope": {
+                                          "type": "string"
+                                        },
+                                        "name": {
+                                          "type": "string"
+                                        },
+                                        "roleDefinitionId": {
+                                          "type": "string"
+                                        },
+                                        "principalId": {
+                                          "type": "string"
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User",
+                                            ""
+                                          ],
+                                          "defaultValue": "",
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string"
+                                        }
+                                      },
+                                      "resources": [
+                                        {
+                                          "type": "Microsoft.Authorization/roleAssignments",
+                                          "apiVersion": "2022-04-01",
+                                          "scope": "[[parameters('scope')]",
+                                          "name": "[[parameters('name')]",
+                                          "properties": {
+                                            "roleDefinitionId": "[[parameters('roleDefinitionId')]",
+                                            "principalId": "[[parameters('principalId')]",
+                                            "principalType": "[[parameters('principalType')]",
+                                            "description": "[[parameters('description')]"
+                                          }
+                                        }
+                                      ],
+                                      "outputs": {
+                                        "roleAssignmentId": {
+                                          "type": "string",
+                                          "value": "[[extensionResourceId(parameters('scope'), 'Microsoft.Authorization/roleAssignments', parameters('name'))]"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.ptn.authorization-resourceroleassignment.{0}.{1}', replace('0.1.2', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2023-07-01",
+                                      "name": "[format('{0}-ResourceRoleAssignment', guid(parameters('resourceId'), parameters('principalId'), parameters('roleDefinitionId')))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "expressionEvaluationOptions": {
+                                          "scope": "Outer"
+                                        },
+                                        "template": "[variables('$fxv#0')]",
+                                        "parameters": {
+                                          "scope": {
+                                            "value": "[parameters('resourceId')]"
+                                          },
+                                          "name": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "roleDefinitionId": {
+                                            "value": "[if(contains(parameters('roleDefinitionId'), '/providers/Microsoft.Authorization/roleDefinitions/'), parameters('roleDefinitionId'), subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('roleDefinitionId')))]"
+                                          },
+                                          "principalId": {
+                                            "value": "[parameters('principalId')]"
+                                          },
+                                          "principalType": {
+                                            "value": "[parameters('principalType')]"
+                                          },
+                                          "description": {
+                                            "value": "[parameters('description')]"
+                                          }
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The GUID of the Role Assignment."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "roleName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name for the role, used for logging."
+                                      },
+                                      "value": "[parameters('roleName')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Role Assignment."
+                                      },
+                                      "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}-ResourceRoleAssignment', guid(parameters('resourceId'), parameters('principalId'), parameters('roleDefinitionId')))), '2023-07-01').outputs.roleAssignmentId.value]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the role assignment was applied at."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "dataCollectionRule",
+                                "dataCollectionRuleAll"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the dataCollectionRule."
+                              },
+                              "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), parameters('name'), parameters('name'))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the dataCollectionRule."
+                              },
+                              "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), resourceId('Microsoft.Insights/dataCollectionRules', parameters('name')), resourceId('Microsoft.Insights/dataCollectionRules', parameters('name')))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the dataCollectionRule was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), reference('dataCollectionRuleAll', '2024-03-11', 'full').location, reference('dataCollectionRule', '2024-03-11', 'full').location)]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), tryGet(tryGet(if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), reference('dataCollectionRuleAll', '2024-03-11', 'full'), null()), 'identity'), 'principalId'), tryGet(tryGet(if(not(equals(parameters('dataCollectionRuleProperties').kind, 'All')), reference('dataCollectionRule', '2024-03-11', 'full'), null()), 'identity'), 'principalId'))]"
+                            },
+                            "endpoints": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Insights/dataCollectionRules@2024-03-11#properties/properties/properties/endpoints",
+                                  "output": true
+                                },
+                                "description": "The endpoints of the dataCollectionRule, if created."
+                              },
+                              "nullable": true,
+                              "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), tryGet(reference('dataCollectionRuleAll'), 'endpoints'), tryGet(reference('dataCollectionRule'), 'endpoints'))]"
+                            },
+                            "immutableId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The ImmutableId of the dataCollectionRule."
+                              },
+                              "value": "[if(equals(parameters('dataCollectionRuleProperties').kind, 'All'), tryGet(reference('dataCollectionRuleAll'), 'immutableId'), tryGet(reference('dataCollectionRule'), 'immutableId'))]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the data collection rule."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.data-collection-rule.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the data collection rule."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.insights.data-collection-rule.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "existingLogAnalyticsWorkspace",
+                "log_analytics"
+              ]
+            },
+            "proximityPlacementGroup": {
+              "condition": "[parameters('enablePrivateNetworking')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.proximity-placement-group.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "availabilityZone": {
+                    "value": "[variables('virtualMachineAvailabilityZone')]"
+                  },
+                  "vmSizes": {
+                    "value": [
+                      "[parameters('vmSize')]"
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "13006336383696924611"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('ppg-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the proximity placement group."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "availabilityZone": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Availability zone for the proximity placement group."
+                      }
+                    },
+                    "vmSizes": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "VM sizes intent for the proximity placement group."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Enable Azure telemetry collection."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.compute.proximity-placement-group.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "availabilityZone": {
+                            "value": "[parameters('availabilityZone')]"
+                          },
+                          "intent": "[if(not(empty(parameters('vmSizes'))), createObject('value', createObject('vmSizes', parameters('vmSizes'))), createObject('value', null()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "14590939924256334253"
+                            },
+                            "name": "Proximity Placement Groups",
+                            "description": "This module deploys a Proximity Placement Group."
+                          },
+                          "definitions": {
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the proximity placement group that is being created."
+                              }
+                            },
+                            "type": {
+                              "type": "string",
+                              "defaultValue": "Standard",
+                              "allowedValues": [
+                                "Standard",
+                                "Ultra"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the type of the proximity placement group."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Resource location."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/proximityPlacementGroups@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the proximity placement group resource."
+                              },
+                              "nullable": true
+                            },
+                            "availabilityZone": {
+                              "type": "int",
+                              "allowedValues": [
+                                -1,
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Required. Specifies the Availability Zone where virtual machine, virtual machine scale set or availability set associated with the proximity placement group can be created. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                              }
+                            },
+                            "colocationStatus": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/proximityPlacementGroups@2024-11-01#properties/properties/properties/colocationStatus"
+                                },
+                                "description": "Optional. Describes colocation status of the Proximity Placement Group."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "intent": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/proximityPlacementGroups@2024-11-01#properties/properties/properties/intent"
+                                },
+                                "description": "Optional. Specifies the user intent of the proximity placement group."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.compute-proximityplacementgroup.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "proximityPlacementGroup": {
+                              "type": "Microsoft.Compute/proximityPlacementGroups",
+                              "apiVersion": "2022-08-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "zones": "[if(not(equals(parameters('availabilityZone'), -1)), array(string(parameters('availabilityZone'))), null())]",
+                              "properties": {
+                                "proximityPlacementGroupType": "[parameters('type')]",
+                                "colocationStatus": "[parameters('colocationStatus')]",
+                                "intent": "[parameters('intent')]"
+                              }
+                            },
+                            "proximityPlacementGroup_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Compute/proximityPlacementGroups/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "proximityPlacementGroup"
+                              ]
+                            },
+                            "proximityPlacementGroup_roleAssignments": {
+                              "copy": {
+                                "name": "proximityPlacementGroup_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Compute/proximityPlacementGroups/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Compute/proximityPlacementGroups', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "proximityPlacementGroup"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the proximity placement group."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resourceId the proximity placement group."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/proximityPlacementGroups', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the proximity placement group was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('proximityPlacementGroup', '2022-08-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the proximity placement group."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.compute.proximity-placement-group.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the proximity placement group."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.compute.proximity-placement-group.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+                    }
+                  }
+                }
+              }
+            },
+            "virtualMachine": {
+              "condition": "[parameters('enablePrivateNetworking')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.virtual-machine.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "vmSize": {
+                    "value": "[parameters('vmSize')]"
+                  },
+                  "availabilityZone": {
+                    "value": "[variables('virtualMachineAvailabilityZone')]"
+                  },
+                  "adminUsername": {
+                    "value": "[coalesce(parameters('vmAdminUsername'), 'testvmuser')]"
+                  },
+                  "adminPassword": {
+                    "value": "[coalesce(parameters('vmAdminPassword'), format('Vm!{0}{1}', uniqueString(subscription().subscriptionId, parameters('solutionName')), guid(subscription().subscriptionId, parameters('solutionName'), 'vm-admin-password')))]"
+                  },
+                  "subnetResourceId": {
+                    "value": "[reference('virtualNetwork').outputs.administrationSubnetResourceId.value]"
+                  },
+                  "deployingUserPrincipalId": {
+                    "value": "[variables('deployingUserPrincipalId')]"
+                  },
+                  "deployingUserPrincipalType": {
+                    "value": "[parameters('deployingUserPrincipalType')]"
+                  },
+                  "roleAssignments": {
+                    "value": [
+                      {
+                        "roleDefinitionIdOrName": "1c0163c0-47e6-4577-8991-ea5c82e286e4",
+                        "principalId": "[variables('deployingUserPrincipalId')]",
+                        "principalType": "[parameters('deployingUserPrincipalType')]"
+                      }
+                    ]
+                  },
+                  "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', null()))]",
+                  "maintenanceConfigurationResourceId": {
+                    "value": "[reference('maintenanceConfiguration').outputs.resourceId.value]"
+                  },
+                  "proximityPlacementGroupResourceId": {
+                    "value": "[reference('proximityPlacementGroup').outputs.resourceId.value]"
+                  },
+                  "extensionMonitoringAgentConfig": "[if(parameters('enableMonitoring'), createObject('value', createObject('dataCollectionRuleAssociations', createArray(createObject('dataCollectionRuleResourceId', reference('windowsVmDataCollectionRules').outputs.resourceId.value, 'name', format('send-{0}', if(variables('useExistingLogAnalytics'), split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8], if(parameters('enableMonitoring'), reference('log_analytics').outputs.name.value, ''))))), 'enabled', true(), 'tags', parameters('tags'))), createObject('value', null()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "6809285625079537766"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('vm-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the virtual machine."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "vmSize": {
+                      "type": "string",
+                      "defaultValue": "Standard_D2s_v5",
+                      "metadata": {
+                        "description": "VM size."
+                      }
+                    },
+                    "adminUsername": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "Local admin username. Required by Azure at provisioning time but not used for login when Entra ID is enabled."
+                      }
+                    },
+                    "adminPassword": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "Local admin password. Required by Azure at provisioning time but not used for login when Entra ID is enabled."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the subnet for the VM NIC."
+                      }
+                    },
+                    "osType": {
+                      "type": "string",
+                      "defaultValue": "Windows",
+                      "metadata": {
+                        "description": "OS type for the VM."
+                      }
+                    },
+                    "availabilityZone": {
+                      "type": "int",
+                      "defaultValue": -1,
+                      "metadata": {
+                        "description": "Availability zone for the VM."
+                      }
+                    },
+                    "imageReference": {
+                      "type": "object",
+                      "defaultValue": {
+                        "publisher": "microsoft-dsvm",
+                        "offer": "dsvm-win-2022",
+                        "sku": "winserver-2022",
+                        "version": "latest"
+                      },
+                      "metadata": {
+                        "description": "Image reference for the VM."
+                      }
+                    },
+                    "osDiskSizeGB": {
+                      "type": "int",
+                      "defaultValue": 128,
+                      "metadata": {
+                        "description": "OS disk size in GB."
+                      }
+                    },
+                    "maintenanceConfigurationResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Resource ID of the maintenance configuration."
+                      }
+                    },
+                    "proximityPlacementGroupResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Resource ID of the proximity placement group."
+                      }
+                    },
+                    "extensionMonitoringAgentConfig": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Monitoring agent extension configuration (data collection rule associations)."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Diagnostic settings for the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Enable Azure telemetry collection."
+                      }
+                    },
+                    "deployingUserPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Deploying user principal ID. Used for default role assignment to grant the deploying user login access to the VM. This is required because with Entra ID authentication enabled, local accounts cannot be used to access the VM, including the local admin account created at provisioning."
+                      }
+                    },
+                    "deployingUserPrincipalType": {
+                      "type": "string",
+                      "defaultValue": "User",
+                      "metadata": {
+                        "description": "Deploying user principal type. Used for default role assignment to grant the deploying user login access to the VM. This is required because with Entra ID authentication enabled, local accounts cannot be used to access the VM, including the local admin account created at provisioning."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "defaultValue": [
+                        {
+                          "roleDefinitionIdOrName": "1c0163c0-47e6-4577-8991-ea5c82e286e4",
+                          "principalId": "[parameters('deployingUserPrincipalId')]",
+                          "principalType": "[parameters('deployingUserPrincipalType')]"
+                        }
+                      ],
+                      "metadata": {
+                        "description": "Role assignments to apply to the virtual machine."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "virtualMachine": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.compute.virtual-machine.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "computerName": {
+                            "value": "[take(parameters('name'), 15)]"
+                          },
+                          "osType": {
+                            "value": "[parameters('osType')]"
+                          },
+                          "vmSize": {
+                            "value": "[parameters('vmSize')]"
+                          },
+                          "adminUsername": {
+                            "value": "[parameters('adminUsername')]"
+                          },
+                          "adminPassword": {
+                            "value": "[parameters('adminPassword')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          },
+                          "patchMode": {
+                            "value": "AutomaticByPlatform"
+                          },
+                          "bypassPlatformSafetyChecksOnUserSchedule": {
+                            "value": true
+                          },
+                          "maintenanceConfigurationResourceId": {
+                            "value": "[parameters('maintenanceConfigurationResourceId')]"
+                          },
+                          "enableAutomaticUpdates": {
+                            "value": true
+                          },
+                          "encryptionAtHost": {
+                            "value": true
+                          },
+                          "availabilityZone": {
+                            "value": "[parameters('availabilityZone')]"
+                          },
+                          "proximityPlacementGroupResourceId": {
+                            "value": "[parameters('proximityPlacementGroupResourceId')]"
+                          },
+                          "imageReference": {
+                            "value": "[parameters('imageReference')]"
+                          },
+                          "osDisk": {
+                            "value": {
+                              "name": "[format('osdisk-{0}', parameters('name'))]",
+                              "caching": "ReadWrite",
+                              "createOption": "FromImage",
+                              "deleteOption": "Delete",
+                              "diskSizeGB": "[parameters('osDiskSizeGB')]",
+                              "managedDisk": {
+                                "storageAccountType": "Premium_LRS"
+                              }
+                            }
+                          },
+                          "nicConfigurations": {
+                            "value": [
+                              {
+                                "name": "[format('nic-{0}', parameters('name'))]",
+                                "tags": "[parameters('tags')]",
+                                "deleteOption": "Delete",
+                                "diagnosticSettings": "[parameters('diagnosticSettings')]",
+                                "ipConfigurations": [
+                                  {
+                                    "name": "[format('{0}-nic01-ipconfig01', parameters('name'))]",
+                                    "subnetResourceId": "[parameters('subnetResourceId')]",
+                                    "diagnosticSettings": "[parameters('diagnosticSettings')]"
+                                  }
+                                ]
+                              }
+                            ]
+                          },
+                          "roleAssignments": {
+                            "value": "[parameters('roleAssignments')]"
+                          },
+                          "extensionAadJoinConfig": {
+                            "value": {
+                              "enabled": true,
+                              "tags": "[parameters('tags')]",
+                              "typeHandlerVersion": "2.0",
+                              "settings": {
+                                "mdmId": ""
+                              }
+                            }
+                          },
+                          "extensionAntiMalwareConfig": {
+                            "value": {
+                              "enabled": true,
+                              "settings": {
+                                "AntimalwareEnabled": "true",
+                                "Exclusions": {},
+                                "RealtimeProtectionEnabled": "true",
+                                "ScheduledScanSettings": {
+                                  "day": "7",
+                                  "isEnabled": "true",
+                                  "scanType": "Quick",
+                                  "time": "120"
+                                }
+                              },
+                              "tags": "[parameters('tags')]"
+                            }
+                          },
+                          "extensionMonitoringAgentConfig": {
+                            "value": "[parameters('extensionMonitoringAgentConfig')]"
+                          },
+                          "extensionNetworkWatcherAgentConfig": {
+                            "value": {
+                              "enabled": true,
+                              "tags": "[parameters('tags')]"
+                            }
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "17174537341033050778"
+                            },
+                            "name": "Virtual Machines",
+                            "description": "This module deploys a Virtual Machine with one or multiple NICs and optionally one or multiple public IPs."
+                          },
+                          "definitions": {
+                            "osDiskType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The disk name."
+                                  }
+                                },
+                                "diskSizeGB": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the size of an empty data disk in gigabytes."
+                                  }
+                                },
+                                "createOption": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Attach",
+                                    "Empty",
+                                    "FromImage"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies how the virtual machine should be created."
+                                  }
+                                },
+                                "deleteOption": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Delete",
+                                    "Detach"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion."
+                                  }
+                                },
+                                "caching": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "None",
+                                    "ReadOnly",
+                                    "ReadWrite"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the caching requirements."
+                                  }
+                                },
+                                "diffDiskSettings": {
+                                  "type": "object",
+                                  "properties": {
+                                    "placement": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "CacheDisk",
+                                        "NvmeDisk",
+                                        "ResourceDisk"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Specifies the ephemeral disk placement for the operating system disk."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the ephemeral Disk Settings for the operating system disk."
+                                  }
+                                },
+                                "managedDisk": {
+                                  "type": "object",
+                                  "properties": {
+                                    "storageAccountType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "PremiumV2_LRS",
+                                        "Premium_LRS",
+                                        "Premium_ZRS",
+                                        "StandardSSD_LRS",
+                                        "StandardSSD_ZRS",
+                                        "Standard_LRS",
+                                        "UltraSSD_LRS"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the storage account type for the managed disk."
+                                      }
+                                    },
+                                    "diskEncryptionSetResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                                      }
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the resource id of a pre-existing managed disk. If the disk should be created, this property should be empty."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The managed disk parameters."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type describing an OS disk."
+                              }
+                            },
+                            "dataDiskType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The disk name. When attaching a pre-existing disk, this name is ignored and the name of the existing disk is used."
+                                  }
+                                },
+                                "lun": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the logical unit number of the data disk."
+                                  }
+                                },
+                                "diskSizeGB": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the size of an empty data disk in gigabytes. This property is ignored when attaching a pre-existing disk."
+                                  }
+                                },
+                                "createOption": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Attach",
+                                    "Empty",
+                                    "FromImage"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies how the virtual machine should be created. This property is automatically set to 'Attach' when attaching a pre-existing disk."
+                                  }
+                                },
+                                "deleteOption": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Delete",
+                                    "Detach"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether data disk should be deleted or detached upon VM deletion. This property is automatically set to 'Detach' when attaching a pre-existing disk."
+                                  }
+                                },
+                                "caching": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "None",
+                                    "ReadOnly",
+                                    "ReadWrite"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the caching requirements. This property is automatically set to 'None' when attaching a pre-existing disk."
+                                  }
+                                },
+                                "diskIOPSReadWrite": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The number of IOPS allowed for this disk; only settable for UltraSSD disks. One operation can transfer between 4k and 256k bytes. Ignored when attaching a pre-existing disk."
+                                  }
+                                },
+                                "diskMBpsReadWrite": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The bandwidth allowed for this disk; only settable for UltraSSD disks. MBps means millions of bytes per second - MB here uses the ISO notation, of powers of 10. Ignored when attaching a pre-existing disk."
+                                  }
+                                },
+                                "managedDisk": {
+                                  "type": "object",
+                                  "properties": {
+                                    "storageAccountType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "PremiumV2_LRS",
+                                        "Premium_LRS",
+                                        "Premium_ZRS",
+                                        "StandardSSD_LRS",
+                                        "StandardSSD_ZRS",
+                                        "Standard_LRS",
+                                        "UltraSSD_LRS"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the storage account type for the managed disk. Ignored when attaching a pre-existing disk."
+                                      }
+                                    },
+                                    "diskEncryptionSetResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the customer managed disk encryption set resource id for the managed disk."
+                                      }
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the resource id of a pre-existing managed disk. If the disk should be created, this property should be empty."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The managed disk parameters."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Compute/disks@2025-01-02#properties/tags"
+                                    },
+                                    "description": "Optional. The tags of the public IP address. Valid only when creating a new managed disk."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type describing a data disk."
+                              }
+                            },
+                            "publicKeyType": {
+                              "type": "object",
+                              "properties": {
+                                "keyData": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Specifies the SSH public key data used to authenticate through ssh."
+                                  }
+                                },
+                                "path": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Specifies the full path on the created VM where ssh public key is stored. If the file already exists, the specified key is appended to the file."
+                                  }
+                                }
+                              }
+                            },
+                            "nicConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the NIC configuration."
+                                  }
+                                },
+                                "nicSuffix": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The suffix to append to the NIC name."
+                                  }
+                                },
+                                "enableIPForwarding": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Indicates whether IP forwarding is enabled on this network interface."
+                                  }
+                                },
+                                "enableAcceleratedNetworking": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If the network interface is accelerated networking enabled."
+                                  }
+                                },
+                                "deleteOption": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Delete",
+                                    "Detach"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify what happens to the network interface when the VM is deleted."
+                                  }
+                                },
+                                "dnsServers": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. List of DNS servers IP addresses. Use 'AzureProvidedDNS' to switch to azure provided DNS resolution. 'AzureProvidedDNS' value cannot be combined with other IPs, it must be the only value in dnsServers collection."
+                                  }
+                                },
+                                "networkSecurityGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The network security group (NSG) to attach to the network interface."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/ipConfigurationType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The IP configurations of the network interface."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The lock settings of the service."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The tags of the public IP address."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for the module."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the IP configuration."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the NIC configuration."
+                              }
+                            },
+                            "imageReferenceType": {
+                              "type": "object",
+                              "properties": {
+                                "communityGalleryImageId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specified the community gallery image unique id for vm deployment. This can be fetched from community gallery image GET call."
+                                  }
+                                },
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource Id of the image reference."
+                                  }
+                                },
+                                "offer": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the offer of the platform image or marketplace image used to create the virtual machine."
+                                  }
+                                },
+                                "publisher": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The image publisher."
+                                  }
+                                },
+                                "sku": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The SKU of the image."
+                                  }
+                                },
+                                "version": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the version of the platform image or marketplace image used to create the virtual machine. The allowed formats are Major.Minor.Build or 'latest'. Even if you use 'latest', the VM image will not automatically update after deploy time even if a new version becomes available."
+                                  }
+                                },
+                                "sharedGalleryImageId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specified the shared gallery image unique id for vm deployment. This can be fetched from shared gallery image GET call."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type describing the image reference."
+                              }
+                            },
+                            "planType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the plan."
+                                  }
+                                },
+                                "product": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the product of the image from the marketplace."
+                                  }
+                                },
+                                "publisher": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The publisher ID."
+                                  }
+                                },
+                                "promotionCode": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The promotion code."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "Specifies information about the marketplace image used to create the virtual machine."
+                              }
+                            },
+                            "autoShutDownConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "status": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "Enabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The status of the auto shutdown configuration."
+                                  }
+                                },
+                                "timeZone": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The time zone ID (e.g. China Standard Time, Greenland Standard Time, Pacific Standard time, etc.)."
+                                  }
+                                },
+                                "dailyRecurrenceTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The time of day the schedule will occur."
+                                  }
+                                },
+                                "notificationSettings": {
+                                  "type": "object",
+                                  "properties": {
+                                    "status": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The status of the notification settings."
+                                      }
+                                    },
+                                    "emailRecipient": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The email address to send notifications to (can be a list of semi-colon separated email addresses)."
+                                      }
+                                    },
+                                    "notificationLocale": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The locale to use when sending a notification (fallback for unsupported languages is EN)."
+                                      }
+                                    },
+                                    "webhookUrl": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The webhook URL to which the notification will be sent."
+                                      }
+                                    },
+                                    "timeInMinutes": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The time in minutes before shutdown to send notifications."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the schedule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type describing the configuration profile."
+                              }
+                            },
+                            "vaultSecretGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "sourceVault": {
+                                  "$ref": "#/definitions/subResourceType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The relative URL of the Key Vault containing all of the certificates in VaultCertificates."
+                                  }
+                                },
+                                "vaultCertificates": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "certificateStore": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. For Windows VMs, specifies the certificate store on the Virtual Machine to which the certificate should be added. The specified certificate store is implicitly in the LocalMachine account. For Linux VMs, the certificate file is placed under the /var/lib/waagent directory, with the file name <UppercaseThumbprint>.crt for the X509 certificate file and <UppercaseThumbprint>.prv for private key. Both of these files are .pem formatted."
+                                        }
+                                      },
+                                      "certificateUrl": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. This is the URL of a certificate that has been uploaded to Key Vault as a secret."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The list of key vault references in SourceVault which contain certificates."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type describing the set of certificates that should be installed onto the virtual machine."
+                              }
+                            },
+                            "vmGalleryApplicationType": {
+                              "type": "object",
+                              "properties": {
+                                "packageReferenceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Specifies the GalleryApplicationVersion resource id on the form of /subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroupName}/providers/Microsoft.Compute/galleries/{galleryName}/applications/{application}/versions/{version}."
+                                  }
+                                },
+                                "configurationReference": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the uri to an azure blob that will replace the default configuration for the package if provided."
+                                  }
+                                },
+                                "enableAutomaticUpgrade": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If set to true, when a new Gallery Application version is available in PIR/SIG, it will be automatically updated for the VM/VMSS."
+                                  }
+                                },
+                                "order": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the order in which the packages have to be installed."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies a passthrough value for more generic context."
+                                  }
+                                },
+                                "treatFailureAsDeploymentFailure": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If true, any failure for any operation in the VmApplication will fail the deployment."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type describing the gallery application that should be made available to the VM/VMSS."
+                              }
+                            },
+                            "additionalUnattendContentType": {
+                              "type": "object",
+                              "properties": {
+                                "settingName": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AutoLogon",
+                                    "FirstLogonCommands"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the name of the setting to which the content applies."
+                                  }
+                                },
+                                "content": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the XML formatted content that is added to the unattend.xml file for the specified path and component. The XML must be less than 4KB and must include the root element for the setting or feature that is being inserted."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type describing additional base-64 encoded XML formatted information that can be included in the Unattend.xml file, which is used by Windows Setup."
+                              }
+                            },
+                            "winRMListenerType": {
+                              "type": "object",
+                              "properties": {
+                                "certificateUrl": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The URL of a certificate that has been uploaded to Key Vault as a secret."
+                                  }
+                                },
+                                "protocol": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Http",
+                                    "Https"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the protocol of WinRM listener."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type describing a Windows Remote Management listener."
+                              }
+                            },
+                            "nicConfigurationOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the NIC configuration."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/networkInterfaceIPConfigurationOutputType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. List of IP configurations of the NIC configuration."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type describing the network interface configuration output."
+                              }
+                            },
+                            "extensionCustomScriptConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the virtual machine extension. Defaults to `CustomScriptExtension`."
+                                  }
+                                },
+                                "typeHandlerVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the version of the script handler. Defaults to `1.10` for Windows and `2.1` for Linux."
+                                  }
+                                },
+                                "autoUpgradeMinorVersion": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true. Defaults to `true`."
+                                  }
+                                },
+                                "forceUpdateTag": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                  }
+                                },
+                                "settings": {
+                                  "type": "object",
+                                  "properties": {
+                                    "commandToExecute": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. The entry point script to run. If the command contains any credentials, use the same property of the `protectedSettings` instead. Required if `protectedSettings.commandToExecute` is not provided."
+                                      }
+                                    },
+                                    "fileUris": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. URLs for files to be downloaded. If URLs are sensitive, for example, if they contain keys, this field should be specified in `protectedSettings`."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration of the custom script extension. Note: You can provide any property either in the `settings` or `protectedSettings` but not both. If your property contains secrets, use `protectedSettings`."
+                                  }
+                                },
+                                "protectedSettings": {
+                                  "type": "secureObject",
+                                  "properties": {
+                                    "commandToExecute": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. The entry point script to run. Use this property if your command contains secrets such as passwords or if your file URIs are sensitive. Required if `settings.commandToExecute` is not provided."
+                                      }
+                                    },
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The name of storage account. If you specify storage credentials, all fileUris values must be URLs for Azure blobs.."
+                                      }
+                                    },
+                                    "storageAccountKey": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The access key of the storage account."
+                                      }
+                                    },
+                                    "managedIdentityResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity for downloading files. Must not be used in conjunction with the `storageAccountName` or `storageAccountKey` property. If you want to use the VM's system assigned identity, set the `value` to an empty string."
+                                      }
+                                    },
+                                    "fileUris": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. URLs for files to be downloaded."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration of the custom script extension. Note: You can provide any property either in the `settings` or `protectedSettings` but not both. If your property contains secrets, use `protectedSettings`."
+                                  }
+                                },
+                                "supressFailures": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). Defaults to `false`."
+                                  }
+                                },
+                                "enableAutomaticUpgrade": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available. Defaults to `false`."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "protectedSettingsFromKeyVault": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                    },
+                                    "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                  },
+                                  "nullable": true
+                                },
+                                "provisionAfterExtensions": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                    },
+                                    "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a 'CustomScriptExtension' extension."
+                              }
+                            },
+                            "_1.applicationGatewayBackendAddressPoolsType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the backend address pool."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the backend address pool that is unique within an Application Gateway."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "backendAddresses": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "ipAddress": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. IP address of the backend address."
+                                            }
+                                          },
+                                          "fqdn": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. FQDN of the backend address."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Backend addresses."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Properties of the application gateway backend address pool."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the application gateway backend address pool.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "_1.applicationSecurityGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the application security group."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location of the application security group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Properties of the application security group."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Tags of the application security group."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the application security group.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "_1.backendAddressPoolType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the backend address pool."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the backend address pool."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The properties of the backend address pool."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a backend address pool.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "_1.inboundNatRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the inbound NAT rule."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the resource that is unique within the set of inbound NAT rules used by the load balancer. This name can be used to access the resource."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "backendAddressPool": {
+                                      "$ref": "#/definitions/_1.subResourceType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A reference to backendAddressPool resource."
+                                      }
+                                    },
+                                    "backendPort": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The port used for the internal endpoint. Acceptable values range from 1 to 65535."
+                                      }
+                                    },
+                                    "enableFloatingIP": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configures a virtual machine's endpoint for the floating IP capability required to configure a SQL AlwaysOn Availability Group. This setting is required when using the SQL AlwaysOn Availability Groups in SQL server. This setting can't be changed after you create the endpoint."
+                                      }
+                                    },
+                                    "enableTcpReset": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Receive bidirectional TCP Reset on TCP flow idle timeout or unexpected connection termination. This element is only used when the protocol is set to TCP."
+                                      }
+                                    },
+                                    "frontendIPConfiguration": {
+                                      "$ref": "#/definitions/_1.subResourceType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A reference to frontend IP addresses."
+                                      }
+                                    },
+                                    "frontendPort": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The port for the external endpoint. Port numbers for each rule must be unique within the Load Balancer. Acceptable values range from 1 to 65534."
+                                      }
+                                    },
+                                    "frontendPortRangeStart": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The port range start for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeEnd. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                      }
+                                    },
+                                    "frontendPortRangeEnd": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The port range end for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeStart. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                      }
+                                    },
+                                    "protocol": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "All",
+                                        "Tcp",
+                                        "Udp"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The reference to the transport protocol used by the load balancing rule."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Properties of the inbound NAT rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the inbound NAT rule.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "_1.subResourceType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the sub resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the sub resource.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "_1.virtualNetworkTapType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the virtual network tap."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location of the virtual network tap."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Properties of the virtual network tap."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Tags of the virtual network tap."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the virtual network tap.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                }
+                              }
+                            },
+                            "_2.ddosSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "ddosProtectionPlan": {
+                                  "type": "object",
+                                  "properties": {
+                                    "id": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                  }
+                                },
+                                "protectionMode": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Enabled"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The DDoS protection policy customizations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                                }
+                              }
+                            },
+                            "_2.dnsSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "domainNameLabel": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                  }
+                                },
+                                "domainNameLabelScope": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "NoReuse",
+                                    "ResourceGroupReuse",
+                                    "SubscriptionReuse",
+                                    "TenantReuse"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                  }
+                                },
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                  }
+                                },
+                                "reverseFqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                                }
+                              }
+                            },
+                            "_2.ipTagType": {
+                              "type": "object",
+                              "properties": {
+                                "ipTagType": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IP tag type."
+                                  }
+                                },
+                                "tag": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The IP tag."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                                }
+                              }
+                            },
+                            "_3.diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_3.lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_3.roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_4.publicIPConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Public IP Address."
+                                  }
+                                },
+                                "publicIPAddressResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the public IP address."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_3.diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Diagnostic settings for the public IP address."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The idle timeout in minutes."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/_3.lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The lock settings of the public IP address."
+                                  }
+                                },
+                                "idleTimeoutInMinutes": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The idle timeout of the public IP address."
+                                  }
+                                },
+                                "ddosSettings": {
+                                  "$ref": "#/definitions/_2.ddosSettingsType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                                  }
+                                },
+                                "dnsSettings": {
+                                  "$ref": "#/definitions/_2.dnsSettingsType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The DNS settings of the public IP address."
+                                  }
+                                },
+                                "publicIPAddressVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "IPv4",
+                                    "IPv6"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The public IP address version."
+                                  }
+                                },
+                                "publicIPAllocationMethod": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Dynamic",
+                                    "Static"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The public IP address allocation method."
+                                  }
+                                },
+                                "publicIpPrefixResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                                  }
+                                },
+                                "publicIpNameSuffix": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name suffix of the public IP address resource."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_3.roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "skuName": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Basic",
+                                    "Standard"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The SKU name of the public IP address."
+                                  }
+                                },
+                                "skuTier": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Global",
+                                    "Regional"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The SKU tier of the public IP address."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/publicIPAddresses@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. The tags of the public IP address."
+                                  },
+                                  "nullable": true
+                                },
+                                "availabilityZones": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    1,
+                                    2,
+                                    3
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The zones of the public IP address."
+                                  }
+                                },
+                                "ipTags": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_2.ipTagType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The list of tags associated with the public IP address."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for the module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the public IP address configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "modules/nic-configuration.bicep"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "ipConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the IP configuration."
+                                  }
+                                },
+                                "privateIPAllocationMethod": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Dynamic",
+                                    "Static"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private IP address allocation method."
+                                  }
+                                },
+                                "privateIPAddress": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private IP address."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the subnet."
+                                  }
+                                },
+                                "loadBalancerBackendAddressPools": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.backendAddressPoolType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The load balancer backend address pools."
+                                  }
+                                },
+                                "applicationSecurityGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.applicationSecurityGroupType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The application security groups."
+                                  }
+                                },
+                                "applicationGatewayBackendAddressPools": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.applicationGatewayBackendAddressPoolsType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The application gateway backend address pools."
+                                  }
+                                },
+                                "gatewayLoadBalancer": {
+                                  "$ref": "#/definitions/_1.subResourceType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The gateway load balancer settings."
+                                  }
+                                },
+                                "loadBalancerInboundNatRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.inboundNatRuleType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The load balancer inbound NAT rules."
+                                  }
+                                },
+                                "privateIPAddressVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "IPv4",
+                                    "IPv6"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private IP address version."
+                                  }
+                                },
+                                "virtualNetworkTaps": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.virtualNetworkTapType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The virtual network taps."
+                                  }
+                                },
+                                "pipConfiguration": {
+                                  "$ref": "#/definitions/_4.publicIPConfigurationType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The public IP address configuration."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_3.diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the IP configuration."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/networkInterfaces@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. The tags of the public IP address."
+                                  },
+                                  "nullable": true
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for the module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the IP configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "modules/nic-configuration.bicep"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "networkInterfaceIPConfigurationOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the IP configuration."
+                                  }
+                                },
+                                "privateIP": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The private IP address."
+                                  }
+                                },
+                                "publicIP": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The public IP address."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the network interface IP configuration output.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.3"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "subResourceType": {
+                              "type": "object",
+                              "properties": {
+                                "id": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the sub resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the sub resource.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.3"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the virtual machine to be created. You should use a unique prefix to reduce name collisions in Active Directory."
+                              }
+                            },
+                            "computerName": {
+                              "type": "string",
+                              "defaultValue": "[parameters('name')]",
+                              "metadata": {
+                                "description": "Optional. Can be used if the computer name needs to be different from the Azure VM resource name. If not used, the resource name will be used as computer name."
+                              }
+                            },
+                            "vmSize": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Specifies the size for the VMs."
+                              }
+                            },
+                            "encryptionAtHost": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. This property can be used by user in the request to enable or disable the Host Encryption for the virtual machine. This will enable the encryption for all the disks including Resource/Temp disk at host itself. For security reasons, it is recommended to set encryptionAtHost to True. Restrictions: Cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                              }
+                            },
+                            "securityType": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines@2025-04-01#properties/properties/properties/securityProfile/properties/securityType"
+                                },
+                                "description": "Optional. Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. The default behavior is: UefiSettings will not be enabled unless this property is set."
+                              },
+                              "nullable": true
+                            },
+                            "secureBootEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether secure boot should be enabled on the virtual machine. This parameter is part of the UefiSettings. SecurityType should be set to TrustedLaunch to enable UefiSettings."
+                              }
+                            },
+                            "vTpmEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether vTPM should be enabled on the virtual machine. This parameter is part of the UefiSettings.  SecurityType should be set to TrustedLaunch to enable UefiSettings."
+                              }
+                            },
+                            "imageReference": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines@2025-04-01#properties/properties/properties/storageProfile/properties/imageReference"
+                                },
+                                "description": "Conditional. OS image reference. In case of marketplace images, it's the combination of the publisher, offer, sku, version attributes. In case of custom images it's the resource ID of the custom image. Required if not creating the VM from an existing os-disk via the `osDisk.managedDisk.resourceId` parameter."
+                              },
+                              "nullable": true
+                            },
+                            "plan": {
+                              "$ref": "#/definitions/planType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies information about the marketplace image used to create the virtual machine. This element is only used for marketplace images. Before you can use a marketplace image from an API, you must enable the image for programmatic use."
+                              }
+                            },
+                            "osDisk": {
+                              "$ref": "#/definitions/osDiskType",
+                              "metadata": {
+                                "description": "Required. Specifies the OS disk. For security reasons, it is recommended to specify DiskEncryptionSet into the osDisk object.  Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                              }
+                            },
+                            "dataDisks": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/dataDiskType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the data disks. For security reasons, it is recommended to specify DiskEncryptionSet into the dataDisk object. Restrictions: DiskEncryptionSet cannot be enabled if Azure Disk Encryption (guest-VM encryption using bitlocker/DM-Crypt) is enabled on your VMs."
+                              }
+                            },
+                            "ultraSSDEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The flag that enables or disables a capability to have one or more managed data disks with UltraSSD_LRS storage account type on the VM or VMSS. Managed disks with storage account type UltraSSD_LRS can be added to a virtual machine or virtual machine scale set only if this property is enabled."
+                              }
+                            },
+                            "hibernationEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The flag that enables or disables hibernation capability on the VM."
+                              }
+                            },
+                            "adminUsername": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. Administrator username. Required if no pre-existing OS-Disk is provided (osDisk.managedDisk.resourceId is not empty)."
+                              }
+                            },
+                            "adminPassword": {
+                              "type": "securestring",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. When specifying a Windows Virtual Machine, and no pre-existing OS-Disk is provided (osDisk.managedDisk.resourceId is not empty), this value should be passed."
+                              }
+                            },
+                            "userData": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. UserData for the VM, which must be base-64 encoded. Customer should not pass any secrets in here."
+                              }
+                            },
+                            "customData": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Custom data associated to the VM, this value will be automatically converted into base64 to account for the expected VM format."
+                              }
+                            },
+                            "certificatesToBeInstalled": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/vaultSecretGroupType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies set of certificates that should be installed onto the virtual machine."
+                              }
+                            },
+                            "priority": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Regular",
+                                "Low",
+                                "Spot"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the priority for the virtual machine."
+                              }
+                            },
+                            "evictionPolicy": {
+                              "type": "string",
+                              "defaultValue": "Deallocate",
+                              "allowedValues": [
+                                "Deallocate",
+                                "Delete"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the eviction policy for the low priority virtual machine."
+                              }
+                            },
+                            "maxPriceForLowPriorityVm": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies the maximum price you are willing to pay for a low priority VM/VMSS. This price is in US Dollars."
+                              }
+                            },
+                            "dedicatedHostResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies resource ID about the dedicated host that the virtual machine resides in."
+                              }
+                            },
+                            "licenseType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "RHEL_BYOS",
+                                "SLES_BYOS",
+                                "Windows_Client",
+                                "Windows_Server"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies that the image or disk that is being used was licensed on-premises."
+                              }
+                            },
+                            "publicKeys": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/publicKeyType"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The list of SSH public keys used to authenticate with linux based VMs."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource. The system-assigned managed identity will automatically be enabled if extensionAadJoinConfig.enabled = \"True\"."
+                              }
+                            },
+                            "bootDiagnostics": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Whether boot diagnostics should be enabled on the Virtual Machine. Boot diagnostics will be enabled with a managed storage account if no bootDiagnosticsStorageAccountName value is provided. If bootDiagnostics and bootDiagnosticsStorageAccountName values are not provided, boot diagnostics will be disabled."
+                              }
+                            },
+                            "bootDiagnosticStorageAccountName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Custom storage account used to store boot diagnostic information. Boot diagnostics will be enabled with a custom storage account if a value is provided."
+                              }
+                            },
+                            "bootDiagnosticStorageAccountUri": {
+                              "type": "string",
+                              "defaultValue": "[format('.blob.{0}/', environment().suffixes.storage)]",
+                              "metadata": {
+                                "description": "Optional. Storage account boot diagnostic base URI."
+                              }
+                            },
+                            "proximityPlacementGroupResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of a proximity placement group."
+                              }
+                            },
+                            "virtualMachineScaleSetResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of a virtual machine scale set, where the VM should be added."
+                              }
+                            },
+                            "availabilitySetResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Resource ID of an availability set. Cannot be used in combination with availability zone nor scale set."
+                              }
+                            },
+                            "galleryApplications": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/vmGalleryApplicationType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the gallery applications that should be made available to the VM/VMSS."
+                              }
+                            },
+                            "availabilityZone": {
+                              "type": "int",
+                              "allowedValues": [
+                                -1,
+                                1,
+                                2,
+                                3
+                              ],
+                              "metadata": {
+                                "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                              }
+                            },
+                            "nicConfigurations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/nicConfigurationType"
+                              },
+                              "metadata": {
+                                "description": "Required. Configures NICs and PIPs."
+                              }
+                            },
+                            "backupVaultName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Recovery service vault name to add VMs to backup."
+                              }
+                            },
+                            "backupVaultResourceGroup": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().name]",
+                              "metadata": {
+                                "description": "Optional. Resource group of the backup recovery service vault. If not provided the current resource group name is considered by default."
+                              }
+                            },
+                            "backupPolicyName": {
+                              "type": "string",
+                              "defaultValue": "DefaultPolicy",
+                              "metadata": {
+                                "description": "Optional. Backup policy the VMs should be using for backup. If not provided, it will use the DefaultPolicy from the backup recovery service vault."
+                              }
+                            },
+                            "autoShutdownConfig": {
+                              "$ref": "#/definitions/autoShutDownConfigType",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The configuration for auto-shutdown."
+                              }
+                            },
+                            "maintenanceConfigurationResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The resource Id of a maintenance configuration for this VM."
+                              }
+                            },
+                            "allowExtensionOperations": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Specifies whether extension operations should be allowed on the virtual machine. This may only be set to False when no extensions are present on the virtual machine."
+                              }
+                            },
+                            "extensionDomainJoinPassword": {
+                              "type": "securestring",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Required if name is specified. Password of the user specified in user parameter."
+                              }
+                            },
+                            "extensionDomainJoinConfig": {
+                              "type": "secureObject",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Domain Join] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionAadJoinConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [AAD Join] extension. Must at least contain the [\"enabled\": true] property to be executed. To enroll in Intune, add the setting mdmId: \"0000000a-0000-0000-c000-000000000000\"."
+                              }
+                            },
+                            "extensionAntiMalwareConfig": {
+                              "type": "object",
+                              "defaultValue": "[if(equals(parameters('osType'), 'Windows'), createObject('enabled', true()), createObject('enabled', false()))]",
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Anti Malware] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionMonitoringAgentConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false,
+                                "dataCollectionRuleAssociations": []
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Monitoring Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionDependencyAgentConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Dependency Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionNetworkWatcherAgentConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Network Watcher Agent] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionAzureDiskEncryptionConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Azure Disk Encryption] extension. Must at least contain the [\"enabled\": true] property to be executed. Restrictions: Cannot be enabled on disks that have encryption at host enabled. Managed disks encrypted using Azure Disk Encryption cannot be encrypted using customer-managed keys."
+                              }
+                            },
+                            "extensionDSCConfig": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Desired State Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionCustomScriptConfig": {
+                              "$ref": "#/definitions/extensionCustomScriptConfigType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Custom Script] extension."
+                              }
+                            },
+                            "extensionNvidiaGpuDriverWindows": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Nvidia Gpu Driver Windows] extension. Must at least contain the [\"enabled\": true] property to be executed."
+                              }
+                            },
+                            "extensionHostPoolRegistration": {
+                              "type": "secureObject",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Host Pool Registration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identity."
+                              }
+                            },
+                            "extensionGuestConfigurationExtension": {
+                              "type": "object",
+                              "defaultValue": {
+                                "enabled": false
+                              },
+                              "metadata": {
+                                "description": "Optional. The configuration for the [Guest Configuration] extension. Must at least contain the [\"enabled\": true] property to be executed. Needs a managed identity."
+                              }
+                            },
+                            "guestConfiguration": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. The guest configuration for the virtual machine. Needs the Guest Configuration extension to be enabled."
+                              }
+                            },
+                            "extensionGuestConfigurationExtensionProtectedSettings": {
+                              "type": "secureObject",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. An object that contains the extension specific protected settings."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Compute/virtualMachines@2024-11-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "osType": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Windows",
+                                "Linux"
+                              ],
+                              "metadata": {
+                                "description": "Required. The chosen OS type."
+                              }
+                            },
+                            "disablePasswordAuthentication": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Specifies whether password authentication should be disabled."
+                              }
+                            },
+                            "provisionVMAgent": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Indicates whether virtual machine agent should be provisioned on the virtual machine. When this property is not specified in the request body, default behavior is to set it to true. This will ensure that VM Agent is installed on the VM so that extensions can be added to the VM later."
+                              }
+                            },
+                            "enableAutomaticUpdates": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Indicates whether Automatic Updates is enabled for the Windows virtual machine. Default value is true. When patchMode is set to Manual, this parameter must be set to false. For virtual machine scale sets, this property can be updated and updates will take effect on OS reprovisioning."
+                              }
+                            },
+                            "patchMode": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "AutomaticByPlatform",
+                                "AutomaticByOS",
+                                "Manual",
+                                "ImageDefault",
+                                ""
+                              ],
+                              "metadata": {
+                                "description": "Optional. VM guest patching orchestration mode. 'AutomaticByOS' & 'Manual' are for Windows only, 'ImageDefault' for Linux only. Refer to 'https://learn.microsoft.com/en-us/azure/virtual-machines/automatic-vm-guest-patching'."
+                              }
+                            },
+                            "bypassPlatformSafetyChecksOnUserSchedule": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enables customer to schedule patching without accidental upgrades."
+                              }
+                            },
+                            "rebootSetting": {
+                              "type": "string",
+                              "defaultValue": "IfRequired",
+                              "allowedValues": [
+                                "Always",
+                                "IfRequired",
+                                "Never",
+                                "Unknown"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the reboot setting for all AutomaticByPlatform patch installation operations."
+                              }
+                            },
+                            "patchAssessmentMode": {
+                              "type": "string",
+                              "defaultValue": "ImageDefault",
+                              "allowedValues": [
+                                "AutomaticByPlatform",
+                                "ImageDefault"
+                              ],
+                              "metadata": {
+                                "description": "Optional. VM guest patching assessment mode. Set it to 'AutomaticByPlatform' to enable automatically check for updates every 24 hours."
+                              }
+                            },
+                            "enableHotpatching": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enables customers to patch their Azure VMs without requiring a reboot. For enableHotpatching, the 'provisionVMAgent' must be set to true and 'patchMode' must be set to 'AutomaticByPlatform'."
+                              }
+                            },
+                            "timeZone": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Specifies the time zone of the virtual machine. e.g. 'Pacific Standard Time'. Possible values can be `TimeZoneInfo.id` value from time zones returned by `TimeZoneInfo.GetSystemTimeZones`."
+                              }
+                            },
+                            "additionalUnattendContent": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/additionalUnattendContentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies additional XML formatted information that can be included in the Unattend.xml file, which is used by Windows Setup. Contents are defined by setting name, component name, and the pass in which the content is applied."
+                              }
+                            },
+                            "winRMListeners": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/winRMListenerType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the Windows Remote Management listeners. This enables remote Windows PowerShell."
+                              }
+                            },
+                            "configurationProfile": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The configuration profile of automanage. Either '/providers/Microsoft.Automanage/bestPractices/AzureBestPracticesProduction', 'providers/Microsoft.Automanage/bestPractices/AzureBestPracticesDevTest' or the resource Id of custom profile."
+                              }
+                            },
+                            "capacityReservationGroupResourceId": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Capacity reservation group resource id that should be used for allocating the virtual machine vm instances provided enough capacity has been reserved."
+                              }
+                            },
+                            "networkAccessPolicy": {
+                              "type": "string",
+                              "defaultValue": "DenyAll",
+                              "allowedValues": [
+                                "AllowAll",
+                                "AllowPrivate",
+                                "DenyAll"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Policy for accessing the disk via network."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "defaultValue": "Disabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Policy for controlling export on the disk."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "publicKeysFormatted",
+                                "count": "[length(parameters('publicKeys'))]",
+                                "input": {
+                                  "path": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].path]",
+                                  "keyData": "[parameters('publicKeys')[copyIndex('publicKeysFormatted')].keyData]"
+                                }
+                              },
+                              {
+                                "name": "additionalUnattendContentFormatted",
+                                "count": "[length(coalesce(parameters('additionalUnattendContent'), createArray()))]",
+                                "input": {
+                                  "settingName": "[coalesce(parameters('additionalUnattendContent'), createArray())[copyIndex('additionalUnattendContentFormatted')].settingName]",
+                                  "content": "[coalesce(parameters('additionalUnattendContent'), createArray())[copyIndex('additionalUnattendContentFormatted')].content]",
+                                  "componentName": "Microsoft-Windows-Shell-Setup",
+                                  "passName": "OobeSystem"
+                                }
+                              },
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "linuxConfiguration": {
+                              "disablePasswordAuthentication": "[parameters('disablePasswordAuthentication')]",
+                              "ssh": {
+                                "publicKeys": "[variables('publicKeysFormatted')]"
+                              },
+                              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+                              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('ImageDefault')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]"
+                            },
+                            "windowsConfiguration": {
+                              "provisionVMAgent": "[parameters('provisionVMAgent')]",
+                              "enableAutomaticUpdates": "[parameters('enableAutomaticUpdates')]",
+                              "patchSettings": "[if(and(parameters('provisionVMAgent'), or(or(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), equals(toLower(parameters('patchMode')), toLower('AutomaticByOS'))), equals(toLower(parameters('patchMode')), toLower('Manual')))), createObject('patchMode', parameters('patchMode'), 'assessmentMode', parameters('patchAssessmentMode'), 'enableHotpatching', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), parameters('enableHotpatching'), false()), 'automaticByPlatformSettings', if(equals(toLower(parameters('patchMode')), toLower('AutomaticByPlatform')), createObject('bypassPlatformSafetyChecksOnUserSchedule', parameters('bypassPlatformSafetyChecksOnUserSchedule'), 'rebootSetting', parameters('rebootSetting')), null())), null())]",
+                              "timeZone": "[if(empty(parameters('timeZone')), null(), parameters('timeZone'))]",
+                              "additionalUnattendContent": "[if(empty(parameters('additionalUnattendContent')), null(), variables('additionalUnattendContentFormatted'))]",
+                              "winRM": "[if(not(empty(parameters('winRMListeners'))), createObject('listeners', parameters('winRMListeners')), null())]"
+                            },
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(if(parameters('extensionAadJoinConfig').enabled, true(), coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false())), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Data Operator for Managed Disks": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '959f8984-c045-4866-89c7-12bf9737be2e')]",
+                              "Desktop Virtualization Power On Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '489581de-a3bd-480d-9518-53dea7416b33')]",
+                              "Desktop Virtualization Power On Off Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '40c5ff49-9181-41f8-ae61-143b0e78555e')]",
+                              "Desktop Virtualization Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a959dbd1-f747-45e3-8ba6-dd80f235f97c')]",
+                              "DevTest Labs User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76283e04-6283-4c54-8f91-bcf1374a3c64')]",
+                              "Disk Backup Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3e5e47e6-65f7-47ef-90b5-e5dd4d455f24')]",
+                              "Disk Pool Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '60fc6e62-5479-42d4-8bf4-67625fcc2840')]",
+                              "Disk Restore Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b50d9833-a0cb-478e-945f-707fcc997c13')]",
+                              "Disk Snapshot Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7efff54f-a5b4-42b5-a1c5-5411624893ce')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                              "Virtual Machine Administrator Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1c0163c0-47e6-4577-8991-ea5c82e286e4')]",
+                              "Virtual Machine Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9980e02c-c2be-4d73-94e8-173b1dc7cf3c')]",
+                              "Virtual Machine User Login": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb879df8-f326-4884-b1cf-06f3ad86be52')]",
+                              "VM Scanner Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'd24ecba3-c1f4-40fa-a7bb-4588a071e8fd')]"
+                            },
+                            "aadJoinSettings": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'settings'), createObject())]",
+                            "filteredAadJoinSettings": "[if(and(contains(variables('aadJoinSettings'), 'mdmId'), empty(variables('aadJoinSettings').mdmId)), reduce(items(variables('aadJoinSettings')), createObject(), lambda('cur', 'item', if(equals(lambdaVariables('item').key, 'mdmId'), lambdaVariables('cur'), union(lambdaVariables('cur'), createObject(format('{0}', lambdaVariables('item').key), lambdaVariables('item').value))))), variables('aadJoinSettings'))]"
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-07-01",
+                              "name": "[format('46d3xbcp.res.compute-virtualmachine.{0}.{1}', replace('0.22.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "managedDataDisks": {
+                              "copy": {
+                                "name": "managedDataDisks",
+                                "count": "[length(coalesce(parameters('dataDisks'), createArray()))]"
+                              },
+                              "condition": "[and(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk, 'resourceId')), not(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'createOption'), 'Empty'), 'FromImage')))]",
+                              "type": "Microsoft.Compute/disks",
+                              "apiVersion": "2025-01-02",
+                              "name": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex(), 1), 2, '0')))]",
+                              "location": "[parameters('location')]",
+                              "sku": {
+                                "name": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk, 'storageAccountType')]"
+                              },
+                              "properties": {
+                                "diskSizeGB": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskSizeGB')]",
+                                "creationData": {
+                                  "createOption": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'createOption'), 'Empty')]"
+                                },
+                                "diskIOPSReadWrite": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskIOPSReadWrite')]",
+                                "diskMBpsReadWrite": "[tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'diskMBpsReadWrite')]",
+                                "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                                "networkAccessPolicy": "[parameters('networkAccessPolicy')]"
+                              },
+                              "zones": "[if(and(not(equals(parameters('availabilityZone'), -1)), not(contains(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()].managedDisk, 'storageAccountType'), ''), 'ZRS'))), array(string(parameters('availabilityZone'))), null())]",
+                              "tags": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                            },
+                            "vm": {
+                              "type": "Microsoft.Compute/virtualMachines",
+                              "apiVersion": "2024-07-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "identity": "[variables('identity')]",
+                              "tags": "[parameters('tags')]",
+                              "zones": "[if(not(equals(parameters('availabilityZone'), -1)), array(string(parameters('availabilityZone'))), null())]",
+                              "plan": "[parameters('plan')]",
+                              "properties": {
+                                "hardwareProfile": {
+                                  "vmSize": "[parameters('vmSize')]"
+                                },
+                                "securityProfile": "[shallowMerge(createArray(if(parameters('encryptionAtHost'), createObject('encryptionAtHost', parameters('encryptionAtHost')), createObject()), createObject('securityType', parameters('securityType'), 'uefiSettings', if(equals(parameters('securityType'), 'TrustedLaunch'), createObject('secureBootEnabled', parameters('secureBootEnabled'), 'vTpmEnabled', parameters('vTpmEnabled')), null()))))]",
+                                "storageProfile": {
+                                  "copy": [
+                                    {
+                                      "name": "dataDisks",
+                                      "count": "[length(coalesce(parameters('dataDisks'), createArray()))]",
+                                      "input": {
+                                        "lun": "[coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'lun'), copyIndex('dataDisks'))]",
+                                        "name": "[if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId'))), last(split(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.resourceId, '/')), coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0'))))]",
+                                        "createOption": "[if(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'), 'FromImage', if(or(not(equals(if(and(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId')), not(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'))), resourceId('Microsoft.Compute/disks', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))), null()), null())), not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId')))), 'Attach', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty')))]",
+                                        "deleteOption": "[if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId'))), 'Detach', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'deleteOption'), 'Delete'))]",
+                                        "caching": "[if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId'))), 'None', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'caching'), 'ReadOnly'))]",
+                                        "diskSizeGB": "[if(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'), null(), tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'diskSizeGB'))]",
+                                        "managedDisk": "[if(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'), createObject('storageAccountType', tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'storageAccountType'), 'diskEncryptionSet', if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'diskEncryptionSetResourceId'))), createObject('id', coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.diskEncryptionSetResourceId), null())), createObject('id', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId'), if(and(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'resourceId')), not(equals(coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'createOption'), 'Empty'), 'FromImage'))), resourceId('Microsoft.Compute/disks', coalesce(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')], 'name'), format('{0}-disk-data-{1}', parameters('name'), padLeft(add(copyIndex('dataDisks'), 1), 2, '0')))), null())), 'diskEncryptionSet', if(not(empty(tryGet(coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk, 'diskEncryptionSetResourceId'))), createObject('id', coalesce(parameters('dataDisks'), createArray())[copyIndex('dataDisks')].managedDisk.diskEncryptionSetResourceId), null())))]"
+                                      }
+                                    }
+                                  ],
+                                  "imageReference": "[parameters('imageReference')]",
+                                  "osDisk": {
+                                    "name": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId'))), last(split(parameters('osDisk').managedDisk.resourceId, '/')), coalesce(tryGet(parameters('osDisk'), 'name'), format('{0}-disk-os-01', parameters('name'))))]",
+                                    "createOption": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId'))), 'Attach', coalesce(tryGet(parameters('osDisk'), 'createOption'), 'FromImage'))]",
+                                    "osType": "[parameters('osType')]",
+                                    "deleteOption": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId'))), 'Detach', coalesce(tryGet(parameters('osDisk'), 'deleteOption'), 'Delete'))]",
+                                    "diffDiskSettings": "[if(empty(coalesce(tryGet(parameters('osDisk'), 'diffDiskSettings'), createObject())), null(), createObject('option', 'Local', 'placement', parameters('osDisk').diffDiskSettings.placement))]",
+                                    "diskSizeGB": "[tryGet(parameters('osDisk'), 'diskSizeGB')]",
+                                    "caching": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId'))), 'None', coalesce(tryGet(parameters('osDisk'), 'caching'), 'ReadOnly'))]",
+                                    "managedDisk": {
+                                      "storageAccountType": "[tryGet(parameters('osDisk').managedDisk, 'storageAccountType')]",
+                                      "diskEncryptionSet": "[if(not(empty(tryGet(parameters('osDisk').managedDisk, 'diskEncryptionSetResourceId'))), createObject('id', tryGet(parameters('osDisk').managedDisk, 'diskEncryptionSetResourceId')), null())]",
+                                      "id": "[tryGet(parameters('osDisk').managedDisk, 'resourceId')]"
+                                    }
+                                  }
+                                },
+                                "additionalCapabilities": {
+                                  "ultraSSDEnabled": "[parameters('ultraSSDEnabled')]",
+                                  "hibernationEnabled": "[parameters('hibernationEnabled')]"
+                                },
+                                "osProfile": "[if(empty(tryGet(parameters('osDisk').managedDisk, 'resourceId')), createObject('computerName', parameters('computerName'), 'adminUsername', parameters('adminUsername'), 'adminPassword', parameters('adminPassword'), 'customData', if(not(empty(parameters('customData'))), base64(parameters('customData')), null()), 'windowsConfiguration', if(equals(parameters('osType'), 'Windows'), variables('windowsConfiguration'), null()), 'linuxConfiguration', if(equals(parameters('osType'), 'Linux'), variables('linuxConfiguration'), null()), 'secrets', parameters('certificatesToBeInstalled'), 'allowExtensionOperations', parameters('allowExtensionOperations')), null())]",
+                                "networkProfile": {
+                                  "copy": [
+                                    {
+                                      "name": "networkInterfaces",
+                                      "count": "[length(parameters('nicConfigurations'))]",
+                                      "input": {
+                                        "properties": {
+                                          "deleteOption": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'deleteOption'), 'Delete')]",
+                                          "primary": "[if(equals(copyIndex('networkInterfaces'), 0), true(), false())]"
+                                        },
+                                        "id": "[resourceId('Microsoft.Network/networkInterfaces', coalesce(tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'name'), format('{0}{1}', parameters('name'), tryGet(parameters('nicConfigurations')[copyIndex('networkInterfaces')], 'nicSuffix'))))]"
+                                      }
+                                    }
+                                  ]
+                                },
+                                "capacityReservation": "[if(not(empty(parameters('capacityReservationGroupResourceId'))), createObject('capacityReservationGroup', createObject('id', parameters('capacityReservationGroupResourceId'))), null())]",
+                                "diagnosticsProfile": {
+                                  "bootDiagnostics": {
+                                    "enabled": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), true(), parameters('bootDiagnostics'))]",
+                                    "storageUri": "[if(not(empty(parameters('bootDiagnosticStorageAccountName'))), format('https://{0}{1}', parameters('bootDiagnosticStorageAccountName'), parameters('bootDiagnosticStorageAccountUri')), null())]"
+                                  }
+                                },
+                                "applicationProfile": "[if(not(empty(parameters('galleryApplications'))), createObject('galleryApplications', parameters('galleryApplications')), null())]",
+                                "availabilitySet": "[if(not(empty(parameters('availabilitySetResourceId'))), createObject('id', parameters('availabilitySetResourceId')), null())]",
+                                "proximityPlacementGroup": "[if(not(empty(parameters('proximityPlacementGroupResourceId'))), createObject('id', parameters('proximityPlacementGroupResourceId')), null())]",
+                                "virtualMachineScaleSet": "[if(not(empty(parameters('virtualMachineScaleSetResourceId'))), createObject('id', parameters('virtualMachineScaleSetResourceId')), null())]",
+                                "priority": "[parameters('priority')]",
+                                "evictionPolicy": "[if(and(not(empty(parameters('priority'))), not(equals(parameters('priority'), 'Regular'))), parameters('evictionPolicy'), null())]",
+                                "billingProfile": "[if(and(not(empty(parameters('priority'))), not(empty(parameters('maxPriceForLowPriorityVm')))), createObject('maxPrice', json(parameters('maxPriceForLowPriorityVm'))), null())]",
+                                "host": "[if(not(empty(parameters('dedicatedHostResourceId'))), createObject('id', parameters('dedicatedHostResourceId')), null())]",
+                                "licenseType": "[parameters('licenseType')]",
+                                "userData": "[if(not(empty(parameters('userData'))), base64(parameters('userData')), null())]"
+                              },
+                              "dependsOn": [
+                                "managedDataDisks",
+                                "vm_nic"
+                              ]
+                            },
+                            "vm_configurationAssignment": {
+                              "condition": "[not(empty(parameters('maintenanceConfigurationResourceId')))]",
+                              "type": "Microsoft.Maintenance/configurationAssignments",
+                              "apiVersion": "2023-04-01",
+                              "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                              "name": "[format('{0}assignment', parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "maintenanceConfigurationId": "[parameters('maintenanceConfigurationResourceId')]",
+                                "resourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_configurationProfileAssignment": {
+                              "condition": "[not(empty(parameters('configurationProfile')))]",
+                              "type": "Microsoft.Automanage/configurationProfileAssignments",
+                              "apiVersion": "2022-05-04",
+                              "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                              "name": "default",
+                              "properties": {
+                                "configurationProfile": "[parameters('configurationProfile')]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_autoShutdownConfiguration": {
+                              "condition": "[not(empty(parameters('autoShutdownConfig')))]",
+                              "type": "Microsoft.DevTestLab/schedules",
+                              "apiVersion": "2018-09-15",
+                              "name": "[format('shutdown-computevm-{0}', parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'tags'), parameters('tags'))]",
+                              "properties": {
+                                "status": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'status'), 'Disabled')]",
+                                "targetResourceId": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                                "taskType": "ComputeVmShutdownTask",
+                                "dailyRecurrence": {
+                                  "time": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'dailyRecurrenceTime'), '19:00')]"
+                                },
+                                "timeZoneId": "[coalesce(tryGet(parameters('autoShutdownConfig'), 'timeZone'), 'UTC')]",
+                                "notificationSettings": "[if(contains(parameters('autoShutdownConfig'), 'notificationSettings'), createObject('status', coalesce(tryGet(parameters('autoShutdownConfig'), 'status'), 'Disabled'), 'emailRecipient', coalesce(tryGet(tryGet(parameters('autoShutdownConfig'), 'notificationSettings'), 'emailRecipient'), ''), 'notificationLocale', coalesce(tryGet(tryGet(parameters('autoShutdownConfig'), 'notificationSettings'), 'notificationLocale'), 'en'), 'webhookUrl', coalesce(tryGet(tryGet(parameters('autoShutdownConfig'), 'notificationSettings'), 'webhookUrl'), ''), 'timeInMinutes', coalesce(tryGet(tryGet(parameters('autoShutdownConfig'), 'notificationSettings'), 'timeInMinutes'), 30)), null())]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_dataCollectionRuleAssociations": {
+                              "copy": {
+                                "name": "vm_dataCollectionRuleAssociations",
+                                "count": "[length(parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations)]"
+                              },
+                              "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+                              "type": "Microsoft.Insights/dataCollectionRuleAssociations",
+                              "apiVersion": "2024-03-11",
+                              "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                              "name": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].name]",
+                              "properties": {
+                                "dataCollectionRuleId": "[parameters('extensionMonitoringAgentConfig').dataCollectionRuleAssociations[copyIndex()].dataCollectionRuleResourceId]"
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureMonitorAgentExtension"
+                              ]
+                            },
+                            "cseIdentity": {
+                              "condition": "[not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'managedIdentityResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                              "apiVersion": "2024-11-30",
+                              "subscriptionId": "[split(parameters('extensionCustomScriptConfig').protectedSettings.managedIdentityResourceId, '/')[2]]",
+                              "resourceGroup": "[split(parameters('extensionCustomScriptConfig').protectedSettings.managedIdentityResourceId, '/')[4]]",
+                              "name": "[last(split(parameters('extensionCustomScriptConfig').protectedSettings.managedIdentityResourceId, '/'))]"
+                            },
+                            "AzureWindowsBaseline": {
+                              "condition": "[not(empty(parameters('guestConfiguration')))]",
+                              "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
+                              "apiVersion": "2024-04-05",
+                              "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('guestConfiguration'), 'name'), 'AzureWindowsBaseline')]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "guestConfiguration": "[parameters('guestConfiguration')]"
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureGuestConfigurationExtension"
+                              ]
+                            },
+                            "vm_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_roleAssignments": {
+                              "copy": {
+                                "name": "vm_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Compute/virtualMachines', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_nic": {
+                              "copy": {
+                                "name": "vm_nic",
+                                "count": "[length(parameters('nicConfigurations'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-Nic-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "networkInterfaceName": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'name'), format('{0}{1}', parameters('name'), tryGet(parameters('nicConfigurations')[copyIndex()], 'nicSuffix')))]"
+                                  },
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "enableIPForwarding": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableIPForwarding'), false())]"
+                                  },
+                                  "enableAcceleratedNetworking": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'enableAcceleratedNetworking'), true())]"
+                                  },
+                                  "dnsServers": "[if(contains(parameters('nicConfigurations')[copyIndex()], 'dnsServers'), if(not(empty(tryGet(parameters('nicConfigurations')[copyIndex()], 'dnsServers'))), createObject('value', tryGet(parameters('nicConfigurations')[copyIndex()], 'dnsServers')), createObject('value', createArray())), createObject('value', createArray()))]",
+                                  "networkSecurityGroupResourceId": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'networkSecurityGroupResourceId'), '')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[parameters('nicConfigurations')[copyIndex()].ipConfigurations]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('nicConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'diagnosticSettings')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(parameters('nicConfigurations')[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "5982155361487304817"
+                                    }
+                                  },
+                                  "definitions": {
+                                    "publicIPConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Public IP Address."
+                                          }
+                                        },
+                                        "publicIPAddressResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the public IP address."
+                                          }
+                                        },
+                                        "diagnosticSettings": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/diagnosticSettingFullType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Diagnostic settings for the public IP address."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The idle timeout in minutes."
+                                          }
+                                        },
+                                        "lock": {
+                                          "$ref": "#/definitions/lockType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The lock settings of the public IP address."
+                                          }
+                                        },
+                                        "idleTimeoutInMinutes": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The idle timeout of the public IP address."
+                                          }
+                                        },
+                                        "ddosSettings": {
+                                          "$ref": "#/definitions/ddosSettingsType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                                          }
+                                        },
+                                        "dnsSettings": {
+                                          "$ref": "#/definitions/dnsSettingsType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The DNS settings of the public IP address."
+                                          }
+                                        },
+                                        "publicIPAddressVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "IPv4",
+                                            "IPv6"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The public IP address version."
+                                          }
+                                        },
+                                        "publicIPAllocationMethod": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Dynamic",
+                                            "Static"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The public IP address allocation method."
+                                          }
+                                        },
+                                        "publicIpPrefixResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                                          }
+                                        },
+                                        "publicIpNameSuffix": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name suffix of the public IP address resource."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        },
+                                        "skuName": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Basic",
+                                            "Standard"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The SKU name of the public IP address."
+                                          }
+                                        },
+                                        "skuTier": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Global",
+                                            "Regional"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The SKU tier of the public IP address."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Network/publicIPAddresses@2024-07-01#properties/tags"
+                                            },
+                                            "description": "Optional. The tags of the public IP address."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "availabilityZones": {
+                                          "type": "array",
+                                          "allowedValues": [
+                                            1,
+                                            2,
+                                            3
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The zones of the public IP address."
+                                          }
+                                        },
+                                        "ipTags": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/ipTagType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The list of tags associated with the public IP address."
+                                          }
+                                        },
+                                        "enableTelemetry": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable/Disable usage telemetry for the module."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the public IP address configuration."
+                                      }
+                                    },
+                                    "ipConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the IP configuration."
+                                          }
+                                        },
+                                        "privateIPAllocationMethod": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Dynamic",
+                                            "Static"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private IP address allocation method."
+                                          }
+                                        },
+                                        "privateIPAddress": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private IP address."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource ID of the subnet."
+                                          }
+                                        },
+                                        "loadBalancerBackendAddressPools": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/backendAddressPoolType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The load balancer backend address pools."
+                                          }
+                                        },
+                                        "applicationSecurityGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/applicationSecurityGroupType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The application security groups."
+                                          }
+                                        },
+                                        "applicationGatewayBackendAddressPools": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/applicationGatewayBackendAddressPoolsType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The application gateway backend address pools."
+                                          }
+                                        },
+                                        "gatewayLoadBalancer": {
+                                          "$ref": "#/definitions/subResourceType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The gateway load balancer settings."
+                                          }
+                                        },
+                                        "loadBalancerInboundNatRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/inboundNatRuleType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The load balancer inbound NAT rules."
+                                          }
+                                        },
+                                        "privateIPAddressVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "IPv4",
+                                            "IPv6"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private IP address version."
+                                          }
+                                        },
+                                        "virtualNetworkTaps": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/virtualNetworkTapType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The virtual network taps."
+                                          }
+                                        },
+                                        "pipConfiguration": {
+                                          "$ref": "#/definitions/publicIPConfigurationType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The public IP address configuration."
+                                          }
+                                        },
+                                        "diagnosticSettings": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/diagnosticSettingFullType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The diagnostic settings of the IP configuration."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Network/networkInterfaces@2024-07-01#properties/tags"
+                                            },
+                                            "description": "Optional. The tags of the public IP address."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "enableTelemetry": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable/Disable usage telemetry for the module."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the IP configuration."
+                                      }
+                                    },
+                                    "applicationGatewayBackendAddressPoolsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the backend address pool."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the backend address pool that is unique within an Application Gateway."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "backendAddresses": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "ipAddress": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. IP address of the backend address."
+                                                    }
+                                                  },
+                                                  "fqdn": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. FQDN of the backend address."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Backend addresses."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Properties of the application gateway backend address pool."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for the application gateway backend address pool.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "applicationSecurityGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the application security group."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Location of the application security group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Properties of the application security group."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Tags of the application security group."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for the application security group.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "backendAddressPoolType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the backend address pool."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the backend address pool."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The properties of the backend address pool."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for a backend address pool.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "ddosSettingsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ddosProtectionPlan": {
+                                          "type": "object",
+                                          "properties": {
+                                            "id": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The resource ID of the DDOS protection plan associated with the public IP address."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The DDoS protection plan associated with the public IP address."
+                                          }
+                                        },
+                                        "protectionMode": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Enabled"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The DDoS protection policy customizations."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "dnsSettingsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "domainNameLabel": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The domain name label. The concatenation of the domain name label and the regionalized DNS zone make up the fully qualified domain name associated with the public IP address. If a domain name label is specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system."
+                                          }
+                                        },
+                                        "domainNameLabelScope": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "NoReuse",
+                                            "ResourceGroupReuse",
+                                            "SubscriptionReuse",
+                                            "TenantReuse"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The domain name label scope. If a domain name label and a domain name label scope are specified, an A DNS record is created for the public IP in the Microsoft Azure DNS system with a hashed value includes in FQDN."
+                                          }
+                                        },
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Fully Qualified Domain Name of the A DNS record associated with the public IP. This is the concatenation of the domainNameLabel and the regionalized DNS zone."
+                                          }
+                                        },
+                                        "reverseFqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The reverse FQDN. A user-visible, fully qualified domain name that resolves to this public IP address. If the reverseFqdn is specified, then a PTR DNS record is created pointing from the IP address in the in-addr.arpa domain to the reverse FQDN."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                                        }
+                                      }
+                                    },
+                                    "inboundNatRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the inbound NAT rule."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the resource that is unique within the set of inbound NAT rules used by the load balancer. This name can be used to access the resource."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "backendAddressPool": {
+                                              "$ref": "#/definitions/subResourceType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A reference to backendAddressPool resource."
+                                              }
+                                            },
+                                            "backendPort": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The port used for the internal endpoint. Acceptable values range from 1 to 65535."
+                                              }
+                                            },
+                                            "enableFloatingIP": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Configures a virtual machine's endpoint for the floating IP capability required to configure a SQL AlwaysOn Availability Group. This setting is required when using the SQL AlwaysOn Availability Groups in SQL server. This setting can't be changed after you create the endpoint."
+                                              }
+                                            },
+                                            "enableTcpReset": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Receive bidirectional TCP Reset on TCP flow idle timeout or unexpected connection termination. This element is only used when the protocol is set to TCP."
+                                              }
+                                            },
+                                            "frontendIPConfiguration": {
+                                              "$ref": "#/definitions/subResourceType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A reference to frontend IP addresses."
+                                              }
+                                            },
+                                            "frontendPort": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The port for the external endpoint. Port numbers for each rule must be unique within the Load Balancer. Acceptable values range from 1 to 65534."
+                                              }
+                                            },
+                                            "frontendPortRangeStart": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The port range start for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeEnd. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                              }
+                                            },
+                                            "frontendPortRangeEnd": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The port range end for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeStart. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                              }
+                                            },
+                                            "protocol": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "All",
+                                                "Tcp",
+                                                "Udp"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The reference to the transport protocol used by the load balancing rule."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Properties of the inbound NAT rule."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for the inbound NAT rule.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "ipTagType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ipTagType": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The IP tag type."
+                                          }
+                                        },
+                                        "tag": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The IP tag."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/public-ip-address:0.8.0"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "networkInterfaceIPConfigurationOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the IP configuration."
+                                          }
+                                        },
+                                        "privateIP": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The private IP address."
+                                          }
+                                        },
+                                        "publicIP": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The public IP address."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "subResourceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the sub resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for the sub resource.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "virtualNetworkTapType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the virtual network tap."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Location of the virtual network tap."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Properties of the virtual network tap."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Tags of the virtual network tap."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for the virtual network tap.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/network/network-interface:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "networkInterfaceName": {
+                                      "type": "string"
+                                    },
+                                    "virtualMachineName": {
+                                      "type": "string"
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/ipConfigurationType"
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    },
+                                    "enableIPForwarding": {
+                                      "type": "bool",
+                                      "defaultValue": false
+                                    },
+                                    "enableAcceleratedNetworking": {
+                                      "type": "bool",
+                                      "defaultValue": false
+                                    },
+                                    "dnsServers": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "defaultValue": []
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Enable telemetry via a Globally Unique Identifier (GUID)."
+                                      }
+                                    },
+                                    "networkSecurityGroupResourceId": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The network security group (NSG) to attach to the network interface."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "networkInterface_publicIPAddresses": {
+                                      "copy": {
+                                        "name": "networkInterface_publicIPAddresses",
+                                        "count": "[length(parameters('ipConfigurations'))]"
+                                      },
+                                      "condition": "[and(not(empty(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'))), empty(tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIPAddressResourceId')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-publicIP-{1}', deployment().name, copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'name'), format('{0}{1}', parameters('virtualMachineName'), tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIpNameSuffix')))]"
+                                          },
+                                          "diagnosticSettings": {
+                                            "value": "[coalesce(tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'diagnosticSettings'), tryGet(parameters('ipConfigurations')[copyIndex()], 'diagnosticSettings'))]"
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "lock": {
+                                            "value": "[parameters('lock')]"
+                                          },
+                                          "idleTimeoutInMinutes": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'idleTimeoutInMinutes')]"
+                                          },
+                                          "ddosSettings": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'ddosSettings')]"
+                                          },
+                                          "dnsSettings": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'dnsSettings')]"
+                                          },
+                                          "publicIPAddressVersion": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIPAddressVersion')]"
+                                          },
+                                          "publicIPAllocationMethod": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIPAllocationMethod')]"
+                                          },
+                                          "publicIpPrefixResourceId": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'publicIpPrefixResourceId')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'roleAssignments')]"
+                                          },
+                                          "skuName": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'skuName')]"
+                                          },
+                                          "skuTier": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'skuTier')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "availabilityZones": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'availabilityZones')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[coalesce(coalesce(tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'enableTelemetry'), tryGet(parameters('ipConfigurations')[copyIndex()], 'enableTelemetry')), parameters('enableTelemetry'))]"
+                                          },
+                                          "ipTags": {
+                                            "value": "[tryGet(tryGet(parameters('ipConfigurations')[copyIndex()], 'pipConfiguration'), 'ipTags')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.39.26.7824",
+                                              "templateHash": "5349747633189946992"
+                                            },
+                                            "name": "Public IP Addresses",
+                                            "description": "This module deploys a Public IP Address."
+                                          },
+                                          "definitions": {
+                                            "diagnosticSettingFullType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the diagnostic setting."
+                                                  }
+                                                },
+                                                "logCategoriesAndGroups": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                        }
+                                                      },
+                                                      "categoryGroup": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                  }
+                                                },
+                                                "metricCategories": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                  }
+                                                },
+                                                "logAnalyticsDestinationType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "AzureDiagnostics",
+                                                    "Dedicated"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                  }
+                                                },
+                                                "workspaceResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "storageAccountResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "eventHubAuthorizationRuleResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                  }
+                                                },
+                                                "eventHubName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "marketplacePartnerResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                },
+                                                "notes": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the notes of the lock."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a lock.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the Public IP Address."
+                                              }
+                                            },
+                                            "publicIpPrefixResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Resource ID of the Public IP Prefix object. This is only needed if you want your Public IPs created in a PIP Prefix."
+                                              }
+                                            },
+                                            "publicIPAllocationMethod": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/publicIPAllocationMethod"
+                                                },
+                                                "description": "Optional. The public IP address allocation method."
+                                              },
+                                              "defaultValue": "Static"
+                                            },
+                                            "availabilityZones": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "int"
+                                              },
+                                              "defaultValue": [
+                                                1,
+                                                2,
+                                                3
+                                              ],
+                                              "allowedValues": [
+                                                1,
+                                                2,
+                                                3
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. A list of availability zones denoting the IP allocated for the resource needs to come from."
+                                              }
+                                            },
+                                            "publicIPAddressVersion": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/publicIPAddressVersion"
+                                                },
+                                                "description": "Optional. IP address version."
+                                              },
+                                              "defaultValue": "IPv4"
+                                            },
+                                            "dnsSettings": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/dnsSettings"
+                                                },
+                                                "description": "Optional. The DNS settings of the public IP address."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "ipTags": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/ipTags"
+                                                },
+                                                "description": "Optional. The list of tags associated with the public IP address."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "skuName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/sku/properties/name"
+                                                },
+                                                "description": "Optional. Name of a public IP address SKU."
+                                              },
+                                              "defaultValue": "Standard"
+                                            },
+                                            "skuTier": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/sku/properties/tier"
+                                                },
+                                                "description": "Optional. Tier of a public IP address SKU."
+                                              },
+                                              "defaultValue": "Regional"
+                                            },
+                                            "ddosSettings": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/ddosSettings"
+                                                },
+                                                "description": "Optional. The DDoS protection plan configuration associated with the public IP address."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "deleteOption": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/properties/properties/deleteOption"
+                                                },
+                                                "description": "Optional. The delete option for the public IP address."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all resources."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            },
+                                            "idleTimeoutInMinutes": {
+                                              "type": "int",
+                                              "defaultValue": 4,
+                                              "metadata": {
+                                                "description": "Optional. The idle timeout of the public IP address."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/publicIPAddresses@2025-01-01#properties/tags"
+                                                },
+                                                "description": "Optional. Tags of the resource."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "diagnosticSettings": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/diagnosticSettingFullType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.network-publicipaddress.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "publicIpAddress": {
+                                              "type": "Microsoft.Network/publicIPAddresses",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "sku": {
+                                                "name": "[parameters('skuName')]",
+                                                "tier": "[parameters('skuTier')]"
+                                              },
+                                              "zones": "[map(parameters('availabilityZones'), lambda('zone', string(lambdaVariables('zone'))))]",
+                                              "properties": {
+                                                "ddosSettings": "[parameters('ddosSettings')]",
+                                                "dnsSettings": "[parameters('dnsSettings')]",
+                                                "publicIPAddressVersion": "[parameters('publicIPAddressVersion')]",
+                                                "publicIPAllocationMethod": "[parameters('publicIPAllocationMethod')]",
+                                                "publicIPPrefix": "[if(not(empty(parameters('publicIpPrefixResourceId'))), createObject('id', parameters('publicIpPrefixResourceId')), null())]",
+                                                "idleTimeoutInMinutes": "[parameters('idleTimeoutInMinutes')]",
+                                                "ipTags": "[parameters('ipTags')]",
+                                                "deleteOption": "[parameters('deleteOption')]"
+                                              }
+                                            },
+                                            "publicIpAddress_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                              },
+                                              "dependsOn": [
+                                                "publicIpAddress"
+                                              ]
+                                            },
+                                            "publicIpAddress_roleAssignments": {
+                                              "copy": {
+                                                "name": "publicIpAddress_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/publicIPAddresses', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "publicIpAddress"
+                                              ]
+                                            },
+                                            "publicIpAddress_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "publicIpAddress_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  },
+                                                  {
+                                                    "name": "logs",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                                    "input": {
+                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "publicIpAddress"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the public IP address was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the public IP address."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the public IP address."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
+                                            },
+                                            "ipAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The public IP address of the public IP address resource."
+                                              },
+                                              "value": "[coalesce(tryGet(reference('publicIpAddress'), 'ipAddress'), '')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('publicIpAddress', '2025-01-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "networkInterface": {
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-NetworkInterface', deployment().name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[parameters('networkInterfaceName')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "copy": [
+                                              {
+                                                "name": "value",
+                                                "count": "[length(parameters('ipConfigurations'))]",
+                                                "input": "[createObject('name', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'name'), 'privateIPAllocationMethod', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAllocationMethod'), 'privateIPAddress', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddress'), 'publicIPAddressResourceId', if(not(empty(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'))), if(not(contains(coalesce(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), createObject()), 'publicIPAddressResourceId')), resourceId('Microsoft.Network/publicIPAddresses', coalesce(tryGet(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), 'name'), format('{0}{1}', parameters('virtualMachineName'), tryGet(tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration'), 'publicIpNameSuffix')))), tryGet(parameters('ipConfigurations')[copyIndex('value')], 'pipConfiguration', 'publicIPAddressResourceId')), null()), 'subnetResourceId', parameters('ipConfigurations')[copyIndex('value')].subnetResourceId, 'loadBalancerBackendAddressPools', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerBackendAddressPools'), 'applicationSecurityGroups', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'applicationSecurityGroups'), 'applicationGatewayBackendAddressPools', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'applicationGatewayBackendAddressPools'), 'gatewayLoadBalancer', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'gatewayLoadBalancer'), 'loadBalancerInboundNatRules', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'loadBalancerInboundNatRules'), 'privateIPAddressVersion', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'privateIPAddressVersion'), 'virtualNetworkTaps', tryGet(parameters('ipConfigurations')[copyIndex('value')], 'virtualNetworkTaps'))]"
+                                              }
+                                            ]
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "tags": {
+                                            "value": "[parameters('tags')]"
+                                          },
+                                          "diagnosticSettings": {
+                                            "value": "[parameters('diagnosticSettings')]"
+                                          },
+                                          "dnsServers": {
+                                            "value": "[parameters('dnsServers')]"
+                                          },
+                                          "enableAcceleratedNetworking": {
+                                            "value": "[parameters('enableAcceleratedNetworking')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[parameters('enableTelemetry')]"
+                                          },
+                                          "enableIPForwarding": {
+                                            "value": "[parameters('enableIPForwarding')]"
+                                          },
+                                          "lock": {
+                                            "value": "[parameters('lock')]"
+                                          },
+                                          "networkSecurityGroupResourceId": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('value', parameters('networkSecurityGroupResourceId')), createObject('value', ''))]",
+                                          "roleAssignments": {
+                                            "value": "[parameters('roleAssignments')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.38.5.1644",
+                                              "templateHash": "272838238520810437"
+                                            },
+                                            "name": "Network Interface",
+                                            "description": "This module deploys a Network Interface."
+                                          },
+                                          "definitions": {
+                                            "networkInterfaceIPConfigurationType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the IP configuration."
+                                                  }
+                                                },
+                                                "privateIPAllocationMethod": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Dynamic",
+                                                    "Static"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The private IP address allocation method."
+                                                  }
+                                                },
+                                                "privateIPAddress": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The private IP address."
+                                                  }
+                                                },
+                                                "publicIPAddressResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The resource ID of the public IP address."
+                                                  }
+                                                },
+                                                "subnetResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource ID of the subnet."
+                                                  }
+                                                },
+                                                "loadBalancerBackendAddressPools": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/backendAddressPoolType"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Array of load balancer backend address pools."
+                                                  }
+                                                },
+                                                "loadBalancerInboundNatRules": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/inboundNatRuleType"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of references of LoadBalancerInboundNatRules."
+                                                  }
+                                                },
+                                                "applicationSecurityGroups": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/applicationSecurityGroupType"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Application security groups in which the IP configuration is included."
+                                                  }
+                                                },
+                                                "applicationGatewayBackendAddressPools": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/applicationGatewayBackendAddressPoolsType"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The reference to Application Gateway Backend Address Pools."
+                                                  }
+                                                },
+                                                "gatewayLoadBalancer": {
+                                                  "$ref": "#/definitions/subResourceType",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The reference to gateway load balancer frontend IP."
+                                                  }
+                                                },
+                                                "privateIPAddressVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "IPv4",
+                                                    "IPv6"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Whether the specific IP configuration is IPv4 or IPv6."
+                                                  }
+                                                },
+                                                "virtualNetworkTaps": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/virtualNetworkTapType"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The reference to Virtual Network Taps."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The resource ID of the deployed resource."
+                                              }
+                                            },
+                                            "backendAddressPoolType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "id": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The resource ID of the backend address pool."
+                                                  }
+                                                },
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the backend address pool."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The properties of the backend address pool."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for a backend address pool."
+                                              }
+                                            },
+                                            "applicationSecurityGroupType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "id": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the application security group."
+                                                  }
+                                                },
+                                                "location": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Location of the application security group."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Properties of the application security group."
+                                                  }
+                                                },
+                                                "tags": {
+                                                  "type": "object",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Tags of the application security group."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for the application security group."
+                                              }
+                                            },
+                                            "applicationGatewayBackendAddressPoolsType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "id": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the backend address pool."
+                                                  }
+                                                },
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of the backend address pool that is unique within an Application Gateway."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "backendAddresses": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "ipAddress": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. IP address of the backend address."
+                                                            }
+                                                          },
+                                                          "fqdn": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. FQDN of the backend address."
+                                                            }
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Backend addresses."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Properties of the application gateway backend address pool."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for the application gateway backend address pool."
+                                              }
+                                            },
+                                            "subResourceType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "id": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the sub resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for the sub resource."
+                                              }
+                                            },
+                                            "inboundNatRuleType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "id": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the inbound NAT rule."
+                                                  }
+                                                },
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of the resource that is unique within the set of inbound NAT rules used by the load balancer. This name can be used to access the resource."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "backendAddressPool": {
+                                                      "$ref": "#/definitions/subResourceType",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A reference to backendAddressPool resource."
+                                                      }
+                                                    },
+                                                    "backendPort": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The port used for the internal endpoint. Acceptable values range from 1 to 65535."
+                                                      }
+                                                    },
+                                                    "enableFloatingIP": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Configures a virtual machine's endpoint for the floating IP capability required to configure a SQL AlwaysOn Availability Group. This setting is required when using the SQL AlwaysOn Availability Groups in SQL server. This setting can't be changed after you create the endpoint."
+                                                      }
+                                                    },
+                                                    "enableTcpReset": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Receive bidirectional TCP Reset on TCP flow idle timeout or unexpected connection termination. This element is only used when the protocol is set to TCP."
+                                                      }
+                                                    },
+                                                    "frontendIPConfiguration": {
+                                                      "$ref": "#/definitions/subResourceType",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A reference to frontend IP addresses."
+                                                      }
+                                                    },
+                                                    "frontendPort": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The port for the external endpoint. Port numbers for each rule must be unique within the Load Balancer. Acceptable values range from 1 to 65534."
+                                                      }
+                                                    },
+                                                    "frontendPortRangeStart": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The port range start for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeEnd. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                                      }
+                                                    },
+                                                    "frontendPortRangeEnd": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The port range end for the external endpoint. This property is used together with BackendAddressPool and FrontendPortRangeStart. Individual inbound NAT rule port mappings will be created for each backend address from BackendAddressPool. Acceptable values range from 1 to 65534."
+                                                      }
+                                                    },
+                                                    "protocol": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "All",
+                                                        "Tcp",
+                                                        "Udp"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The reference to the transport protocol used by the load balancing rule."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Properties of the inbound NAT rule."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for the inbound NAT rule."
+                                              }
+                                            },
+                                            "virtualNetworkTapType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "id": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the virtual network tap."
+                                                  }
+                                                },
+                                                "location": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Location of the virtual network tap."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Properties of the virtual network tap."
+                                                  }
+                                                },
+                                                "tags": {
+                                                  "type": "object",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Tags of the virtual network tap."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for the virtual network tap."
+                                              }
+                                            },
+                                            "networkInterfaceIPConfigurationOutputType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "The name of the IP configuration."
+                                                  }
+                                                },
+                                                "privateIP": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "The private IP address."
+                                                  }
+                                                },
+                                                "publicIP": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "The public IP address."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for the network interface IP configuration output."
+                                              }
+                                            },
+                                            "diagnosticSettingFullType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the diagnostic setting."
+                                                  }
+                                                },
+                                                "logCategoriesAndGroups": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                        }
+                                                      },
+                                                      "categoryGroup": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                  }
+                                                },
+                                                "metricCategories": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                  }
+                                                },
+                                                "logAnalyticsDestinationType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "AzureDiagnostics",
+                                                    "Dedicated"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                  }
+                                                },
+                                                "workspaceResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "storageAccountResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "eventHubAuthorizationRuleResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                  }
+                                                },
+                                                "eventHubName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "marketplacePartnerResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                },
+                                                "notes": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the notes of the lock."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a lock.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the network interface."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all resources."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/networkInterfaces@2024-07-01#properties/tags"
+                                                },
+                                                "description": "Optional. Resource tags."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            },
+                                            "enableIPForwarding": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Indicates whether IP forwarding is enabled on this network interface."
+                                              }
+                                            },
+                                            "enableAcceleratedNetworking": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. If the network interface is accelerated networking enabled."
+                                              }
+                                            },
+                                            "dnsServers": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "defaultValue": [],
+                                              "metadata": {
+                                                "description": "Optional. List of DNS servers IP addresses. Use 'AzureProvidedDNS' to switch to azure provided DNS resolution. 'AzureProvidedDNS' value cannot be combined with other IPs, it must be the only value in dnsServers collection."
+                                              }
+                                            },
+                                            "networkSecurityGroupResourceId": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The network security group (NSG) to attach to the network interface."
+                                              }
+                                            },
+                                            "auxiliaryMode": {
+                                              "type": "string",
+                                              "defaultValue": "None",
+                                              "allowedValues": [
+                                                "Floating",
+                                                "MaxConnections",
+                                                "None"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Auxiliary mode of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                                              }
+                                            },
+                                            "auxiliarySku": {
+                                              "type": "string",
+                                              "defaultValue": "None",
+                                              "allowedValues": [
+                                                "A1",
+                                                "A2",
+                                                "A4",
+                                                "A8",
+                                                "None"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Auxiliary sku of Network Interface resource. Not all regions are enabled for Auxiliary Mode Nic."
+                                              }
+                                            },
+                                            "disableTcpStateTracking": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Indicates whether to disable tcp state tracking. Subscription must be registered for the Microsoft.Network/AllowDisableTcpStateTracking feature before this property can be set to true."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/networkInterfaceIPConfigurationType"
+                                              },
+                                              "metadata": {
+                                                "description": "Required. A list of IPConfigurations of the network interface."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "diagnosticSettings": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/diagnosticSettingFullType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "publicIp": {
+                                              "copy": {
+                                                "name": "publicIp",
+                                                "count": "[length(parameters('ipConfigurations'))]"
+                                              },
+                                              "condition": "[and(contains(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), not(equals(tryGet(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), null())))]",
+                                              "existing": true,
+                                              "type": "Microsoft.Network/publicIPAddresses",
+                                              "apiVersion": "2024-05-01",
+                                              "resourceGroup": "[split(coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), ''), '/')[4]]",
+                                              "name": "[last(split(coalesce(tryGet(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), ''), '/'))]"
+                                            },
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.network-networkinterface.{0}.{1}', replace('0.5.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "networkInterface": {
+                                              "type": "Microsoft.Network/networkInterfaces",
+                                              "apiVersion": "2024-05-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "ipConfigurations",
+                                                    "count": "[length(parameters('ipConfigurations'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'name'), format('ipconfig{0}', padLeft(add(copyIndex('ipConfigurations'), 1), 2, '0')))]",
+                                                      "properties": {
+                                                        "primary": "[if(equals(copyIndex('ipConfigurations'), 0), true(), false())]",
+                                                        "privateIPAllocationMethod": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAllocationMethod')]",
+                                                        "privateIPAddress": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddress')]",
+                                                        "publicIPAddress": "[if(contains(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId'), if(not(equals(tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId'), null())), createObject('id', tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'publicIPAddressResourceId')), null()), null())]",
+                                                        "subnet": {
+                                                          "id": "[parameters('ipConfigurations')[copyIndex('ipConfigurations')].subnetResourceId]"
+                                                        },
+                                                        "loadBalancerBackendAddressPools": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerBackendAddressPools')]",
+                                                        "applicationSecurityGroups": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationSecurityGroups')]",
+                                                        "applicationGatewayBackendAddressPools": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'applicationGatewayBackendAddressPools')]",
+                                                        "gatewayLoadBalancer": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'gatewayLoadBalancer')]",
+                                                        "loadBalancerInboundNatRules": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'loadBalancerInboundNatRules')]",
+                                                        "privateIPAddressVersion": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'privateIPAddressVersion')]",
+                                                        "virtualNetworkTaps": "[tryGet(parameters('ipConfigurations')[copyIndex('ipConfigurations')], 'virtualNetworkTaps')]"
+                                                      }
+                                                    }
+                                                  }
+                                                ],
+                                                "auxiliaryMode": "[parameters('auxiliaryMode')]",
+                                                "auxiliarySku": "[parameters('auxiliarySku')]",
+                                                "disableTcpStateTracking": "[parameters('disableTcpStateTracking')]",
+                                                "dnsSettings": "[if(not(empty(parameters('dnsServers'))), createObject('dnsServers', parameters('dnsServers')), null())]",
+                                                "enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
+                                                "enableIPForwarding": "[parameters('enableIPForwarding')]",
+                                                "networkSecurityGroup": "[if(not(empty(parameters('networkSecurityGroupResourceId'))), createObject('id', parameters('networkSecurityGroupResourceId')), null())]"
+                                              }
+                                            },
+                                            "networkInterface_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                              },
+                                              "dependsOn": [
+                                                "networkInterface"
+                                              ]
+                                            },
+                                            "networkInterface_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "networkInterface_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "networkInterface"
+                                              ]
+                                            },
+                                            "networkInterface_roleAssignments": {
+                                              "copy": {
+                                                "name": "networkInterface_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/networkInterfaces/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/networkInterfaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "networkInterface"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed resource."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed resource."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/networkInterfaces', parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed resource."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('networkInterface', '2024-05-01', 'full').location]"
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/networkInterfaceIPConfigurationOutputType"
+                                              },
+                                              "metadata": {
+                                                "description": "The list of IP configurations of the network interface."
+                                              },
+                                              "copy": {
+                                                "count": "[length(parameters('ipConfigurations'))]",
+                                                "input": {
+                                                  "name": "[reference('networkInterface').ipConfigurations[copyIndex()].name]",
+                                                  "privateIP": "[coalesce(tryGet(reference('networkInterface').ipConfigurations[copyIndex()].properties, 'privateIPAddress'), '')]",
+                                                  "publicIP": "[if(and(contains(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), not(equals(tryGet(parameters('ipConfigurations')[copyIndex()], 'publicIPAddressResourceId'), null()))), coalesce(reference(format('publicIp[{0}]', copyIndex())).ipAddress, ''), '')]"
+                                                }
+                                              }
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "networkInterface_publicIPAddresses"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the network interface."
+                                      },
+                                      "value": "[reference('networkInterface').outputs.name.value]"
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/networkInterfaceIPConfigurationOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The list of IP configurations of the network interface."
+                                      },
+                                      "value": "[reference('networkInterface').outputs.ipConfigurations.value]"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "vm_domainJoinExtension": {
+                              "condition": "[and(contains(parameters('extensionDomainJoinConfig'), 'enabled'), parameters('extensionDomainJoinConfig').enabled)]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-DomainJoin', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'name'), 'DomainJoin')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Compute"
+                                  },
+                                  "type": {
+                                    "value": "JsonADDomainExtension"
+                                  },
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'typeHandlerVersion'), '1.3')]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "settings": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'settings'), createObject('Name', tryGet(parameters('extensionDomainJoinConfig'), 'domainName'), 'OUPath', tryGet(parameters('extensionDomainJoinConfig'), 'ouPath'), 'User', tryGet(parameters('extensionDomainJoinConfig'), 'user'), 'Restart', tryGet(parameters('extensionDomainJoinConfig'), 'restart'), 'Options', tryGet(parameters('extensionDomainJoinConfig'), 'options')))]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDomainJoinConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": {
+                                      "Password": "[parameters('extensionDomainJoinPassword')]"
+                                    }
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm"
+                              ]
+                            },
+                            "vm_aadJoinExtension": {
+                              "condition": "[parameters('extensionAadJoinConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-AADLogin', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'name'), 'AADLogin')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.ActiveDirectory"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AADLoginForWindows'), createObject('value', 'AADSSHLoginforLinux'))]",
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '2.0', '1.0'))]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "settings": "[if(not(empty(variables('filteredAadJoinSettings'))), createObject('value', variables('filteredAadJoinSettings')), createObject('value', null()))]",
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAadJoinConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_domainJoinExtension"
+                              ]
+                            },
+                            "vm_microsoftAntiMalwareExtension": {
+                              "condition": "[parameters('extensionAntiMalwareConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-MicrosoftAntiMalware', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'name'), 'MicrosoftAntiMalware')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Security"
+                                  },
+                                  "type": {
+                                    "value": "IaaSAntimalware"
+                                  },
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'typeHandlerVersion'), '1.3')]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "settings": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'settings'), createObject('AntimalwareEnabled', 'true', 'Exclusions', createObject(), 'RealtimeProtectionEnabled', 'true', 'ScheduledScanSettings', createObject('day', '7', 'isEnabled', 'true', 'scanType', 'Quick', 'time', '120')))]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAntiMalwareConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_aadJoinExtension"
+                              ]
+                            },
+                            "vm_azureMonitorAgentExtension": {
+                              "condition": "[parameters('extensionMonitoringAgentConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-AzureMonitorAgent', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'name'), 'AzureMonitorAgent')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Monitor"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureMonitorWindowsAgent'), createObject('value', 'AzureMonitorLinuxAgent'))]",
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.22', '1.29'))]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "settings": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'settings'), createObject())]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionMonitoringAgentConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_microsoftAntiMalwareExtension"
+                              ]
+                            },
+                            "vm_dependencyAgentExtension": {
+                              "condition": "[parameters('extensionDependencyAgentConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-DependencyAgent', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'name'), 'DependencyAgent')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Monitoring.DependencyAgent"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'DependencyAgentWindows'), createObject('value', 'DependencyAgentLinux'))]",
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'typeHandlerVersion'), '9.10')]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'enableAutomaticUpgrade'), true())]"
+                                  },
+                                  "settings": {
+                                    "value": {
+                                      "enableAMA": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'enableAMA'), true())]"
+                                    }
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDependencyAgentConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureMonitorAgentExtension"
+                              ]
+                            },
+                            "vm_networkWatcherAgentExtension": {
+                              "condition": "[parameters('extensionNetworkWatcherAgentConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-NetworkWatcherAgent', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'name'), 'NetworkWatcherAgent')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.NetworkWatcher"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'NetworkWatcherAgentWindows'), createObject('value', 'NetworkWatcherAgentLinux'))]",
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'typeHandlerVersion'), '1.4')]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNetworkWatcherAgentConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_dependencyAgentExtension"
+                              ]
+                            },
+                            "vm_desiredStateConfigurationExtension": {
+                              "condition": "[parameters('extensionDSCConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-DesiredStateConfiguration', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'name'), 'DesiredStateConfiguration')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Powershell"
+                                  },
+                                  "type": {
+                                    "value": "DSC"
+                                  },
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'typeHandlerVersion'), '2.77')]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "settings": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'settings'), createObject())]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": "[coalesce(tryGet(parameters('extensionDSCConfig'), 'protectedSettings'), createObject())]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_networkWatcherAgentExtension"
+                              ]
+                            },
+                            "vm_customScriptExtension": {
+                              "condition": "[not(empty(parameters('extensionCustomScriptConfig')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-CustomScriptExtension', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'name'), 'CustomScriptExtension')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'Microsoft.Compute'), createObject('value', 'Microsoft.Azure.Extensions'))]",
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'CustomScriptExtension'), createObject('value', 'CustomScript'))]",
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.10', '2.1'))]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "forceUpdateTag": {
+                                    "value": "[tryGet(parameters('extensionCustomScriptConfig'), 'forceUpdateTag')]"
+                                  },
+                                  "provisionAfterExtensions": {
+                                    "value": "[tryGet(parameters('extensionCustomScriptConfig'), 'provisionAfterExtensions')]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionCustomScriptConfig'), 'tags'), parameters('tags'))]"
+                                  },
+                                  "protectedSettingsFromKeyVault": {
+                                    "value": "[tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettingsFromKeyVault')]"
+                                  },
+                                  "settings": {
+                                    "value": "[shallowMerge(createArray(if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'settings'), 'commandToExecute'))), createObject('commandToExecute', tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'settings'), 'commandToExecute')), createObject()), if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'settings'), 'fileUris'))), createObject('fileUris', tryGet(parameters('extensionCustomScriptConfig'), 'settings', 'fileUris')), createObject())))]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": "[shallowMerge(createArray(if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'commandToExecute'))), createObject('commandToExecute', tryGet(parameters('extensionCustomScriptConfig').protectedSettings, 'commandToExecute')), createObject()), if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'storageAccountName'))), createObject('storageAccountName', parameters('extensionCustomScriptConfig').protectedSettings.storageAccountName), createObject()), if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'storageAccountKey'))), createObject('storageAccountKey', parameters('extensionCustomScriptConfig').protectedSettings.storageAccountKey), createObject()), if(not(empty(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'fileUris'))), createObject('fileUris', parameters('extensionCustomScriptConfig').protectedSettings.fileUris), createObject()), if(not(equals(tryGet(tryGet(parameters('extensionCustomScriptConfig'), 'protectedSettings'), 'managedIdentityResourceId'), null())), createObject('managedIdentity', if(not(empty(tryGet(parameters('extensionCustomScriptConfig').protectedSettings, 'managedIdentityResourceId'))), createObject('clientId', reference('cseIdentity').clientId), createObject())), createObject())))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "cseIdentity",
+                                "vm"
+                              ]
+                            },
+                            "vm_azureDiskEncryptionExtension": {
+                              "condition": "[parameters('extensionAzureDiskEncryptionConfig').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-AzureDiskEncryption', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'name'), 'AzureDiskEncryption')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.Azure.Security"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'AzureDiskEncryption'), createObject('value', 'AzureDiskEncryptionForLinux'))]",
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '2.2', '1.1'))]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "forceUpdateTag": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'forceUpdateTag'), '1.0')]"
+                                  },
+                                  "settings": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'settings'), createObject())]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionAzureDiskEncryptionConfig'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_customScriptExtension"
+                              ]
+                            },
+                            "vm_nvidiaGpuDriverWindowsExtension": {
+                              "condition": "[parameters('extensionNvidiaGpuDriverWindows').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-NvidiaGpuDriverWindows', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'name'), 'NvidiaGpuDriverWindows')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.HpcCompute"
+                                  },
+                                  "type": {
+                                    "value": "NvidiaGpuDriverWindows"
+                                  },
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'typeHandlerVersion'), '1.4')]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionNvidiaGpuDriverWindows'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureDiskEncryptionExtension"
+                              ]
+                            },
+                            "vm_hostPoolRegistrationExtension": {
+                              "condition": "[parameters('extensionHostPoolRegistration').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-HostPoolRegistration', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'name'), 'HostPoolRegistration')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.PowerShell"
+                                  },
+                                  "type": {
+                                    "value": "DSC"
+                                  },
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'typeHandlerVersion'), '2.77')]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'enableAutomaticUpgrade'), false())]"
+                                  },
+                                  "settings": {
+                                    "value": {
+                                      "modulesUrl": "[parameters('extensionHostPoolRegistration').modulesUrl]",
+                                      "configurationFunction": "[parameters('extensionHostPoolRegistration').configurationFunction]",
+                                      "properties": {
+                                        "hostPoolName": "[parameters('extensionHostPoolRegistration').hostPoolName]",
+                                        "aadJoin": true
+                                      }
+                                    }
+                                  },
+                                  "protectedSettings": {
+                                    "value": {
+                                      "properties": {
+                                        "registrationInfoToken": "[parameters('extensionHostPoolRegistration').registrationInfoToken]"
+                                      }
+                                    }
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'supressFailures'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionHostPoolRegistration'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_nvidiaGpuDriverWindowsExtension"
+                              ]
+                            },
+                            "vm_azureGuestConfigurationExtension": {
+                              "condition": "[parameters('extensionGuestConfigurationExtension').enabled]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-GuestConfiguration', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "virtualMachineName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": "[if(coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'name'), equals(parameters('osType'), 'Windows')), createObject('value', 'AzurePolicyforWindows'), createObject('value', 'AzurePolicyforLinux'))]",
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "publisher": {
+                                    "value": "Microsoft.GuestConfiguration"
+                                  },
+                                  "type": "[if(equals(parameters('osType'), 'Windows'), createObject('value', 'ConfigurationforWindows'), createObject('value', 'ConfigurationForLinux'))]",
+                                  "typeHandlerVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'typeHandlerVersion'), if(equals(parameters('osType'), 'Windows'), '1.0', '1.0'))]"
+                                  },
+                                  "autoUpgradeMinorVersion": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'autoUpgradeMinorVersion'), true())]"
+                                  },
+                                  "enableAutomaticUpgrade": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'enableAutomaticUpgrade'), true())]"
+                                  },
+                                  "forceUpdateTag": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'forceUpdateTag'), '1.0')]"
+                                  },
+                                  "settings": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'settings'), createObject())]"
+                                  },
+                                  "supressFailures": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'supressFailures'), false())]"
+                                  },
+                                  "protectedSettings": {
+                                    "value": "[parameters('extensionGuestConfigurationExtensionProtectedSettings')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(parameters('extensionGuestConfigurationExtension'), 'tags'), parameters('tags'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "3581830278162851734"
+                                    },
+                                    "name": "Virtual Machine Extensions",
+                                    "description": "This module deploys a Virtual Machine Extension."
+                                  },
+                                  "parameters": {
+                                    "virtualMachineName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent virtual machine that extension is provisioned for. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the virtual machine extension."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. The location the extension is deployed to."
+                                      }
+                                    },
+                                    "publisher": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the extension handler publisher."
+                                      }
+                                    },
+                                    "type": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the type of the extension; an example is \"CustomScriptExtension\"."
+                                      }
+                                    },
+                                    "typeHandlerVersion": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Specifies the version of the script handler."
+                                      }
+                                    },
+                                    "autoUpgradeMinorVersion": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should use a newer minor version if one is available at deployment time. Once deployed, however, the extension will not upgrade minor versions unless redeployed, even with this property set to true."
+                                      }
+                                    },
+                                    "forceUpdateTag": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. How the extension handler should be forced to update even if the extension configuration has not changed."
+                                      }
+                                    },
+                                    "settings": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific settings."
+                                      }
+                                    },
+                                    "protectedSettings": {
+                                      "type": "secureObject",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Any object that contains the extension specific protected settings."
+                                      }
+                                    },
+                                    "supressFailures": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether failures stemming from the extension will be suppressed (Operational failures such as not connecting to the VM will not be suppressed regardless of this value). The default is false."
+                                      }
+                                    },
+                                    "enableAutomaticUpgrade": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether the extension should be automatically upgraded by the platform if there is a newer version of the extension available."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "protectedSettingsFromKeyVault": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/protectedSettingsFromKeyVault"
+                                        },
+                                        "description": "Optional. The extensions protected settings that are passed by reference, and consumed from key vault."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "provisionAfterExtensions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Compute/virtualMachines/extensions@2024-11-01#properties/properties/properties/provisionAfterExtensions"
+                                        },
+                                        "description": "Optional. Collection of extension names after which this extension needs to be provisioned."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "virtualMachine": {
+                                      "existing": true,
+                                      "type": "Microsoft.Compute/virtualMachines",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('virtualMachineName')]"
+                                    },
+                                    "extension": {
+                                      "type": "Microsoft.Compute/virtualMachines/extensions",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('virtualMachineName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "publisher": "[parameters('publisher')]",
+                                        "type": "[parameters('type')]",
+                                        "typeHandlerVersion": "[parameters('typeHandlerVersion')]",
+                                        "autoUpgradeMinorVersion": "[parameters('autoUpgradeMinorVersion')]",
+                                        "enableAutomaticUpgrade": "[parameters('enableAutomaticUpgrade')]",
+                                        "forceUpdateTag": "[parameters('forceUpdateTag')]",
+                                        "settings": "[parameters('settings')]",
+                                        "protectedSettings": "[parameters('protectedSettings')]",
+                                        "suppressFailures": "[parameters('supressFailures')]",
+                                        "protectedSettingsFromKeyVault": "[parameters('protectedSettingsFromKeyVault')]",
+                                        "provisionAfterExtensions": "[parameters('provisionAfterExtensions')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('virtualMachineName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the extension was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('extension', '2024-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_hostPoolRegistrationExtension"
+                              ]
+                            },
+                            "vm_backup": {
+                              "condition": "[not(empty(parameters('backupVaultName')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-VM-Backup', uniqueString(deployment().name, parameters('location')))]",
+                              "resourceGroup": "[parameters('backupVaultResourceGroup')]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[format('vm;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "policyId": {
+                                    "value": "[resourceId(parameters('backupVaultResourceGroup'), 'Microsoft.RecoveryServices/vaults/backupPolicies', parameters('backupVaultName'), parameters('backupPolicyName'))]"
+                                  },
+                                  "protectedItemType": {
+                                    "value": "Microsoft.Compute/virtualMachines"
+                                  },
+                                  "protectionContainerName": {
+                                    "value": "[format('iaasvmcontainer;iaasvmcontainerv2;{0};{1}', resourceGroup().name, parameters('name'))]"
+                                  },
+                                  "recoveryVaultName": {
+                                    "value": "[parameters('backupVaultName')]"
+                                  },
+                                  "sourceResourceId": {
+                                    "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "17448691641471706096"
+                                    },
+                                    "name": "Recovery Service Vaults Protection Container Protected Item",
+                                    "description": "This module deploys a Recovery Services Vault Protection Container Protected Item."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the resource."
+                                      }
+                                    },
+                                    "protectionContainerName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. Name of the Azure Recovery Service Vault Protection Container. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "recoveryVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Azure Recovery Service Vault. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "protectedItemType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AzureFileShareProtectedItem",
+                                        "AzureVmWorkloadSAPAseDatabase",
+                                        "AzureVmWorkloadSAPHanaDatabase",
+                                        "AzureVmWorkloadSQLDatabase",
+                                        "DPMProtectedItem",
+                                        "GenericProtectedItem",
+                                        "MabFileFolderProtectedItem",
+                                        "Microsoft.ClassicCompute/virtualMachines",
+                                        "Microsoft.Compute/virtualMachines",
+                                        "Microsoft.Sql/servers/databases"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The backup item type."
+                                      }
+                                    },
+                                    "policyId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. ID of the backup policy with which this item is backed up."
+                                      }
+                                    },
+                                    "sourceResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the resource to back up."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
+                                      "apiVersion": "2025-02-01",
+                                      "name": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "properties": {
+                                        "protectedItemType": "[parameters('protectedItemType')]",
+                                        "policyId": "[parameters('policyId')]",
+                                        "sourceResourceId": "[parameters('sourceResourceId')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Resource Group the protected item was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the protected item."
+                                      },
+                                      "value": "[resourceId('Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems', split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[0], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[1], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[2], split(format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name')), '/')[3])]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The Name of the protected item."
+                                      },
+                                      "value": "[format('{0}/Azure/{1}/{2}', parameters('recoveryVaultName'), parameters('protectionContainerName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "vm",
+                                "vm_azureGuestConfigurationExtension"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the VM."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the VM."
+                              },
+                              "value": "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the VM was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('vm', '2024-07-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('vm', '2024-07-01', 'full').location]"
+                            },
+                            "nicConfigurations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/nicConfigurationOutputType"
+                              },
+                              "metadata": {
+                                "description": "The list of NIC configurations of the virtual machine."
+                              },
+                              "copy": {
+                                "count": "[length(parameters('nicConfigurations'))]",
+                                "input": {
+                                  "name": "[reference(format('vm_nic[{0}]', copyIndex())).outputs.name.value]",
+                                  "ipConfigurations": "[reference(format('vm_nic[{0}]', copyIndex())).outputs.ipConfigurations.value]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the virtual machine."
+                      },
+                      "value": "[reference('virtualMachine').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the virtual machine."
+                      },
+                      "value": "[reference('virtualMachine').outputs.name.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "log_analytics",
+                "maintenanceConfiguration",
+                "proximityPlacementGroup",
+                "virtualNetwork",
+                "windowsVmDataCollectionRules"
+              ]
+            },
+            "privateDnsZoneDeployments": {
+              "copy": {
+                "name": "privateDnsZoneDeployments",
+                "count": "[length(variables('privateDnsZones'))]",
+                "mode": "serial",
+                "batchSize": 5
+              },
+              "condition": "[parameters('enablePrivateNetworking')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.private-dns-zone.{0}.{1}', split(variables('privateDnsZones')[copyIndex()], '.')[1], parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[variables('privateDnsZones')[copyIndex()]]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "virtualNetworkLinks": {
+                    "value": [
+                      {
+                        "name": "[take(format('vnetlink-{0}-{1}', reference('virtualNetwork').outputs.name.value, split(variables('privateDnsZones')[copyIndex()], '.')[1]), 80)]",
+                        "virtualNetworkResourceId": "[reference('virtualNetwork').outputs.resourceId.value]"
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "11076758087490966511"
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the private DNS zone (e.g., privatelink.cognitiveservices.azure.com)."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "virtualNetworkLinks": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Virtual network links to associate with the DNS zone."
+                      }
+                    },
+                    "a": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of A records."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.network.private-dns-zone.{0}', split(parameters('name'), '.')[1]), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "virtualNetworkLinks": {
+                            "value": "[parameters('virtualNetworkLinks')]"
+                          },
+                          "a": {
+                            "value": "[parameters('a')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "18337341331267624582"
+                            },
+                            "name": "Private DNS Zones",
+                            "description": "This module deploys a Private DNS zone."
+                          },
+                          "definitions": {
+                            "aType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the record."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/A@2024-06-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. The metadata of the record."
+                                  },
+                                  "nullable": true
+                                },
+                                "ttl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The TTL of the record."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "aRecords": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/A@2024-06-01#properties/properties/properties/aRecords"
+                                    },
+                                    "description": "Optional. The list of A records in the record set."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the A record."
+                              }
+                            },
+                            "aaaaType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the record."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/AAAA@2024-06-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. The metadata of the record."
+                                  },
+                                  "nullable": true
+                                },
+                                "ttl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The TTL of the record."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "aaaaRecords": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/AAAA@2024-06-01#properties/properties/properties/aaaaRecords"
+                                    },
+                                    "description": "Optional. The list of AAAA records in the record set."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the AAAA record."
+                              }
+                            },
+                            "cnameType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the record."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/CNAME@2024-06-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. The metadata of the record."
+                                  },
+                                  "nullable": true
+                                },
+                                "ttl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The TTL of the record."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "cnameRecord": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/CNAME@2024-06-01#properties/properties/properties/cnameRecord"
+                                    },
+                                    "description": "Optional. The CNAME record in the record set."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the CNAME record."
+                              }
+                            },
+                            "mxType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the record."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/MX@2024-06-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. The metadata of the record."
+                                  },
+                                  "nullable": true
+                                },
+                                "ttl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The TTL of the record."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "mxRecords": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/MX@2024-06-01#properties/properties/properties/mxRecords"
+                                    },
+                                    "description": "Optional. The list of MX records in the record set."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the MX record."
+                              }
+                            },
+                            "ptrType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the record."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/PTR@2024-06-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. The metadata of the record."
+                                  },
+                                  "nullable": true
+                                },
+                                "ttl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The TTL of the record."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "ptrRecords": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/PTR@2024-06-01#properties/properties/properties/ptrRecords"
+                                    },
+                                    "description": "Optional. The list of PTR records in the record set."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the PTR record."
+                              }
+                            },
+                            "soaType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the record."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/SOA@2024-06-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. The metadata of the record."
+                                  },
+                                  "nullable": true
+                                },
+                                "ttl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The TTL of the record."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "soaRecord": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/SOA@2024-06-01#properties/properties/properties/soaRecord"
+                                    },
+                                    "description": "Optional. The SOA record in the record set."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the SOA record."
+                              }
+                            },
+                            "srvType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the record."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/SRV@2024-06-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. The metadata of the record."
+                                  },
+                                  "nullable": true
+                                },
+                                "ttl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The TTL of the record."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "srvRecords": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/SRV@2024-06-01#properties/properties/properties/srvRecords"
+                                    },
+                                    "description": "Optional. The list of SRV records in the record set."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the SRV record."
+                              }
+                            },
+                            "txtType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the record."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/TXT@2024-06-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. The metadata of the record."
+                                  },
+                                  "nullable": true
+                                },
+                                "ttl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The TTL of the record."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "txtRecords": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/TXT@2024-06-01#properties/properties/properties/txtRecords"
+                                    },
+                                    "description": "Optional. The list of TXT records in the record set."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the TXT record."
+                              }
+                            },
+                            "virtualNetworkLinkType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "minLength": 1,
+                                  "maxLength": 80,
+                                  "metadata": {
+                                    "description": "Optional. The resource name."
+                                  }
+                                },
+                                "virtualNetworkResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the virtual network to link."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Azure Region where the resource lives."
+                                  }
+                                },
+                                "registrationEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01#properties/tags"
+                                    },
+                                    "description": "Optional. Resource tags."
+                                  },
+                                  "nullable": true
+                                },
+                                "resolutionPolicy": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Default",
+                                    "NxDomainRedirect"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resolution type of the private-dns-zone fallback machanism."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the virtual network link."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Private DNS zone name."
+                              }
+                            },
+                            "a": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/aType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of A records."
+                              }
+                            },
+                            "aaaa": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/aaaaType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of AAAA records."
+                              }
+                            },
+                            "cname": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/cnameType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of CNAME records."
+                              }
+                            },
+                            "mx": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/mxType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of MX records."
+                              }
+                            },
+                            "ptr": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/ptrType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of PTR records."
+                              }
+                            },
+                            "soa": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/soaType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of SOA records."
+                              }
+                            },
+                            "srv": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/srvType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of SRV records."
+                              }
+                            },
+                            "txt": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/txtType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of TXT records."
+                              }
+                            },
+                            "virtualNetworkLinks": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/virtualNetworkLinkType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of custom objects describing vNet links of the DNS zone. Each object should contain properties 'virtualNetworkResourceId' and 'registrationEnabled'. The 'vnetResourceId' is a resource ID of a vNet to link, 'registrationEnabled' (bool) enables automatic DNS registration in the zone for the linked vNet."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "global",
+                              "metadata": {
+                                "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            },
+                            "enableReferencedModulesTelemetry": false
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-privatednszone.{0}.{1}', replace('0.8.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateDnsZone": {
+                              "type": "Microsoft.Network/privateDnsZones",
+                              "apiVersion": "2020-06-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]"
+                            },
+                            "privateDnsZone_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_roleAssignments": {
+                              "copy": {
+                                "name": "privateDnsZone_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_A": {
+                              "copy": {
+                                "name": "privateDnsZone_A",
+                                "count": "[length(coalesce(parameters('a'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateDnsZone-ARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('a'), createArray())[copyIndex()].name]"
+                                  },
+                                  "aRecords": {
+                                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'aRecords')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('a'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "7372385900111002873"
+                                    },
+                                    "name": "Private DNS Zone A record",
+                                    "description": "This module deploys a Private DNS Zone A record."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the A record."
+                                      }
+                                    },
+                                    "aRecords": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/A@2024-06-01#properties/properties/properties/aRecords"
+                                        },
+                                        "description": "Optional. The list of A records in the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/A@2024-06-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. The metadata attached to the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.nw-privdnszonea.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "A": {
+                                      "type": "Microsoft.Network/privateDnsZones/A",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "aRecords": "[parameters('aRecords')]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      }
+                                    },
+                                    "A_roleAssignments": {
+                                      "copy": {
+                                        "name": "A_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "A"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed A record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed A record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/A', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed A record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_AAAA": {
+                              "copy": {
+                                "name": "privateDnsZone_AAAA",
+                                "count": "[length(coalesce(parameters('aaaa'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateDnsZone-AAAARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('aaaa'), createArray())[copyIndex()].name]"
+                                  },
+                                  "aaaaRecords": {
+                                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'aaaaRecords')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('aaaa'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "14405855828972373002"
+                                    },
+                                    "name": "Private DNS Zone AAAA record",
+                                    "description": "This module deploys a Private DNS Zone AAAA record."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the AAAA record."
+                                      }
+                                    },
+                                    "aaaaRecords": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/AAAA@2024-06-01#properties/properties/properties/aaaaRecords"
+                                        },
+                                        "description": "Optional. The list of AAAA records in the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/AAAA@2024-06-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. The metadata attached to the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.nw-privdnszoneaaaa.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "AAAA": {
+                                      "type": "Microsoft.Network/privateDnsZones/AAAA",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "aaaaRecords": "[parameters('aaaaRecords')]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      }
+                                    },
+                                    "AAAA_roleAssignments": {
+                                      "copy": {
+                                        "name": "AAAA_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "AAAA"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed AAAA record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed AAAA record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/AAAA', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed AAAA record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_CNAME": {
+                              "copy": {
+                                "name": "privateDnsZone_CNAME",
+                                "count": "[length(coalesce(parameters('cname'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateDnsZone-CNAMERecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('cname'), createArray())[copyIndex()].name]"
+                                  },
+                                  "cnameRecord": {
+                                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'cnameRecord')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('cname'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "13818627461335065928"
+                                    },
+                                    "name": "Private DNS Zone CNAME record",
+                                    "description": "This module deploys a Private DNS Zone CNAME record."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the CNAME record."
+                                      }
+                                    },
+                                    "cnameRecord": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/CNAME@2024-06-01#properties/properties/properties/cnameRecord"
+                                        },
+                                        "description": "Optional. A CNAME record."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/CNAME@2024-06-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. The metadata attached to the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.nw-privdnszonecname.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "CNAME": {
+                                      "type": "Microsoft.Network/privateDnsZones/CNAME",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "cnameRecord": "[parameters('cnameRecord')]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      }
+                                    },
+                                    "CNAME_roleAssignments": {
+                                      "copy": {
+                                        "name": "CNAME_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "CNAME"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed CNAME record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed CNAME record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/CNAME', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed CNAME record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_MX": {
+                              "copy": {
+                                "name": "privateDnsZone_MX",
+                                "count": "[length(coalesce(parameters('mx'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateDnsZone-MXRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('mx'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "mxRecords": {
+                                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'mxRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('mx'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "2977624679479439942"
+                                    },
+                                    "name": "Private DNS Zone MX record",
+                                    "description": "This module deploys a Private DNS Zone MX record."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the MX record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/MX@2024-06-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. The metadata attached to the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "mxRecords": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/MX@2024-06-01#properties/properties/properties/mxRecords"
+                                        },
+                                        "description": "Optional. The list of MX records in the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.nw-privdnszonemx.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "MX": {
+                                      "type": "Microsoft.Network/privateDnsZones/MX",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "mxRecords": "[parameters('mxRecords')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      }
+                                    },
+                                    "MX_roleAssignments": {
+                                      "copy": {
+                                        "name": "MX_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "MX"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed MX record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed MX record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/MX', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed MX record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_PTR": {
+                              "copy": {
+                                "name": "privateDnsZone_PTR",
+                                "count": "[length(coalesce(parameters('ptr'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateDnsZone-PTRRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('ptr'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "ptrRecords": {
+                                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ptrRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('ptr'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "15286275176817336979"
+                                    },
+                                    "name": "Private DNS Zone PTR record",
+                                    "description": "This module deploys a Private DNS Zone PTR record."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the PTR record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/PTR@2024-06-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. The metadata attached to the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ptrRecords": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/PTR@2024-06-01#properties/properties/properties/ptrRecords"
+                                        },
+                                        "description": "Optional. The list of PTR records in the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.nw-privdnszoneptr.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "PTR": {
+                                      "type": "Microsoft.Network/privateDnsZones/PTR",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "ptrRecords": "[parameters('ptrRecords')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      }
+                                    },
+                                    "PTR_roleAssignments": {
+                                      "copy": {
+                                        "name": "PTR_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "PTR"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed PTR record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed PTR record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/PTR', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed PTR record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_SOA": {
+                              "copy": {
+                                "name": "privateDnsZone_SOA",
+                                "count": "[length(coalesce(parameters('soa'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateDnsZone-SOARecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('soa'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "soaRecord": {
+                                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'soaRecord')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('soa'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "4837447718856535826"
+                                    },
+                                    "name": "Private DNS Zone SOA record",
+                                    "description": "This module deploys a Private DNS Zone SOA record."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the SOA record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/SOA@2024-06-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. The metadata attached to the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "soaRecord": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/SOA@2024-06-01#properties/properties/properties/soaRecord"
+                                        },
+                                        "description": "Optional. A SOA record."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.nw-privdnszonesoa.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "SOA": {
+                                      "type": "Microsoft.Network/privateDnsZones/SOA",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "soaRecord": "[parameters('soaRecord')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      }
+                                    },
+                                    "SOA_roleAssignments": {
+                                      "copy": {
+                                        "name": "SOA_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "SOA"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed SOA record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed SOA record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SOA', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed SOA record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_SRV": {
+                              "copy": {
+                                "name": "privateDnsZone_SRV",
+                                "count": "[length(coalesce(parameters('srv'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateDnsZone-SRVRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('srv'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "srvRecords": {
+                                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'srvRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('srv'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "15028912535488490265"
+                                    },
+                                    "name": "Private DNS Zone SRV record",
+                                    "description": "This module deploys a Private DNS Zone SRV record."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the SRV record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/SRV@2024-06-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. The metadata attached to the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "srvRecords": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/SRV@2024-06-01#properties/properties/properties/srvRecords"
+                                        },
+                                        "description": "Optional. The list of SRV records in the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.nw-privdnszonesrv.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "SRV": {
+                                      "type": "Microsoft.Network/privateDnsZones/SRV",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "srvRecords": "[parameters('srvRecords')]",
+                                        "ttl": "[parameters('ttl')]"
+                                      }
+                                    },
+                                    "SRV_roleAssignments": {
+                                      "copy": {
+                                        "name": "SRV_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "SRV"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed SRV record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed SRV record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/SRV', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed SRV record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_TXT": {
+                              "copy": {
+                                "name": "privateDnsZone_TXT",
+                                "count": "[length(coalesce(parameters('txt'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateDnsZone-TXTRecord-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('txt'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "txtRecords": {
+                                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'txtRecords')]"
+                                  },
+                                  "ttl": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'ttl'), 3600)]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('txt'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "7641583415110009849"
+                                    },
+                                    "name": "Private DNS Zone TXT record",
+                                    "description": "This module deploys a Private DNS Zone TXT record."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the TXT record."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/TXT@2024-06-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. The metadata attached to the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ttl": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "metadata": {
+                                        "description": "Optional. The TTL (time-to-live) of the records in the record set."
+                                      }
+                                    },
+                                    "txtRecords": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/TXT@2024-06-01#properties/properties/properties/txtRecords"
+                                        },
+                                        "description": "Optional. The list of TXT records in the record set."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.nw-privdnszonetxt.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "TXT": {
+                                      "type": "Microsoft.Network/privateDnsZones/TXT",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]",
+                                        "ttl": "[parameters('ttl')]",
+                                        "txtRecords": "[parameters('txtRecords')]"
+                                      }
+                                    },
+                                    "TXT_roleAssignments": {
+                                      "copy": {
+                                        "name": "TXT_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "TXT"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed TXT record."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed TXT record."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/TXT', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed TXT record."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            },
+                            "privateDnsZone_virtualNetworkLinks": {
+                              "copy": {
+                                "name": "privateDnsZone_virtualNetworkLinks",
+                                "count": "[length(coalesce(parameters('virtualNetworkLinks'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateDnsZone-VNetLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "privateDnsZoneName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'name'), format('{0}-vnetlink', last(split(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId, '/'))))]"
+                                  },
+                                  "virtualNetworkResourceId": {
+                                    "value": "[coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()].virtualNetworkResourceId]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'location'), 'global')]"
+                                  },
+                                  "registrationEnabled": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'registrationEnabled'), false())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "resolutionPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('virtualNetworkLinks'), createArray())[copyIndex()], 'resolutionPolicy')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "7392770862892927923"
+                                    },
+                                    "name": "Private DNS Zone Virtual Network Link",
+                                    "description": "This module deploys a Private DNS Zone Virtual Network Link."
+                                  },
+                                  "parameters": {
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "privateDnsZoneName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Private DNS zone. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[format('{0}-vnetlink', last(split(parameters('virtualNetworkResourceId'), '/')))]",
+                                      "metadata": {
+                                        "description": "Optional. The name of the virtual network link."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "global",
+                                      "metadata": {
+                                        "description": "Optional. The location of the PrivateDNSZone. Should be global."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "registrationEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Is auto-registration of virtual machine records in the virtual network in the Private DNS zone enabled?."
+                                      }
+                                    },
+                                    "virtualNetworkResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Link to another virtual network resource ID."
+                                      }
+                                    },
+                                    "resolutionPolicy": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resolution policy on the virtual network link. Only applicable for virtual network links to privatelink zones, and for A,AAAA,CNAME queries. When set to `NxDomainRedirect`, Azure DNS resolver falls back to public resolution if private dns query resolution results in non-existent domain response. `Default` is configured as the default option."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.nw-privdnszonevnetlink.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZone": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateDnsZones",
+                                      "apiVersion": "2020-06-01",
+                                      "name": "[parameters('privateDnsZoneName')]"
+                                    },
+                                    "virtualNetworkLink": {
+                                      "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+                                      "apiVersion": "2024-06-01",
+                                      "name": "[format('{0}/{1}', parameters('privateDnsZoneName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "registrationEnabled": "[parameters('registrationEnabled')]",
+                                        "virtualNetwork": {
+                                          "id": "[parameters('virtualNetworkResourceId')]"
+                                        },
+                                        "resolutionPolicy": "[parameters('resolutionPolicy')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed virtual network link."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed virtual network link."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateDnsZones/virtualNetworkLinks', parameters('privateDnsZoneName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed virtual network link."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('virtualNetworkLink', '2024-06-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateDnsZone"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private DNS zone was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private DNS zone."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private DNS zone."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('name'))]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateDnsZone', '2020-06-01', 'full').location]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the private DNS zone."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.network.private-dns-zone.{0}', split(parameters('name'), '.')[1]), 64)), '2025-04-01').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the private DNS zone."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.network.private-dns-zone.{0}', split(parameters('name'), '.')[1]), 64)), '2025-04-01').outputs.name.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "virtualNetwork"
+              ]
+            },
+            "existing_project_setup": {
+              "condition": "[variables('useExistingAIProject')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)]",
+              "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+              "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference('ai_foundry_project').outputs.name.value))]",
+                  "projectName": "[if(variables('useExistingAIProject'), if(greater(length(split(parameters('existingFoundryProjectResourceId'), '/')), 10), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[10]), createObject('value', '')), createObject('value', reference('ai_foundry_project').outputs.projectName.value))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "8266777043110372909"
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the existing Cognitive Services account."
+                      }
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the existing AI project."
+                      }
+                    }
+                  },
+                  "resources": [],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Services account."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Services account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the AI Services account (OpenAI Language Model Instance API)."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['OpenAI Language Model Instance API']]"
+                    },
+                    "cognitiveServicesEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the AI Services account (Cognitive Services)."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoint]"
+                    },
+                    "azureOpenAiCuEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure OpenAI Content Understanding endpoint URL."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]"
+                    },
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID of the AI Services account (empty if none)."
+                      },
+                      "value": "[coalesce(tryGet(reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full').identity, 'principalId'), '')]"
+                    },
+                    "projectResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Foundry project."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]"
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Foundry project."
+                      },
+                      "value": "[parameters('projectName')]"
+                    },
+                    "projectEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "AI Foundry project endpoint."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]"
+                    },
+                    "projectIdentityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID of the project (empty if none)."
+                      },
+                      "value": "[coalesce(tryGet(reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full').identity, 'principalId'), '')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "ai_foundry_project"
+              ]
+            },
+            "ai_foundry_project": {
+              "condition": "[not(variables('useExistingAIProject'))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('azureAiServiceLocation')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "publicNetworkAccess": {
+                    "value": "Enabled"
+                  },
+                  "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', null()))]",
+                  "roleAssignments": {
+                    "value": [
+                      {
+                        "roleDefinitionIdOrName": "a97b65f3-24c7-4388-baec-2e87135dc908",
+                        "principalId": "[variables('deployingUserPrincipalId')]",
+                        "principalType": "[parameters('deployingUserPrincipalType')]"
+                      },
+                      {
+                        "roleDefinitionIdOrName": "53ca6127-db72-4b80-b1b0-d745d6d5456d",
+                        "principalId": "[variables('deployingUserPrincipalId')]",
+                        "principalType": "[parameters('deployingUserPrincipalType')]"
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "7014942539753624443"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Solution name suffix used to generate resource names."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('aif-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the AI Services account. Defaults to aif-{solutionName}."
+                      }
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "defaultValue": "[format('proj-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Azure region for the resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Tags to apply to resources."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "S0",
+                      "metadata": {
+                        "description": "Optional. SKU name for the AI Services account."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether to disable local (key-based) authentication."
+                      }
+                    },
+                    "allowProjectManagement": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether to allow project management (AI Foundry hub)."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Optional. Public network access setting."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity type for the resources."
+                      }
+                    },
+                    "networkAclsDefaultAction": {
+                      "type": "string",
+                      "defaultValue": "Allow",
+                      "allowedValues": [
+                        "Allow",
+                        "Deny"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Network ACLs default action."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Diagnostic settings for the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create on the AI Services account."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "aiServices": {
+                      "existing": true,
+                      "type": "Microsoft.CognitiveServices/accounts",
+                      "apiVersion": "2025-12-01",
+                      "name": "[parameters('name')]",
+                      "dependsOn": [
+                        "aiServicesAccount"
+                      ]
+                    },
+                    "aiProject": {
+                      "type": "Microsoft.CognitiveServices/accounts/projects",
+                      "apiVersion": "2025-12-01",
+                      "name": "[format('{0}/{1}', parameters('name'), parameters('projectName'))]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "AIServices",
+                      "identity": "[parameters('identity')]",
+                      "properties": {},
+                      "dependsOn": [
+                        "aiServicesAccount"
+                      ]
+                    },
+                    "aiServicesAccount": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.cognitive-services.account.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "sku": {
+                            "value": "[parameters('skuName')]"
+                          },
+                          "kind": {
+                            "value": "AIServices"
+                          },
+                          "disableLocalAuth": {
+                            "value": "[parameters('disableLocalAuth')]"
+                          },
+                          "allowProjectManagement": {
+                            "value": "[parameters('allowProjectManagement')]"
+                          },
+                          "customSubDomainName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "networkAcls": {
+                            "value": {
+                              "defaultAction": "[parameters('networkAclsDefaultAction')]",
+                              "virtualNetworkRules": [],
+                              "ipRules": []
+                            }
+                          },
+                          "publicNetworkAccess": {
+                            "value": "[parameters('publicNetworkAccess')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[parameters('diagnosticSettings')]"
+                          },
+                          "deployments": {
+                            "value": []
+                          },
+                          "roleAssignments": {
+                            "value": "[parameters('roleAssignments')]"
+                          },
+                          "privateEndpoints": {
+                            "value": []
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "8642151282041103672"
+                            },
+                            "name": "Cognitive Services",
+                            "description": "This module deploys a Cognitive Service."
+                          },
+                          "definitions": {
+                            "privateEndpointOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The group Id for the private endpoint Group."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "FQDN that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses of the private endpoint."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the private endpoint output."
+                              }
+                            },
+                            "deploymentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of cognitive service account deployment."
+                                  }
+                                },
+                                "model": {
+                                  "type": "object",
+                                  "properties": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of Cognitive Services account deployment model."
+                                      }
+                                    },
+                                    "format": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The format of Cognitive Services account deployment model."
+                                      }
+                                    },
+                                    "version": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. The version of Cognitive Services account deployment model. Required if the model does not have a default version."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of Cognitive Services account deployment model."
+                                  }
+                                },
+                                "sku": {
+                                  "type": "object",
+                                  "properties": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the resource model definition representing SKU."
+                                      }
+                                    },
+                                    "capacity": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The capacity of the resource model definition representing SKU."
+                                      }
+                                    },
+                                    "tier": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The tier of the resource model definition representing SKU."
+                                      }
+                                    },
+                                    "size": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The size of the resource model definition representing SKU."
+                                      }
+                                    },
+                                    "family": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The family of the resource model definition representing SKU."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource model definition representing SKU."
+                                  }
+                                },
+                                "raiPolicyName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of RAI policy."
+                                  }
+                                },
+                                "versionUpgradeOption": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The version upgrade option."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cognitive services account deployment."
+                              }
+                            },
+                            "endpointType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Type of the endpoint."
+                                  }
+                                },
+                                "endpoint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The endpoint URI."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cognitive services account endpoint."
+                              }
+                            },
+                            "secretsExportConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
+                                  }
+                                },
+                                "accessKey1Name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name for the accessKey1 secret to create."
+                                  }
+                                },
+                                "accessKey2Name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name for the accessKey2 secret to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of the secrets exported to the provided Key Vault."
+                              }
+                            },
+                            "commitmentPlanType": {
+                              "type": "object",
+                              "properties": {
+                                "autoRenew": {
+                                  "type": "bool",
+                                  "metadata": {
+                                    "description": "Required. Whether the plan should auto-renew at the end of the current commitment period."
+                                  }
+                                },
+                                "current": {
+                                  "type": "object",
+                                  "properties": {
+                                    "count": {
+                                      "type": "int",
+                                      "metadata": {
+                                        "description": "Required. The number of committed instances (e.g., number of containers or cores)."
+                                      }
+                                    },
+                                    "tier": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The tier of the commitment plan (e.g., T1, T2)."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The current commitment configuration."
+                                  }
+                                },
+                                "hostingModel": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The hosting model for the commitment plan. (e.g., DisconnectedContainer, ConnectedContainer, ProvisionedWeb, Web)."
+                                  }
+                                },
+                                "planType": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The plan type indicating which capability the plan applies to (e.g., NTTS, STT, CUSTOMSTT, ADDON)."
+                                  }
+                                },
+                                "commitmentPlanGuid": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The unique identifier of an existing commitment plan to update. Set to null to create a new plan."
+                                  }
+                                },
+                                "next": {
+                                  "type": "object",
+                                  "properties": {
+                                    "count": {
+                                      "type": "int",
+                                      "metadata": {
+                                        "description": "Required. The number of committed instances for the next period."
+                                      }
+                                    },
+                                    "tier": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The tier for the next commitment period."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The configuration of the next commitment period, if scheduled."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a disconnected container commitment plan."
+                              }
+                            },
+                            "networkInjectionType": {
+                              "type": "object",
+                              "properties": {
+                                "scenario": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "agent",
+                                    "none"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The scenario for the network injection."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The Resource ID of the subnet on the Virtual Network on which to inject."
+                                  }
+                                },
+                                "useMicrosoftManagedNetwork": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether to use Microsoft Managed Network. Defaults to false."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "Type for network configuration in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network."
+                              }
+                            },
+                            "_1.secretSetOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "secretResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resourceId of the exported secret."
+                                  }
+                                },
+                                "secretUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI of the exported secret."
+                                  }
+                                },
+                                "secretUriWithVersion": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI with version of the exported secret."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "_2.lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_2.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_2.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_2.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_2.roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "customerManagedKeyType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                  }
+                                },
+                                "keyName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the customer managed key to use for encryption."
+                                  }
+                                },
+                                "keyVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, the deployment will use the latest version available at deployment time."
+                                  }
+                                },
+                                "userAssignedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type does not support auto-rotation of the customer-managed key.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "privateEndpointSingleServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private Endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the Private Endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_2.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_2.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_2.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/_2.lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_2.roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "secretsOutputType": {
+                              "type": "object",
+                              "properties": {},
+                              "additionalProperties": {
+                                "$ref": "#/definitions/_1.secretSetOutputType",
+                                "metadata": {
+                                  "description": "An exported secret's references."
+                                }
+                              },
+                              "metadata": {
+                                "description": "A map of the exported secrets",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of Cognitive Services account."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "allowedValues": [
+                                "AIServices",
+                                "AnomalyDetector",
+                                "CognitiveServices",
+                                "ComputerVision",
+                                "ContentModerator",
+                                "ContentSafety",
+                                "ConversationalLanguageUnderstanding",
+                                "CustomVision.Prediction",
+                                "CustomVision.Training",
+                                "Face",
+                                "FormRecognizer",
+                                "HealthInsights",
+                                "ImmersiveReader",
+                                "Internal.AllInOne",
+                                "LUIS",
+                                "LUIS.Authoring",
+                                "LanguageAuthoring",
+                                "MetricsAdvisor",
+                                "OpenAI",
+                                "Personalizer",
+                                "QnAMaker.v2",
+                                "SpeechServices",
+                                "TextAnalytics",
+                                "TextTranslation"
+                              ],
+                              "metadata": {
+                                "description": "Required. Kind of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+                              }
+                            },
+                            "sku": {
+                              "type": "string",
+                              "defaultValue": "S0",
+                              "allowedValues": [
+                                "C2",
+                                "C3",
+                                "C4",
+                                "F0",
+                                "F1",
+                                "S",
+                                "S0",
+                                "S1",
+                                "S10",
+                                "S2",
+                                "S3",
+                                "S4",
+                                "S5",
+                                "S6",
+                                "S7",
+                                "S8",
+                                "S9",
+                                "DC0"
+                              ],
+                              "metadata": {
+                                "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+                              }
+                            },
+                            "customSubDomainName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. Subdomain name used for token-based authentication. Required if 'networkAcls' or 'privateEndpoints' are set."
+                              }
+                            },
+                            "networkAcls": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A collection of rules governing the accessibility from specific network locations."
+                              }
+                            },
+                            "networkInjections": {
+                              "$ref": "#/definitions/networkInjectionType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointSingleServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "allowedFqdnList": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of allowed FQDN."
+                              }
+                            },
+                            "apiProperties": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The API properties for special APIs."
+                              }
+                            },
+                            "disableLocalAuth": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons."
+                              }
+                            },
+                            "customerManagedKey": {
+                              "$ref": "#/definitions/customerManagedKeyType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The customer managed key definition."
+                              }
+                            },
+                            "dynamicThrottlingEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The flag to enable dynamic throttling."
+                              }
+                            },
+                            "migrationToken": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource migration token."
+                              }
+                            },
+                            "restore": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Restore a soft-deleted cognitive service at deployment time. Will fail if no such soft-deleted resource exists."
+                              }
+                            },
+                            "restrictOutboundNetworkAccess": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Restrict outbound network access."
+                              }
+                            },
+                            "userOwnedStorage": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.CognitiveServices/accounts@2025-04-01-preview#properties/properties/properties/userOwnedStorage"
+                                },
+                                "description": "Optional. The storage accounts for this resource."
+                              },
+                              "nullable": true
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "deployments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/deploymentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of deployments about cognitive service accounts to create."
+                              }
+                            },
+                            "secretsExportConfiguration": {
+                              "$ref": "#/definitions/secretsExportConfigurationType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                              }
+                            },
+                            "allowProjectManagement": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable project management feature for AI Foundry."
+                              }
+                            },
+                            "commitmentPlans": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/commitmentPlanType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Commitment plans to deploy for the cognitive services account."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]",
+                              "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]",
+                              "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]",
+                              "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]",
+                              "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]",
+                              "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]",
+                              "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]",
+                              "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]",
+                              "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]",
+                              "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]",
+                              "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]",
+                              "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]",
+                              "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]",
+                              "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]",
+                              "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]",
+                              "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]",
+                              "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]",
+                              "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]",
+                              "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
+                              "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]",
+                              "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]",
+                              "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]",
+                              "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]",
+                              "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
+                              "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            },
+                            "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                          },
+                          "resources": {
+                            "cMKKeyVault::cMKKey": {
+                              "condition": "[and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults/keys",
+                              "apiVersion": "2025-05-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                            },
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.cognitiveservices-account.{0}.{1}', replace('0.14.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "cMKKeyVault": {
+                              "condition": "[and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2025-05-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                            },
+                            "cMKUserAssignedIdentity": {
+                              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                              "apiVersion": "2025-01-31-preview",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                            },
+                            "cognitiveService": {
+                              "type": "Microsoft.CognitiveServices/accounts",
+                              "apiVersion": "2025-06-01",
+                              "name": "[parameters('name')]",
+                              "kind": "[parameters('kind')]",
+                              "identity": "[variables('identity')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "sku": {
+                                "name": "[parameters('sku')]"
+                              },
+                              "properties": {
+                                "allowProjectManagement": "[parameters('allowProjectManagement')]",
+                                "customSubDomainName": "[parameters('customSubDomainName')]",
+                                "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
+                                "networkInjections": "[if(not(empty(parameters('networkInjections'))), createArray(createObject('scenario', tryGet(parameters('networkInjections'), 'scenario'), 'subnetArmId', tryGet(parameters('networkInjections'), 'subnetResourceId'), 'useMicrosoftManagedNetwork', coalesce(tryGet(parameters('networkInjections'), 'useMicrosoftManagedNetwork'), false()))), null())]",
+                                "publicNetworkAccess": "[if(not(equals(parameters('publicNetworkAccess'), null())), parameters('publicNetworkAccess'), if(not(empty(parameters('networkAcls'))), 'Enabled', 'Disabled'))]",
+                                "allowedFqdnList": "[parameters('allowedFqdnList')]",
+                                "apiProperties": "[parameters('apiProperties')]",
+                                "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                                "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keySource', 'Microsoft.KeyVault', 'keyVaultProperties', createObject('identityClientId', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyVaultUri', if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault').vaultUri, format('https://{0}.managedhsm.azure.net/', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')))), 'keyName', parameters('customerManagedKey').keyName, 'keyVersion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(not(variables('isHSMManagedCMK')), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/')), fail('Managed HSM CMK encryption requires specifying the ''keyVersion''.'))))), null())]",
+                                "migrationToken": "[parameters('migrationToken')]",
+                                "restore": "[parameters('restore')]",
+                                "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]",
+                                "userOwnedStorage": "[if(not(empty(parameters('userOwnedStorage'))), parameters('userOwnedStorage'), null())]",
+                                "dynamicThrottlingEnabled": "[parameters('dynamicThrottlingEnabled')]"
+                              },
+                              "dependsOn": [
+                                "cMKKeyVault",
+                                "cMKKeyVault::cMKKey",
+                                "cMKUserAssignedIdentity"
+                              ]
+                            },
+                            "cognitiveService_deployments": {
+                              "copy": {
+                                "name": "cognitiveService_deployments",
+                                "count": "[length(coalesce(parameters('deployments'), createArray()))]",
+                                "mode": "serial",
+                                "batchSize": 1
+                              },
+                              "type": "Microsoft.CognitiveServices/accounts/deployments",
+                              "apiVersion": "2025-06-01",
+                              "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]",
+                              "properties": {
+                                "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]",
+                                "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]",
+                                "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]"
+                              },
+                              "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', tryGet(parameters('sku'), 'capacity'), 'tier', tryGet(parameters('sku'), 'tier'), 'size', tryGet(parameters('sku'), 'size'), 'family', tryGet(parameters('sku'), 'family')))]",
+                              "dependsOn": [
+                                "cognitiveService"
+                              ]
+                            },
+                            "cognitiveService_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "cognitiveService"
+                              ]
+                            },
+                            "cognitiveService_commitmentPlans": {
+                              "copy": {
+                                "name": "cognitiveService_commitmentPlans",
+                                "count": "[length(coalesce(parameters('commitmentPlans'), createArray()))]"
+                              },
+                              "type": "Microsoft.CognitiveServices/accounts/commitmentPlans",
+                              "apiVersion": "2025-06-01",
+                              "name": "[format('{0}/{1}', parameters('name'), format('{0}-{1}', coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].hostingModel, coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].planType))]",
+                              "properties": "[coalesce(parameters('commitmentPlans'), createArray())[copyIndex()]]",
+                              "dependsOn": [
+                                "cognitiveService"
+                              ]
+                            },
+                            "cognitiveService_diagnosticSettings": {
+                              "copy": {
+                                "name": "cognitiveService_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "cognitiveService"
+                              ]
+                            },
+                            "cognitiveService_roleAssignments": {
+                              "copy": {
+                                "name": "cognitiveService_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "cognitiveService"
+                              ]
+                            },
+                            "cognitiveService_privateEndpoints": {
+                              "copy": {
+                                "name": "cognitiveService_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "16604612898799598358"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.38.5.1644",
+                                              "templateHash": "24141742673128945"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "cognitiveService"
+                              ]
+                            },
+                            "secretsExport": {
+                              "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                              "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "keyVaultName": {
+                                    "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                                  },
+                                  "secretsToSet": {
+                                    "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('cognitiveService', '2025-06-01').key1)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('cognitiveService', '2025-06-01').key2)), createArray()))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "13968722110082077308"
+                                    }
+                                  },
+                                  "definitions": {
+                                    "secretSetOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "secretResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resourceId of the exported secret."
+                                          }
+                                        },
+                                        "secretUri": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI of the exported secret."
+                                          }
+                                        },
+                                        "secretUriWithVersion": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI with version of the exported secret."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "secretToSetType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the secret to set."
+                                          }
+                                        },
+                                        "value": {
+                                          "type": "securestring",
+                                          "metadata": {
+                                            "description": "Required. The value of the secret to set."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "keyVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Key Vault to set the ecrets in."
+                                      }
+                                    },
+                                    "secretsToSet": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/secretToSetType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The secrets to set in the Key Vault."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "keyVault": {
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('keyVaultName')]"
+                                    },
+                                    "secrets": {
+                                      "copy": {
+                                        "name": "secrets",
+                                        "count": "[length(parameters('secretsToSet'))]"
+                                      },
+                                      "type": "Microsoft.KeyVault/vaults/secrets",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                                      "properties": {
+                                        "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "secretsSet": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/secretSetOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The references to the secrets exported to the provided Key Vault."
+                                      },
+                                      "copy": {
+                                        "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                        "input": {
+                                          "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                          "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                                          "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                                        }
+                                      }
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "cognitiveService"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the cognitive services account."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the cognitive services account."
+                              },
+                              "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the cognitive services account was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "endpoint": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The service endpoint of the cognitive services account."
+                              },
+                              "value": "[reference('cognitiveService').endpoint]"
+                            },
+                            "endpoints": {
+                              "$ref": "#/definitions/endpointType",
+                              "metadata": {
+                                "description": "All endpoints available for the cognitive services account, types depends on the cognitive service kind."
+                              },
+                              "value": "[reference('cognitiveService').endpoints]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('cognitiveService', '2025-06-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('cognitiveService', '2025-06-01', 'full').location]"
+                            },
+                            "exportedSecrets": {
+                              "$ref": "#/definitions/secretsOutputType",
+                              "metadata": {
+                                "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                              },
+                              "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the congitive services account."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            },
+                            "primaryKey": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The primary access key."
+                              },
+                              "value": "[if(not(parameters('disableLocalAuth')), listKeys('cognitiveService', '2025-06-01').key1, null())]"
+                            },
+                            "secondaryKey": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The secondary access key."
+                              },
+                              "value": "[if(not(parameters('disableLocalAuth')), listKeys('cognitiveService', '2025-06-01').key2, null())]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Services account."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Services account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the AI Services account (OpenAI Language Model Instance API)."
+                      },
+                      "value": "[reference('aiServices').endpoints['OpenAI Language Model Instance API']]"
+                    },
+                    "cognitiveServicesEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the AI Services account (Cognitive Services)."
+                      },
+                      "value": "[reference('aiServices').endpoint]"
+                    },
+                    "azureOpenAiCuEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure OpenAI Content Understanding endpoint URL."
+                      },
+                      "value": "[reference('aiServices').endpoints['Content Understanding']]"
+                    },
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID of the AI Services account."
+                      },
+                      "value": "[reference('aiServices', '2025-12-01', 'full').identity.principalId]"
+                    },
+                    "projectResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Foundry project."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]"
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Foundry project."
+                      },
+                      "value": "[parameters('projectName')]"
+                    },
+                    "projectEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "AI Foundry project endpoint."
+                      },
+                      "value": "[reference('aiProject').endpoints['AI Foundry API']]"
+                    },
+                    "projectIdentityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID of the project."
+                      },
+                      "value": "[reference('aiProject', '2025-12-01', 'full').identity.principalId]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "log_analytics"
+              ]
+            },
+            "foundry_search_connection": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64)]",
+              "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+              "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "aiServicesAccountName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference('ai_foundry_project').outputs.name.value))]",
+                  "projectName": "[if(variables('useExistingAIProject'), if(greater(length(split(parameters('existingFoundryProjectResourceId'), '/')), 10), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[10]), createObject('value', '')), createObject('value', reference('ai_foundry_project').outputs.projectName.value))]",
+                  "category": {
+                    "value": "CognitiveSearch"
+                  },
+                  "target": {
+                    "value": "[reference('ai_search').outputs.endpoint.value]"
+                  },
+                  "authType": {
+                    "value": "AAD"
+                  },
+                  "metadata": {
+                    "value": {
+                      "ApiType": "Azure",
+                      "ResourceId": "[reference('ai_search').outputs.resourceId.value]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "14116608463414189185"
+                    }
+                  },
+                  "parameters": {
+                    "aiServicesAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the parent AI Services account."
+                      }
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the AI Foundry project."
+                      }
+                    },
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Solution name suffix used to generate the connection name."
+                      }
+                    },
+                    "connectionName": {
+                      "type": "string",
+                      "defaultValue": "[toLower(format('{0}-connection-{1}', parameters('category'), parameters('solutionName')))]",
+                      "metadata": {
+                        "description": "Optional. Connection name. Defaults to lowercase category with solution suffix."
+                      }
+                    },
+                    "category": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Connection category (e.g., CognitiveSearch, AzureBlob, AppInsights, RemoteTool)."
+                      }
+                    },
+                    "target": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Connection target (URL or resource ID)."
+                      }
+                    },
+                    "authType": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Authentication type (e.g., AAD, ApiKey, ProjectManagedIdentity)."
+                      }
+                    },
+                    "isSharedToAll": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether the connection is shared to all project users."
+                      }
+                    },
+                    "isDefault": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether this is the default connection for its category."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Connection metadata object."
+                      }
+                    },
+                    "useWorkspaceManagedIdentity": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to use workspace-managed identity for authentication."
+                      }
+                    },
+                    "credentialsKey": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Credentials key (for ApiKey auth type)."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "baseProperties": {
+                      "category": "[parameters('category')]",
+                      "target": "[parameters('target')]",
+                      "authType": "[parameters('authType')]",
+                      "isSharedToAll": "[parameters('isSharedToAll')]",
+                      "metadata": "[parameters('metadata')]",
+                      "useWorkspaceManagedIdentity": "[parameters('useWorkspaceManagedIdentity')]"
+                    },
+                    "optionalDefault": "[if(parameters('isDefault'), createObject('isDefault', true()), createObject())]",
+                    "optionalCredentials": "[if(not(empty(parameters('credentialsKey'))), createObject('credentials', createObject('key', parameters('credentialsKey'))), createObject())]"
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.CognitiveServices/accounts/projects/connections",
+                      "apiVersion": "2025-12-01",
+                      "name": "[format('{0}/{1}/{2}', parameters('aiServicesAccountName'), parameters('projectName'), parameters('connectionName'))]",
+                      "properties": "[union(variables('baseProperties'), variables('optionalDefault'), variables('optionalCredentials'))]"
+                    }
+                  ],
+                  "outputs": {
+                    "connectionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Connection name."
+                      },
+                      "value": "[parameters('connectionName')]"
+                    },
+                    "connectionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Connection resource ID."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects/connections', parameters('aiServicesAccountName'), parameters('projectName'), parameters('connectionName'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "ai_foundry_project",
+                "ai_search"
+              ]
+            },
+            "model_deployments": {
+              "copy": {
+                "name": "model_deployments",
+                "count": "[length(variables('aiModelDeployments'))]",
+                "mode": "serial",
+                "batchSize": 1
+              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.model-deployment-{0}.{1}', copyIndex(), parameters('solutionName')), 64)]",
+              "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+              "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "aiServicesAccountName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference('ai_foundry_project').outputs.name.value))]",
+                  "deploymentName": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].name]"
+                  },
+                  "modelName": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].model]"
+                  },
+                  "modelVersion": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].version]"
+                  },
+                  "raiPolicyName": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].raiPolicyName]"
+                  },
+                  "skuName": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].sku.name]"
+                  },
+                  "skuCapacity": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].sku.capacity]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "5315493943580072668"
+                    }
+                  },
+                  "parameters": {
+                    "aiServicesAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the parent AI Services account."
+                      }
+                    },
+                    "deploymentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name for this model deployment."
+                      }
+                    },
+                    "modelFormat": {
+                      "type": "string",
+                      "defaultValue": "OpenAI",
+                      "metadata": {
+                        "description": "Optional. Model format (e.g., OpenAI)."
+                      }
+                    },
+                    "modelName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Model name (e.g., gpt-4o, text-embedding-ada-002)."
+                      }
+                    },
+                    "modelVersion": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Model version. Empty string means latest."
+                      }
+                    },
+                    "raiPolicyName": {
+                      "type": "string",
+                      "defaultValue": "Microsoft.Default",
+                      "metadata": {
+                        "description": "Optional. RAI policy name."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. SKU name (e.g., Standard, GlobalStandard)."
+                      }
+                    },
+                    "skuCapacity": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Required. SKU capacity (tokens per minute in thousands)."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.CognitiveServices/accounts/deployments",
+                      "apiVersion": "2025-12-01",
+                      "name": "[format('{0}/{1}', parameters('aiServicesAccountName'), parameters('deploymentName'))]",
+                      "properties": {
+                        "model": {
+                          "format": "[parameters('modelFormat')]",
+                          "name": "[parameters('modelName')]",
+                          "version": "[if(not(empty(parameters('modelVersion'))), parameters('modelVersion'), null())]"
+                        },
+                        "raiPolicyName": "[parameters('raiPolicyName')]"
+                      },
+                      "sku": {
+                        "name": "[parameters('skuName')]",
+                        "capacity": "[parameters('skuCapacity')]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the deployed model."
+                      },
+                      "value": "[parameters('deploymentName')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the model deployment."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts/deployments', parameters('aiServicesAccountName'), parameters('deploymentName'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "ai_foundry_project"
+              ]
+            },
+            "aifoundry_private_endpoint": {
+              "condition": "[and(not(variables('useExistingAIProject')), parameters('enablePrivateNetworking'))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.pe-ai-foundry.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[format('pep-aif-{0}', variables('solutionSuffix'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "subnetResourceId": {
+                    "value": "[reference('virtualNetwork').outputs.backendSubnetResourceId.value]"
+                  },
+                  "customNetworkInterfaceName": {
+                    "value": "[format('nic-aif-{0}', variables('solutionSuffix'))]"
+                  },
+                  "privateLinkServiceConnections": {
+                    "value": [
+                      {
+                        "name": "[format('pep-aif-{0}-connection', variables('solutionSuffix'))]",
+                        "properties": {
+                          "privateLinkServiceId": "[reference('ai_foundry_project').outputs.resourceId.value]",
+                          "groupIds": [
+                            "account"
+                          ]
+                        }
+                      }
+                    ]
+                  },
+                  "privateDnsZoneGroup": {
+                    "value": {
+                      "privateDnsZoneGroupConfigs": [
+                        {
+                          "name": "ai-services-dns-zone-cognitiveservices",
+                          "privateDnsZoneResourceId": "[reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').cognitiveServices)).outputs.resourceId.value]"
+                        },
+                        {
+                          "name": "ai-services-dns-zone-openai",
+                          "privateDnsZoneResourceId": "[reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').openAI)).outputs.resourceId.value]"
+                        },
+                        {
+                          "name": "ai-services-dns-zone-aiservices",
+                          "privateDnsZoneResourceId": "[reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').aiServices)).outputs.resourceId.value]"
+                        }
+                      ]
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "14933983914799613850"
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the private endpoint."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "customNetworkInterfaceName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Custom NIC name for the private endpoint."
+                      }
+                    },
+                    "subnetResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the subnet for the private endpoint."
+                      }
+                    },
+                    "privateLinkServiceConnections": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "Private link service connections configuration."
+                      }
+                    },
+                    "privateDnsZoneGroup": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Private DNS zone group configuration."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "privateEndpoint": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.network.private-endpoint.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "customNetworkInterfaceName": "[if(not(empty(parameters('customNetworkInterfaceName'))), createObject('value', parameters('customNetworkInterfaceName')), createObject('value', format('nic-{0}', parameters('name'))))]",
+                          "subnetResourceId": {
+                            "value": "[parameters('subnetResourceId')]"
+                          },
+                          "privateLinkServiceConnections": {
+                            "value": "[parameters('privateLinkServiceConnections')]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[parameters('privateDnsZoneGroup')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "18436885663402767850"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a private dns zone group."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a private DNS zone group configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                },
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              },
+                              "nullable": true
+                            },
+                            "ipVersionType": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                },
+                                "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                              },
+                              "defaultValue": "IPv4"
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              },
+                              "nullable": true
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                },
+                                "description": "Optional. Custom DNS configurations."
+                              },
+                              "nullable": true
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                },
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                },
+                                "ipVersionType": "[parameters('ipVersionType')]"
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "9935179114830442414"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private DNS zone group configuration."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "privateDnsZoneConfigs",
+                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "input": {
+                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "properties": {
+                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                              }
+                                            }
+                                          }
+                                        ]
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                  "output": true
+                                },
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the private endpoint."
+                      },
+                      "value": "[reference('privateEndpoint').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the private endpoint."
+                      },
+                      "value": "[reference('privateEndpoint').outputs.name.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "ai_foundry_project",
+                "foundry_search_connection",
+                "model_deployments",
+                "privateDnsZoneDeployments",
+                "virtualNetwork"
+              ]
+            },
+            "ai_search": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.ai-search.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "skuName": {
+                    "value": "standard"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "publicNetworkAccess": {
+                    "value": "Enabled"
+                  },
+                  "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+                  "roleAssignments": {
+                    "value": [
+                      {
+                        "roleDefinitionIdOrName": "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
+                        "principalId": "[variables('deployingUserPrincipalId')]",
+                        "principalType": "[parameters('deployingUserPrincipalType')]"
+                      },
+                      {
+                        "roleDefinitionIdOrName": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
+                        "principalId": "[variables('deployingUserPrincipalId')]",
+                        "principalType": "[parameters('deployingUserPrincipalType')]"
+                      }
+                    ]
+                  },
+                  "privateEndpoints": {
+                    "value": []
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "8867387679090698118"
+                    }
+                  },
+                  "definitions": {
+                    "_1.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_1.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "minLength": 3,
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('srch-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the search service. Defaults to srch-{solutionName}."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "basic",
+                      "allowedValues": [
+                        "free",
+                        "basic",
+                        "standard",
+                        "standard2",
+                        "standard3",
+                        "storage_optimized_l1",
+                        "storage_optimized_l2"
+                      ],
+                      "metadata": {
+                        "description": "SKU name for the search service."
+                      }
+                    },
+                    "replicaCount": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Number of replicas."
+                      }
+                    },
+                    "partitionCount": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Number of partitions."
+                      }
+                    },
+                    "hostingMode": {
+                      "type": "string",
+                      "defaultValue": "Default",
+                      "allowedValues": [
+                        "Default",
+                        "HighDensity"
+                      ],
+                      "metadata": {
+                        "description": "Hosting mode."
+                      }
+                    },
+                    "semanticSearch": {
+                      "type": "string",
+                      "defaultValue": "free",
+                      "allowedValues": [
+                        "disabled",
+                        "free",
+                        "standard"
+                      ],
+                      "metadata": {
+                        "description": "Semantic search tier."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Whether to disable local authentication."
+                      }
+                    },
+                    "authOptions": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Authentication options for the search service (e.g., aadOrApiKey)."
+                      }
+                    },
+                    "networkRuleSet": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Network rule set for the search service (e.g., bypass: AzureServices)."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Diagnostic settings for monitoring."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create on the AI Search service."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "searchService": {
+                      "type": "Microsoft.Search/searchServices",
+                      "apiVersion": "2025-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]"
+                      }
+                    },
+                    "searchServiceUpdate": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.search.update.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "sku": {
+                            "value": "[parameters('skuName')]"
+                          },
+                          "replicaCount": {
+                            "value": "[parameters('replicaCount')]"
+                          },
+                          "partitionCount": {
+                            "value": "[parameters('partitionCount')]"
+                          },
+                          "hostingMode": {
+                            "value": "[parameters('hostingMode')]"
+                          },
+                          "semanticSearch": {
+                            "value": "[parameters('semanticSearch')]"
+                          },
+                          "authOptions": "[if(not(empty(parameters('authOptions'))), createObject('value', parameters('authOptions')), createObject('value', null()))]",
+                          "disableLocalAuth": {
+                            "value": "[parameters('disableLocalAuth')]"
+                          },
+                          "networkRuleSet": "[if(not(empty(parameters('networkRuleSet'))), createObject('value', parameters('networkRuleSet')), createObject('value', null()))]",
+                          "publicNetworkAccess": {
+                            "value": "[parameters('publicNetworkAccess')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          },
+                          "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]",
+                          "privateEndpoints": {
+                            "value": "[parameters('privateEndpoints')]"
+                          },
+                          "roleAssignments": "[if(not(empty(parameters('roleAssignments'))), createObject('value', parameters('roleAssignments')), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "6207719545398489494"
+                            },
+                            "name": "Search Services",
+                            "description": "This module deploys a Search Service."
+                          },
+                          "definitions": {
+                            "privateEndpointOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The group Id for the private endpoint Group."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "FQDN that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses of the private endpoint."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "secretsExportConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The key vault name where to store the API Admin keys generated by the modules."
+                                  }
+                                },
+                                "primaryAdminKeyName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The primaryAdminKey secret name to create."
+                                  }
+                                },
+                                "secondaryAdminKeyName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The secondaryAdminKey secret name to create."
+                                  }
+                                }
+                              }
+                            },
+                            "secretsOutputType": {
+                              "type": "object",
+                              "properties": {},
+                              "additionalProperties": {
+                                "$ref": "#/definitions/secretSetType",
+                                "metadata": {
+                                  "description": "An exported secret's references."
+                                }
+                              }
+                            },
+                            "_1.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "privateEndpointSingleServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private Endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the Private Endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "secretSetType": {
+                              "type": "object",
+                              "properties": {
+                                "secretResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resourceId of the exported secret."
+                                  }
+                                },
+                                "secretUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI of the exported secret."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "modules/keyVaultExport.bicep"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Azure Cognitive Search service to create or update. Search service names must only contain lowercase letters, digits or dashes, cannot use dash as the first two or last one characters, cannot contain consecutive dashes, and must be between 2 and 60 characters in length. Search service names must be globally unique since they are part of the service URI (https://<name>.search.windows.net). You cannot change the service name after the service is created."
+                              }
+                            },
+                            "authOptions": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Search/searchServices@2025-05-01#properties/properties/properties/authOptions"
+                                },
+                                "description": "Optional. Defines the options for how the data plane API of a Search service authenticates requests. Must remain an empty object {} if 'disableLocalAuth' is set to true."
+                              },
+                              "nullable": true
+                            },
+                            "disableLocalAuth": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. When set to true, calls to the search service will not be permitted to utilize API keys for authentication. This cannot be set to true if 'authOptions' are defined."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "computeType": {
+                              "type": "string",
+                              "defaultValue": "Default",
+                              "allowedValues": [
+                                "Confidential",
+                                "Default"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The compute type of the search service."
+                              }
+                            },
+                            "cmkEnforcement": {
+                              "type": "string",
+                              "defaultValue": "Unspecified",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled",
+                                "Unspecified"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Describes a policy that determines how resources within the search service are to be encrypted with Customer Managed Keys."
+                              }
+                            },
+                            "dataExfiltrationProtections": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "allowedValues": [
+                                "All"
+                              ],
+                              "metadata": {
+                                "description": "Optional. A list of data exfiltration scenarios that are explicitly disallowed for the search service. Currently, the only supported value is 'All' to disable all possible data export scenarios with more fine grained controls planned for the future."
+                              }
+                            },
+                            "hostingMode": {
+                              "type": "string",
+                              "defaultValue": "Default",
+                              "allowedValues": [
+                                "Default",
+                                "HighDensity"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Applicable only for the standard3 SKU. You can set this property to enable up to 3 high density partitions that allow up to 1000 indexes, which is much higher than the maximum indexes allowed for any other SKU. For the standard3 SKU, the value is either 'default' or 'highDensity'. For all other SKUs, this value must be 'default'."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings for all Resources in the solution."
+                              }
+                            },
+                            "networkRuleSet": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Search/searchServices@2025-05-01#properties/properties/properties/networkRuleSet"
+                                },
+                                "description": "Optional. Network specific rules that determine how the Azure Cognitive Search service may be reached."
+                              },
+                              "nullable": true
+                            },
+                            "partitionCount": {
+                              "type": "int",
+                              "defaultValue": 1,
+                              "minValue": 1,
+                              "maxValue": 12,
+                              "metadata": {
+                                "description": "Optional. The number of partitions in the search service; if specified, it can be 1, 2, 3, 4, 6, or 12. Values greater than 1 are only valid for standard SKUs. For 'standard3' services with hostingMode set to 'highDensity', the allowed values are between 1 and 3."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointSingleServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                              }
+                            },
+                            "sharedPrivateLinkResources": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. The sharedPrivateLinkResources to create as part of the search Service."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. This value can be set to 'Enabled' to avoid breaking changes on existing customer resources and templates. If set to 'Disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method."
+                              }
+                            },
+                            "secretsExportConfiguration": {
+                              "$ref": "#/definitions/secretsExportConfigurationType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                              }
+                            },
+                            "replicaCount": {
+                              "type": "int",
+                              "defaultValue": 3,
+                              "minValue": 1,
+                              "maxValue": 12,
+                              "metadata": {
+                                "description": "Optional. The number of replicas in the search service. If specified, it must be a value between 1 and 12 inclusive for standard SKUs or between 1 and 3 inclusive for basic SKU."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "semanticSearch": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "disabled",
+                                "free",
+                                "standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Sets options that control the availability of semantic search. This configuration is only possible for certain search SKUs in certain locations."
+                              }
+                            },
+                            "sku": {
+                              "type": "string",
+                              "defaultValue": "standard",
+                              "allowedValues": [
+                                "basic",
+                                "free",
+                                "standard",
+                                "standard2",
+                                "standard3",
+                                "storage_optimized_l1",
+                                "storage_optimized_l2"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Defines the SKU of an Azure Cognitive Search Service, which determines price tier and capacity limits."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Search/searchServices@2025-05-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to help categorize the resource in the Azure portal."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', '')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "Search Index Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]",
+                              "Search Index Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1407120a-92aa-4202-b7e9-c0e197c71c8f')]",
+                              "Search Service Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.search-searchservice.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "searchService": {
+                              "type": "Microsoft.Search/searchServices",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "sku": {
+                                "name": "[parameters('sku')]"
+                              },
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "properties": {
+                                "authOptions": "[parameters('authOptions')]",
+                                "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                                "encryptionWithCmk": {
+                                  "enforcement": "[parameters('cmkEnforcement')]"
+                                },
+                                "hostingMode": "[parameters('hostingMode')]",
+                                "networkRuleSet": "[parameters('networkRuleSet')]",
+                                "partitionCount": "[parameters('partitionCount')]",
+                                "replicaCount": "[parameters('replicaCount')]",
+                                "publicNetworkAccess": "[toLower(parameters('publicNetworkAccess'))]",
+                                "semanticSearch": "[parameters('semanticSearch')]",
+                                "computeType": "[parameters('computeType')]",
+                                "dataExfiltrationProtections": "[parameters('dataExfiltrationProtections')]"
+                              }
+                            },
+                            "searchService_diagnosticSettings": {
+                              "copy": {
+                                "name": "searchService_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "searchService"
+                              ]
+                            },
+                            "searchService_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "searchService"
+                              ]
+                            },
+                            "searchService_roleAssignments": {
+                              "copy": {
+                                "name": "searchService_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Search/searchServices', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "searchService"
+                              ]
+                            },
+                            "searchService_privateEndpoints": {
+                              "copy": {
+                                "name": "searchService_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-searchService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "16604612898799598358"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.38.5.1644",
+                                              "templateHash": "24141742673128945"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "searchService"
+                              ]
+                            },
+                            "searchService_sharedPrivateLinkResources": {
+                              "copy": {
+                                "name": "searchService_sharedPrivateLinkResources",
+                                "count": "[length(parameters('sharedPrivateLinkResources'))]",
+                                "mode": "serial",
+                                "batchSize": 1
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-searchService-SharedPrvLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'name'), format('spl-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), parameters('sharedPrivateLinkResources')[copyIndex()].groupId, copyIndex()))]"
+                                  },
+                                  "searchServiceName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateLinkResourceId": {
+                                    "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].privateLinkResourceId]"
+                                  },
+                                  "groupId": {
+                                    "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].groupId]"
+                                  },
+                                  "requestMessage": {
+                                    "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].requestMessage]"
+                                  },
+                                  "resourceRegion": {
+                                    "value": "[tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'resourceRegion')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "2115224445601868607"
+                                    },
+                                    "name": "Search Services Private Link Resources",
+                                    "description": "This module deploys a Search Service Private Link Resource."
+                                  },
+                                  "parameters": {
+                                    "searchServiceName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent searchServices. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the shared private link resource managed by the Azure Cognitive Search service within the specified resource group."
+                                      }
+                                    },
+                                    "privateLinkResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the resource the shared private link resource is for."
+                                      }
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The group ID from the provider of resource the shared private link resource is for."
+                                      }
+                                    },
+                                    "requestMessage": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The request message for requesting approval of the shared private link resource."
+                                      }
+                                    },
+                                    "resourceRegion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Can be used to specify the Azure Resource Manager location of the resource to which a shared private link is to be created. This is only required for those resources whose DNS configuration are regional (such as Azure Kubernetes Service)."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "searchService": {
+                                      "existing": true,
+                                      "type": "Microsoft.Search/searchServices",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('searchServiceName')]"
+                                    },
+                                    "sharedPrivateLinkResource": {
+                                      "type": "Microsoft.Search/searchServices/sharedPrivateLinkResources",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[format('{0}/{1}', parameters('searchServiceName'), parameters('name'))]",
+                                      "properties": {
+                                        "privateLinkResourceId": "[parameters('privateLinkResourceId')]",
+                                        "groupId": "[parameters('groupId')]",
+                                        "requestMessage": "[parameters('requestMessage')]",
+                                        "resourceRegion": "[parameters('resourceRegion')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the shared private link resource."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the shared private link resource."
+                                      },
+                                      "value": "[resourceId('Microsoft.Search/searchServices/sharedPrivateLinkResources', parameters('searchServiceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the shared private link resource was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "searchService"
+                              ]
+                            },
+                            "secretsExport": {
+                              "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                              "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "keyVaultName": {
+                                    "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                                  },
+                                  "secretsToSet": {
+                                    "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-05-01').primaryKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-05-01').secondaryKey)), createArray()))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "696453183181258843"
+                                    }
+                                  },
+                                  "definitions": {
+                                    "secretSetType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "secretResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resourceId of the exported secret."
+                                          }
+                                        },
+                                        "secretUri": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI of the exported secret."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "secretToSetType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the secret to set."
+                                          }
+                                        },
+                                        "value": {
+                                          "type": "securestring",
+                                          "metadata": {
+                                            "description": "Required. The value of the secret to set."
+                                          }
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "keyVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Key Vault to set the ecrets in."
+                                      }
+                                    },
+                                    "secretsToSet": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/secretToSetType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The secrets to set in the Key Vault."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "keyVault": {
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('keyVaultName')]"
+                                    },
+                                    "secrets": {
+                                      "copy": {
+                                        "name": "secrets",
+                                        "count": "[length(parameters('secretsToSet'))]"
+                                      },
+                                      "type": "Microsoft.KeyVault/vaults/secrets",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                                      "properties": {
+                                        "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "secretsSet": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/secretSetType"
+                                      },
+                                      "metadata": {
+                                        "description": "The references to the secrets exported to the provided Key Vault."
+                                      },
+                                      "copy": {
+                                        "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                        "input": {
+                                          "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                          "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]"
+                                        }
+                                      }
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "searchService"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the search service."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the search service."
+                              },
+                              "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the search service was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('searchService', '2025-05-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('searchService', '2025-05-01', 'full').location]"
+                            },
+                            "endpoint": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The endpoint of the search service."
+                              },
+                              "value": "[reference('searchService').endpoint]"
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the search service."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            },
+                            "exportedSecrets": {
+                              "$ref": "#/definitions/secretsOutputType",
+                              "metadata": {
+                                "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                              },
+                              "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                            },
+                            "primaryKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The primary admin API key of the search service."
+                              },
+                              "value": "[listAdminKeys('searchService', '2025-05-01').primaryKey]"
+                            },
+                            "secondaryKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The secondaryKey admin API key of the search service."
+                              },
+                              "value": "[listAdminKeys('searchService', '2025-05-01').secondaryKey]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "searchService"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Search service."
+                      },
+                      "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Search service."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint URL of the AI Search service."
+                      },
+                      "value": "[format('https://{0}.search.windows.net', parameters('name'))]"
+                    },
+                    "identityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(reference('searchServiceUpdate').outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "log_analytics"
+              ]
+            },
+            "storage_account": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.storage-account.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableHierarchicalNamespace": {
+                    "value": true
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                  "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+                  "containers": {
+                    "value": [
+                      {
+                        "name": "data",
+                        "publicAccess": "None"
+                      }
+                    ]
+                  },
+                  "roleAssignments": {
+                    "value": [
+                      {
+                        "roleDefinitionIdOrName": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
+                        "principalId": "[variables('deployingUserPrincipalId')]",
+                        "principalType": "[parameters('deployingUserPrincipalType')]"
+                      }
+                    ]
+                  },
+                  "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-blob-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-blob-{0}', variables('solutionSuffix')), 'service', 'blob', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageBlob)).outputs.resourceId.value)))), createObject('name', format('pep-queue-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-queue-{0}', variables('solutionSuffix')), 'service', 'queue', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageQueue)).outputs.resourceId.value)))), createObject('name', format('pep-file-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-file-{0}', variables('solutionSuffix')), 'service', 'file', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageFile)).outputs.resourceId.value)))), createObject('name', format('pep-dfs-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-dfs-{0}', variables('solutionSuffix')), 'service', 'dfs', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageDfs)).outputs.resourceId.value)))))), createObject('value', createArray()))]",
+                  "networkAcls": {
+                    "value": {
+                      "bypass": "AzureServices, Logging, Metrics",
+                      "defaultAction": "[if(parameters('enablePrivateNetworking'), 'Deny', 'Allow')]",
+                      "virtualNetworkRules": []
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "13916396394410274337"
+                    }
+                  },
+                  "definitions": {
+                    "_1.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_1.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[take(format('st{0}', toLower(replace(parameters('solutionName'), '-', ''))), 24)]",
+                      "metadata": {
+                        "description": "Name of the storage account."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "Standard_LRS",
+                      "metadata": {
+                        "description": "Storage account SKU."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "StorageV2",
+                      "metadata": {
+                        "description": "Storage account kind."
+                      }
+                    },
+                    "accessTier": {
+                      "type": "string",
+                      "defaultValue": "Hot",
+                      "allowedValues": [
+                        "Hot",
+                        "Cool"
+                      ],
+                      "metadata": {
+                        "description": "Access tier."
+                      }
+                    },
+                    "allowBlobPublicAccess": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Allow blob public access."
+                      }
+                    },
+                    "allowSharedKeyAccess": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Allow shared key access."
+                      }
+                    },
+                    "enableHierarchicalNamespace": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable hierarchical namespace (Data Lake Storage Gen2)."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "containers": {
+                      "type": "array",
+                      "defaultValue": [
+                        {
+                          "name": "default",
+                          "publicAccess": "None"
+                        }
+                      ],
+                      "metadata": {
+                        "description": "Blob containers to create."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Diagnostic settings for monitoring."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    },
+                    "networkAcls": {
+                      "type": "object",
+                      "defaultValue": {
+                        "defaultAction": "Allow",
+                        "bypass": "AzureServices"
+                      },
+                      "metadata": {
+                        "description": "Network ACLs for the storage account."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create on the Storage Account."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "storage": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.storage.storage-account.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "skuName": {
+                            "value": "[parameters('skuName')]"
+                          },
+                          "kind": {
+                            "value": "[parameters('kind')]"
+                          },
+                          "accessTier": {
+                            "value": "[parameters('accessTier')]"
+                          },
+                          "allowBlobPublicAccess": {
+                            "value": "[parameters('allowBlobPublicAccess')]"
+                          },
+                          "allowSharedKeyAccess": {
+                            "value": "[parameters('allowSharedKeyAccess')]"
+                          },
+                          "enableHierarchicalNamespace": {
+                            "value": "[parameters('enableHierarchicalNamespace')]"
+                          },
+                          "minimumTlsVersion": {
+                            "value": "TLS1_2"
+                          },
+                          "supportsHttpsTrafficOnly": {
+                            "value": true
+                          },
+                          "requireInfrastructureEncryption": {
+                            "value": true
+                          },
+                          "publicNetworkAccess": {
+                            "value": "[parameters('publicNetworkAccess')]"
+                          },
+                          "networkAcls": {
+                            "value": "[parameters('networkAcls')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          },
+                          "blobServices": {
+                            "value": {
+                              "copy": [
+                                {
+                                  "name": "containers",
+                                  "count": "[length(parameters('containers'))]",
+                                  "input": {
+                                    "name": "[parameters('containers')[copyIndex('containers')].name]",
+                                    "publicAccess": "[parameters('containers')[copyIndex('containers')].publicAccess]"
+                                  }
+                                }
+                              ],
+                              "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), parameters('diagnosticSettings'), createArray())]"
+                            }
+                          },
+                          "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]",
+                          "privateEndpoints": {
+                            "value": "[parameters('privateEndpoints')]"
+                          },
+                          "roleAssignments": "[if(not(empty(parameters('roleAssignments'))), createObject('value', parameters('roleAssignments')), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.41.2.15936",
+                              "templateHash": "1254456195180100771"
+                            },
+                            "name": "Storage Accounts",
+                            "description": "This module deploys a Storage Account."
+                          },
+                          "definitions": {
+                            "privateEndpointOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The group Id for the private endpoint Group."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "FQDN that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses of the private endpoint."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the private endpoints output."
+                              }
+                            },
+                            "networkAclsType": {
+                              "type": "object",
+                              "properties": {
+                                "resourceAccessRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "tenantId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The ID of the tenant in which the resource resides in."
+                                        }
+                                      },
+                                      "resourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only."
+                                  }
+                                },
+                                "bypass": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureServices",
+                                    "AzureServices, Logging",
+                                    "AzureServices, Logging, Metrics",
+                                    "AzureServices, Metrics",
+                                    "Logging",
+                                    "Logging, Metrics",
+                                    "Metrics",
+                                    "None"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics."
+                                  }
+                                },
+                                "virtualNetworkRules": {
+                                  "type": "array",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Sets the virtual network rules."
+                                  }
+                                },
+                                "ipRules": {
+                                  "type": "array",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Sets the IP ACL rules."
+                                  }
+                                },
+                                "defaultAction": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Allow",
+                                    "Deny"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the default action of allow or deny when no other rules match."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the network configuration."
+                              }
+                            },
+                            "secretsExportConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
+                                  }
+                                },
+                                "accessKey1Name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The accessKey1 secret name to create."
+                                  }
+                                },
+                                "connectionString1Name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The connectionString1 secret name to create."
+                                  }
+                                },
+                                "accessKey2Name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The accessKey2 secret name to create."
+                                  }
+                                },
+                                "connectionString2Name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The connectionString2 secret name to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of the exported secrets."
+                              }
+                            },
+                            "localUserType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the local user used for SFTP Authentication."
+                                  }
+                                },
+                                "hasSharedKey": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
+                                  }
+                                },
+                                "hasSshKey": {
+                                  "type": "bool",
+                                  "metadata": {
+                                    "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                                  }
+                                },
+                                "hasSshPassword": {
+                                  "type": "bool",
+                                  "metadata": {
+                                    "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                                  }
+                                },
+                                "homeDirectory": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The local user home directory."
+                                  }
+                                },
+                                "permissionScopes": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/permissionScopeType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The permission scopes of the local user."
+                                  }
+                                },
+                                "sshAuthorizedKeys": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/sshAuthorizedKeyType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The local user SSH authorized keys for SFTP."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a local user."
+                              }
+                            },
+                            "blobServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "automaticSnapshotPolicyEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Automatic Snapshot is enabled if set to true."
+                                  }
+                                },
+                                "changeFeedEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                                  }
+                                },
+                                "changeFeedRetentionInDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "minValue": 1,
+                                  "maxValue": 146000,
+                                  "metadata": {
+                                    "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
+                                  }
+                                },
+                                "containerDeleteRetentionPolicyEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                                  }
+                                },
+                                "containerDeleteRetentionPolicyDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "minValue": 1,
+                                  "maxValue": 365,
+                                  "metadata": {
+                                    "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                                  }
+                                },
+                                "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                                  }
+                                },
+                                "corsRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/blobCorsRuleType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                  }
+                                },
+                                "defaultServiceVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
+                                  }
+                                },
+                                "deleteRetentionPolicyEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The blob service properties for blob soft delete."
+                                  }
+                                },
+                                "deleteRetentionPolicyDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "minValue": 1,
+                                  "maxValue": 365,
+                                  "metadata": {
+                                    "description": "Optional. Indicates the number of days that the deleted blob should be retained."
+                                  }
+                                },
+                                "deleteRetentionPolicyAllowPermanentDelete": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                                  }
+                                },
+                                "isVersioningEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
+                                  }
+                                },
+                                "versionDeletePolicyDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Number of days to keep a version before deleting. If set, a lifecycle management policy will be created to handle deleting previous versions."
+                                  }
+                                },
+                                "lastAccessTimeTrackingPolicyEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                                  }
+                                },
+                                "restorePolicyEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                                  }
+                                },
+                                "restorePolicyDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "minValue": 1,
+                                  "metadata": {
+                                    "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                                  }
+                                },
+                                "containers": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/containerType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Blob containers to create."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the service."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a blob service."
+                              }
+                            },
+                            "fileServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "protocolSettings": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings"
+                                    },
+                                    "description": "Optional. Protocol settings for file service."
+                                  },
+                                  "nullable": true
+                                },
+                                "shareDeleteRetentionPolicy": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy"
+                                    },
+                                    "description": "Optional. The service properties for soft delete."
+                                  },
+                                  "nullable": true
+                                },
+                                "shares": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/fileShareType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. File shares to create."
+                                  }
+                                },
+                                "corsRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/fileCorsRuleType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the service."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a file service."
+                              }
+                            },
+                            "queueServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "queues": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/queueType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Queues to create."
+                                  }
+                                },
+                                "corsRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/queueCorsRuleType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the service."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a queue service."
+                              }
+                            },
+                            "tableServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "tables": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/tableType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Tables to create."
+                                  }
+                                },
+                                "corsRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/tableCorsRuleType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the service."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a table service."
+                              }
+                            },
+                            "objectReplicationPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the object replication policy. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "destinationStorageAccountResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the destination storage account."
+                                  }
+                                },
+                                "enableMetrics": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Indicates whether metrics are enabled for the object replication policy."
+                                  }
+                                },
+                                "rules": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/objectReplicationPolicyRuleType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The storage account object replication rules."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of an object replication policy."
+                              }
+                            },
+                            "_1.immutabilityPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "immutabilityPeriodSinceCreationInDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                  }
+                                },
+                                "allowProtectedAppendWrites": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. Defaults to false."
+                                  }
+                                },
+                                "allowProtectedAppendWritesAll": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for an immutability policy.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "blob-service/container/main.bicep"
+                                }
+                              }
+                            },
+                            "_2.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_2.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_2.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_2.secretSetOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "secretResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resourceId of the exported secret."
+                                  }
+                                },
+                                "secretUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI of the exported secret."
+                                  }
+                                },
+                                "secretUriWithVersion": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI with version of the exported secret."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "blobCorsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a cors rule.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "blob-service/main.bicep",
+                                  "originalIdentifier": "corsRuleType"
+                                }
+                              }
+                            },
+                            "containerType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the Storage Container to deploy."
+                                  }
+                                },
+                                "defaultEncryptionScope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                  }
+                                },
+                                "denyEncryptionScopeOverride": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Block override of encryption scope from the container default."
+                                  }
+                                },
+                                "enableNfsV3AllSquash": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable NFSv3 all squash on blob container."
+                                  }
+                                },
+                                "enableNfsV3RootSquash": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable NFSv3 root squash on blob container."
+                                  }
+                                },
+                                "immutableStorageWithVersioningEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                  }
+                                },
+                                "immutabilityPolicy": {
+                                  "$ref": "#/definitions/_1.immutabilityPolicyType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Configure immutability policy."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. A name-value pair to associate with the container as metadata."
+                                  },
+                                  "nullable": true
+                                },
+                                "publicAccess": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Blob",
+                                    "Container",
+                                    "None"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a storage container.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "blob-service/main.bicep"
+                                }
+                              }
+                            },
+                            "customerManagedKeyWithAutoRotateType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                  }
+                                },
+                                "keyName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the customer managed key to use for encryption."
+                                  }
+                                },
+                                "keyVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                                  }
+                                },
+                                "autoRotationEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                                  }
+                                },
+                                "userAssignedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "diagnosticSettingMetricsOnlyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of diagnostic setting."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "fileCorsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a cors rule.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "file-service/main.bicep",
+                                  "originalIdentifier": "corsRuleType"
+                                }
+                              }
+                            },
+                            "fileShareType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the file share."
+                                  }
+                                },
+                                "accessTier": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Cool",
+                                    "Hot",
+                                    "Premium",
+                                    "TransactionOptimized"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
+                                  }
+                                },
+                                "enabledProtocols": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "NFS",
+                                    "SMB"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
+                                  }
+                                },
+                                "rootSquash": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AllSquash",
+                                    "NoRootSquash",
+                                    "RootSquash"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
+                                  }
+                                },
+                                "shareQuota": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
+                                  }
+                                },
+                                "provisionedBandwidthMibps": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "maxValue": 10340,
+                                  "metadata": {
+                                    "description": "Optional. The provisioned bandwidth of the share, in mebibytes per second. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 10340."
+                                  }
+                                },
+                                "provisionedIops": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "maxValue": 102400,
+                                  "metadata": {
+                                    "description": "Optional. The provisioned IOPS of the share. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 102400."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a file share.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "file-service/main.bicep"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "objectReplicationPolicyRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "ruleId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The ID of the rule. Auto-generated on destination account. Required for source account."
+                                  }
+                                },
+                                "containerName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the source container."
+                                  }
+                                },
+                                "destinationContainerName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the destination container. If not provided, the same name as the source container will be used."
+                                  }
+                                },
+                                "filters": {
+                                  "type": "object",
+                                  "properties": {
+                                    "prefixMatch": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The prefix to match for the replication policy rule."
+                                      }
+                                    },
+                                    "minCreationTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The minimum creation time to match for the replication policy rule."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The filters for the object replication policy rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of an object replication policy rule.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "object-replication-policy/policy/main.bicep"
+                                }
+                              }
+                            },
+                            "permissionScopeType": {
+                              "type": "object",
+                              "properties": {
+                                "permissions": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
+                                  }
+                                },
+                                "resourceName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The service used by the local user, e.g. blob, file."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "local-user/main.bicep"
+                                }
+                              }
+                            },
+                            "privateEndpointMultiServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the private endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_2.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_2.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_2.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "queueCorsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a cors rule.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "queue-service/main.bicep",
+                                  "originalIdentifier": "corsRuleType"
+                                }
+                              }
+                            },
+                            "queueType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the queue."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. Metadata to set on the queue."
+                                  },
+                                  "nullable": true
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a queue.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "queue-service/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "secretsOutputType": {
+                              "type": "object",
+                              "properties": {},
+                              "additionalProperties": {
+                                "$ref": "#/definitions/_2.secretSetOutputType",
+                                "metadata": {
+                                  "description": "An exported secret's references."
+                                }
+                              },
+                              "metadata": {
+                                "description": "A map of the exported secrets",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "sshAuthorizedKeyType": {
+                              "type": "object",
+                              "properties": {
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description used to store the function/usage of the key."
+                                  }
+                                },
+                                "key": {
+                                  "type": "securestring",
+                                  "metadata": {
+                                    "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "local-user/main.bicep"
+                                }
+                              }
+                            },
+                            "tableCorsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a cors rule.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "table-service/main.bicep",
+                                  "originalIdentifier": "corsRuleType"
+                                }
+                              }
+                            },
+                            "tableType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the table."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a table.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "table-service/main.bicep"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Required. Name of the Storage Account. Must be lower-case."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "extendedLocationZone": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Extended Zone location (ex 'losangeles'). When supplied, the storage account will be created in the specified zone under the parent location. The extended zone must be available in the supplied parent location."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "defaultValue": "StorageV2",
+                              "allowedValues": [
+                                "Storage",
+                                "StorageV2",
+                                "BlobStorage",
+                                "FileStorage",
+                                "BlockBlobStorage"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Type of Storage Account to create."
+                              }
+                            },
+                            "skuName": {
+                              "type": "string",
+                              "defaultValue": "Standard_GRS",
+                              "allowedValues": [
+                                "Standard_LRS",
+                                "Standard_ZRS",
+                                "Standard_GRS",
+                                "Standard_GZRS",
+                                "Standard_RAGRS",
+                                "Standard_RAGZRS",
+                                "StandardV2_LRS",
+                                "StandardV2_ZRS",
+                                "StandardV2_GRS",
+                                "StandardV2_GZRS",
+                                "Premium_LRS",
+                                "Premium_ZRS",
+                                "PremiumV2_LRS",
+                                "PremiumV2_ZRS"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage."
+                              }
+                            },
+                            "accessTier": {
+                              "type": "string",
+                              "defaultValue": "Hot",
+                              "allowedValues": [
+                                "Premium",
+                                "Hot",
+                                "Cool",
+                                "Cold"
+                              ],
+                              "metadata": {
+                                "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type."
+                              }
+                            },
+                            "largeFileSharesState": {
+                              "type": "string",
+                              "defaultValue": "Disabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)."
+                              }
+                            },
+                            "azureFilesIdentityBasedAuthentication": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication"
+                                },
+                                "description": "Optional. Provides the identity based authentication settings for Azure Files."
+                              },
+                              "nullable": true
+                            },
+                            "defaultToOAuthAuthentication": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not."
+                              }
+                            },
+                            "allowSharedKeyAccess": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointMultiServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                              }
+                            },
+                            "managementPolicyRules": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts/managementPolicies@2025-01-01#properties/properties/properties/policy/properties/rules"
+                                },
+                                "description": "Optional. The Storage Account ManagementPolicies Rules."
+                              },
+                              "nullable": true
+                            },
+                            "networkAcls": {
+                              "$ref": "#/definitions/networkAclsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny."
+                              }
+                            },
+                            "requireInfrastructureEncryption": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true."
+                              }
+                            },
+                            "allowCrossTenantReplication": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Allow or disallow cross AAD tenant object replication."
+                              }
+                            },
+                            "customDomainName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source."
+                              }
+                            },
+                            "customDomainUseSubDomainName": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates."
+                              }
+                            },
+                            "dnsEndpointType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "AzureDnsZone",
+                                "Standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier."
+                              }
+                            },
+                            "blobServices": {
+                              "$ref": "#/definitions/blobServiceType",
+                              "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]",
+                              "metadata": {
+                                "description": "Optional. Blob service and containers to deploy."
+                              }
+                            },
+                            "fileServices": {
+                              "$ref": "#/definitions/fileServiceType",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. File service and shares to deploy."
+                              }
+                            },
+                            "queueServices": {
+                              "$ref": "#/definitions/queueServiceType",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Queue service and queues to create."
+                              }
+                            },
+                            "tableServices": {
+                              "$ref": "#/definitions/tableServiceType",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Table service and tables to create."
+                              }
+                            },
+                            "allowBlobPublicAccess": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false."
+                              }
+                            },
+                            "minimumTlsVersion": {
+                              "type": "string",
+                              "defaultValue": "TLS1_2",
+                              "allowedValues": [
+                                "TLS1_2",
+                                "TLS1_3"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore."
+                              }
+                            },
+                            "enableHierarchicalNamespace": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true."
+                              }
+                            },
+                            "enableSftp": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true."
+                              }
+                            },
+                            "localUsers": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/localUserType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Local users to deploy for SFTP authentication."
+                              }
+                            },
+                            "isLocalUserEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enables local users feature, if set to true."
+                              }
+                            },
+                            "enableNfsV3": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "allowedCopyScope": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "AAD",
+                                "PrivateLink"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled",
+                                "SecuredByPerimeter"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+                              }
+                            },
+                            "supportsHttpsTrafficOnly": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Allows HTTPS traffic only to storage service if sets to true."
+                              }
+                            },
+                            "customerManagedKey": {
+                              "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The customer managed key definition."
+                              }
+                            },
+                            "sasExpirationPeriod": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The SAS expiration period. DD.HH:MM:SS."
+                              }
+                            },
+                            "sasExpirationAction": {
+                              "type": "string",
+                              "defaultValue": "Log",
+                              "allowedValues": [
+                                "Block",
+                                "Log"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The SAS expiration action. Allowed values are Block and Log."
+                              }
+                            },
+                            "keyType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Account",
+                                "Service"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The keyType to use with Queue & Table services."
+                              }
+                            },
+                            "secretsExportConfiguration": {
+                              "$ref": "#/definitions/secretsExportConfigurationType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                              }
+                            },
+                            "immutableStorageWithVersioning": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning"
+                                },
+                                "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts."
+                              },
+                              "nullable": true
+                            },
+                            "objectReplicationPolicies": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/objectReplicationPolicyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Object replication policies for the storage account."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]",
+                            "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+                            "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                              "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                              "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                              "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+                              "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+                              "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]",
+                              "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]",
+                              "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+                              "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+                              "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+                              "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+                              "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+                              "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+                              "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+                              "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+                              "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            },
+                            "formattedManagementPolicies": "[union(coalesce(parameters('managementPolicyRules'), createArray()), if(and(and(not(empty(parameters('blobServices'))), coalesce(tryGet(parameters('blobServices'), 'isVersioningEnabled'), false())), not(equals(tryGet(parameters('blobServices'), 'versionDeletePolicyDays'), null()))), createArray(createObject('name', 'DeletePreviousVersions (auto-created)', 'enabled', true(), 'type', 'Lifecycle', 'definition', createObject('actions', createObject('version', createObject('delete', createObject('daysAfterCreationGreaterThan', parameters('blobServices').versionDeletePolicyDays))), 'filters', createObject('blobTypes', createArray('blockBlob', 'appendBlob'))))), createArray()))]",
+                            "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                          },
+                          "resources": {
+                            "cMKKeyVault::cMKKey": {
+                              "condition": "[and(and(not(variables('isHSMManagedCMK')), not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults/keys",
+                              "apiVersion": "2024-11-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                            },
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.32.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "cMKKeyVault": {
+                              "condition": "[and(not(variables('isHSMManagedCMK')), not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2025-05-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                            },
+                            "cMKUserAssignedIdentity": {
+                              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                              "apiVersion": "2024-11-30",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                            },
+                            "storageAccount": {
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-06-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "extendedLocation": "[if(not(empty(parameters('extendedLocationZone'))), createObject('name', parameters('extendedLocationZone'), 'type', 'EdgeZone'), null())]",
+                              "kind": "[parameters('kind')]",
+                              "sku": {
+                                "name": "[parameters('skuName')]"
+                              },
+                              "identity": "[variables('identity')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault').vaultUri, format('https://{0}.managedhsm.azure.net/', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')))), 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), if(not(variables('isHSMManagedCMK')), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/')), fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]",
+                              "dependsOn": [
+                                "cMKKeyVault",
+                                "cMKKeyVault::cMKKey"
+                              ]
+                            },
+                            "storageAccount_diagnosticSettings": {
+                              "copy": {
+                                "name": "storageAccount_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount_roleAssignments": {
+                              "copy": {
+                                "name": "storageAccount_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount_privateEndpoints": {
+                              "copy": {
+                                "name": "storageAccount_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "16604612898799598358"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.38.5.1644",
+                                              "templateHash": "24141742673128945"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount_managementPolicies": {
+                              "condition": "[not(empty(coalesce(variables('formattedManagementPolicies'), createArray())))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "rules": {
+                                    "value": "[variables('formattedManagementPolicies')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "4000605059554016072"
+                                    },
+                                    "name": "Storage Account Management Policies",
+                                    "description": "This module deploys a Storage Account Management Policy."
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "rules": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts/managementPolicies@2025-06-01#properties/properties/properties/policy/properties/rules"
+                                        },
+                                        "description": "Required. The Storage Account ManagementPolicies Rules."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.storage-mgmtpolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Storage/storageAccounts/managementPolicies",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
+                                      "properties": {
+                                        "policy": {
+                                          "rules": "[parameters('rules')]"
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed management policy."
+                                      },
+                                      "value": "default"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed management policy."
+                                      },
+                                      "value": "default"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed management policy."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount",
+                                "storageAccount_blobServices"
+                              ]
+                            },
+                            "storageAccount_localUsers": {
+                              "copy": {
+                                "name": "storageAccount_localUsers",
+                                "count": "[length(coalesce(parameters('localUsers'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]"
+                                  },
+                                  "hasSshKey": {
+                                    "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]"
+                                  },
+                                  "hasSshPassword": {
+                                    "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]"
+                                  },
+                                  "permissionScopes": {
+                                    "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]"
+                                  },
+                                  "hasSharedKey": {
+                                    "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]"
+                                  },
+                                  "homeDirectory": {
+                                    "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]"
+                                  },
+                                  "sshAuthorizedKeys": {
+                                    "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "1801226901235196767"
+                                    },
+                                    "name": "Storage Account Local Users",
+                                    "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication."
+                                  },
+                                  "definitions": {
+                                    "sshAuthorizedKeyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Description used to store the function/usage of the key."
+                                          }
+                                        },
+                                        "key": {
+                                          "type": "securestring",
+                                          "metadata": {
+                                            "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "permissionScopeType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "permissions": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
+                                          }
+                                        },
+                                        "resourceName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
+                                          }
+                                        },
+                                        "service": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The service used by the local user, e.g. blob, file."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the local user used for SFTP Authentication."
+                                      }
+                                    },
+                                    "hasSharedKey": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
+                                      }
+                                    },
+                                    "hasSshKey": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                                      }
+                                    },
+                                    "hasSshPassword": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                                      }
+                                    },
+                                    "homeDirectory": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The local user home directory."
+                                      }
+                                    },
+                                    "permissionScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/permissionScopeType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The permission scopes of the local user."
+                                      }
+                                    },
+                                    "sshAuthorizedKeys": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/sshAuthorizedKeyType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The local user SSH authorized keys for SFTP."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.storage-localuser.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "localUsers": {
+                                      "type": "Microsoft.Storage/storageAccounts/localUsers",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                                      "properties": {
+                                        "hasSharedKey": "[parameters('hasSharedKey')]",
+                                        "hasSshKey": "[parameters('hasSshKey')]",
+                                        "hasSshPassword": "[parameters('hasSshPassword')]",
+                                        "homeDirectory": "[parameters('homeDirectory')]",
+                                        "permissionScopes": "[parameters('permissionScopes')]",
+                                        "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed local user."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed local user."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed local user."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount_blobServices": {
+                              "condition": "[not(empty(parameters('blobServices')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "containers": {
+                                    "value": "[tryGet(parameters('blobServices'), 'containers')]"
+                                  },
+                                  "automaticSnapshotPolicyEnabled": {
+                                    "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]"
+                                  },
+                                  "changeFeedEnabled": {
+                                    "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]"
+                                  },
+                                  "changeFeedRetentionInDays": {
+                                    "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]"
+                                  },
+                                  "containerDeleteRetentionPolicyEnabled": {
+                                    "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]"
+                                  },
+                                  "containerDeleteRetentionPolicyDays": {
+                                    "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]"
+                                  },
+                                  "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                                    "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]"
+                                  },
+                                  "corsRules": {
+                                    "value": "[tryGet(parameters('blobServices'), 'corsRules')]"
+                                  },
+                                  "defaultServiceVersion": {
+                                    "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]"
+                                  },
+                                  "deleteRetentionPolicyAllowPermanentDelete": {
+                                    "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]"
+                                  },
+                                  "deleteRetentionPolicyEnabled": {
+                                    "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]"
+                                  },
+                                  "deleteRetentionPolicyDays": {
+                                    "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]"
+                                  },
+                                  "isVersioningEnabled": {
+                                    "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]"
+                                  },
+                                  "lastAccessTimeTrackingPolicyEnabled": {
+                                    "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]"
+                                  },
+                                  "restorePolicyEnabled": {
+                                    "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]"
+                                  },
+                                  "restorePolicyDays": {
+                                    "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "468225492069709453"
+                                    },
+                                    "name": "Storage Account blob Services",
+                                    "description": "This module deploys a Storage Account Blob Service."
+                                  },
+                                  "definitions": {
+                                    "corsRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                          }
+                                        },
+                                        "allowedMethods": {
+                                          "type": "array",
+                                          "allowedValues": [
+                                            "CONNECT",
+                                            "DELETE",
+                                            "GET",
+                                            "HEAD",
+                                            "MERGE",
+                                            "OPTIONS",
+                                            "PATCH",
+                                            "POST",
+                                            "PUT",
+                                            "TRACE"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                          }
+                                        },
+                                        "allowedOrigins": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                          }
+                                        },
+                                        "exposedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of response headers to expose to CORS clients."
+                                          }
+                                        },
+                                        "maxAgeInSeconds": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a cors rule."
+                                      }
+                                    },
+                                    "containerType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the Storage Container to deploy."
+                                          }
+                                        },
+                                        "defaultEncryptionScope": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                          }
+                                        },
+                                        "denyEncryptionScopeOverride": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Block override of encryption scope from the container default."
+                                          }
+                                        },
+                                        "enableNfsV3AllSquash": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable NFSv3 all squash on blob container."
+                                          }
+                                        },
+                                        "enableNfsV3RootSquash": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable NFSv3 root squash on blob container."
+                                          }
+                                        },
+                                        "immutableStorageWithVersioningEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                          }
+                                        },
+                                        "immutabilityPolicy": {
+                                          "$ref": "#/definitions/immutabilityPolicyType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Configure immutability policy."
+                                          }
+                                        },
+                                        "metadata": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                            },
+                                            "description": "Optional. A name-value pair to associate with the container as metadata."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "publicAccess": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Blob",
+                                            "Container",
+                                            "None"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a storage container."
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "immutabilityPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "immutabilityPeriodSinceCreationInDays": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                          }
+                                        },
+                                        "allowProtectedAppendWrites": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. Defaults to false."
+                                          }
+                                        },
+                                        "allowProtectedAppendWritesAll": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for an immutability policy.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "container/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "automaticSnapshotPolicyEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Automatic Snapshot is enabled if set to true."
+                                      }
+                                    },
+                                    "changeFeedEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                                      }
+                                    },
+                                    "changeFeedRetentionInDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 1,
+                                      "maxValue": 146000,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
+                                      }
+                                    },
+                                    "containerDeleteRetentionPolicyEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                                      }
+                                    },
+                                    "containerDeleteRetentionPolicyDays": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 1,
+                                      "maxValue": 365,
+                                      "metadata": {
+                                        "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                                      }
+                                    },
+                                    "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                                      }
+                                    },
+                                    "corsRules": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/corsRuleType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                      }
+                                    },
+                                    "defaultServiceVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
+                                      }
+                                    },
+                                    "deleteRetentionPolicyEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. The blob service properties for blob soft delete."
+                                      }
+                                    },
+                                    "deleteRetentionPolicyDays": {
+                                      "type": "int",
+                                      "defaultValue": 7,
+                                      "minValue": 1,
+                                      "maxValue": 365,
+                                      "metadata": {
+                                        "description": "Optional. Indicates the number of days that the deleted blob should be retained."
+                                      }
+                                    },
+                                    "deleteRetentionPolicyAllowPermanentDelete": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                                      }
+                                    },
+                                    "isVersioningEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
+                                      }
+                                    },
+                                    "lastAccessTimeTrackingPolicyEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                                      }
+                                    },
+                                    "restorePolicyEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                                      }
+                                    },
+                                    "restorePolicyDays": {
+                                      "type": "int",
+                                      "defaultValue": 7,
+                                      "minValue": 1,
+                                      "metadata": {
+                                        "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                                      }
+                                    },
+                                    "containers": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/containerType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Blob containers to create."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "enableReferencedModulesTelemetry": false,
+                                    "name": "default"
+                                  },
+                                  "resources": {
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "blobServices": {
+                                      "type": "Microsoft.Storage/storageAccounts/blobServices",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                                      "properties": {
+                                        "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]",
+                                        "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]",
+                                        "containerDeleteRetentionPolicy": {
+                                          "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]",
+                                          "days": "[parameters('containerDeleteRetentionPolicyDays')]",
+                                          "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]"
+                                        },
+                                        "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
+                                        "defaultServiceVersion": "[parameters('defaultServiceVersion')]",
+                                        "deleteRetentionPolicy": {
+                                          "enabled": "[parameters('deleteRetentionPolicyEnabled')]",
+                                          "days": "[parameters('deleteRetentionPolicyDays')]",
+                                          "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]"
+                                        },
+                                        "isVersioningEnabled": "[parameters('isVersioningEnabled')]",
+                                        "lastAccessTimeTrackingPolicy": "[if(and(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), empty(tryGet(reference('storageAccount', '2025-01-01', 'full'), 'extendedLocation'))), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]",
+                                        "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]"
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "blobServices_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "blobServices_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "blobServices"
+                                      ]
+                                    },
+                                    "blobServices_container": {
+                                      "copy": {
+                                        "name": "blobServices_container",
+                                        "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('storageAccountName')]"
+                                          },
+                                          "blobServiceName": {
+                                            "value": "[variables('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
+                                          },
+                                          "defaultEncryptionScope": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]"
+                                          },
+                                          "denyEncryptionScopeOverride": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]"
+                                          },
+                                          "enableNfsV3AllSquash": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]"
+                                          },
+                                          "enableNfsV3RootSquash": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]"
+                                          },
+                                          "immutableStorageWithVersioningEnabled": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]"
+                                          },
+                                          "metadata": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]"
+                                          },
+                                          "publicAccess": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "immutabilityPolicy": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "273904034769611992"
+                                            },
+                                            "name": "Storage Account Blob Containers",
+                                            "description": "This module deploys a Storage Account Blob Container."
+                                          },
+                                          "definitions": {
+                                            "immutabilityPolicyType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "immutabilityPeriodSinceCreationInDays": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                                  }
+                                                },
+                                                "allowProtectedAppendWrites": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. Defaults to false."
+                                                  }
+                                                },
+                                                "allowProtectedAppendWritesAll": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for an immutability policy."
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "blobServiceName": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the Storage Container to deploy."
+                                              }
+                                            },
+                                            "defaultEncryptionScope": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                              }
+                                            },
+                                            "denyEncryptionScopeOverride": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Block override of encryption scope from the container default."
+                                              }
+                                            },
+                                            "enableNfsV3AllSquash": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Enable NFSv3 all squash on blob container."
+                                              }
+                                            },
+                                            "enableNfsV3RootSquash": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Enable NFSv3 root squash on blob container."
+                                              }
+                                            },
+                                            "immutableStorageWithVersioningEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                              }
+                                            },
+                                            "immutabilityPolicy": {
+                                              "$ref": "#/definitions/immutabilityPolicyType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Configure immutability policy."
+                                              }
+                                            },
+                                            "metadata": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                                },
+                                                "description": "Optional. A name-value pair to associate with the container as metadata."
+                                              },
+                                              "defaultValue": {}
+                                            },
+                                            "publicAccess": {
+                                              "type": "string",
+                                              "defaultValue": "None",
+                                              "allowedValues": [
+                                                "Container",
+                                                "Blob",
+                                                "None"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                              "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                              "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                                              "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+                                              "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+                                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                            },
+                                            "enableReferencedModulesTelemetry": false
+                                          },
+                                          "resources": {
+                                            "storageAccount::blobServices": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts/blobServices",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]"
+                                            },
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "container": {
+                                              "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
+                                              "properties": {
+                                                "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]",
+                                                "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]",
+                                                "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]",
+                                                "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]",
+                                                "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]",
+                                                "metadata": "[parameters('metadata')]",
+                                                "publicAccess": "[parameters('publicAccess')]"
+                                              }
+                                            },
+                                            "container_roleAssignments": {
+                                              "copy": {
+                                                "name": "container_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "container"
+                                              ]
+                                            },
+                                            "container_immutabilityPolicy": {
+                                              "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "storageAccountName": {
+                                                    "value": "[parameters('storageAccountName')]"
+                                                  },
+                                                  "containerName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "immutabilityPeriodSinceCreationInDays": {
+                                                    "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]"
+                                                  },
+                                                  "allowProtectedAppendWrites": {
+                                                    "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]"
+                                                  },
+                                                  "allowProtectedAppendWritesAll": {
+                                                    "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]"
+                                                  },
+                                                  "enableTelemetry": {
+                                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.41.2.15936",
+                                                      "templateHash": "15304742179563677019"
+                                                    },
+                                                    "name": "Storage Account Blob Container Immutability Policies",
+                                                    "description": "This module deploys a Storage Account Blob Container Immutability Policy."
+                                                  },
+                                                  "parameters": {
+                                                    "storageAccountName": {
+                                                      "type": "string",
+                                                      "maxLength": 24,
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "containerName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "immutabilityPeriodSinceCreationInDays": {
+                                                      "type": "int",
+                                                      "defaultValue": 365,
+                                                      "metadata": {
+                                                        "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                                      }
+                                                    },
+                                                    "allowProtectedAppendWrites": {
+                                                      "type": "bool",
+                                                      "defaultValue": false,
+                                                      "metadata": {
+                                                        "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                                                      }
+                                                    },
+                                                    "allowProtectedAppendWritesAll": {
+                                                      "type": "bool",
+                                                      "defaultValue": false,
+                                                      "metadata": {
+                                                        "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive. Defaults to false."
+                                                      }
+                                                    },
+                                                    "enableTelemetry": {
+                                                      "type": "bool",
+                                                      "defaultValue": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                                      }
+                                                    }
+                                                  },
+                                                  "resources": [
+                                                    {
+                                                      "condition": "[parameters('enableTelemetry')]",
+                                                      "type": "Microsoft.Resources/deployments",
+                                                      "apiVersion": "2024-03-01",
+                                                      "name": "[format('46d3xbcp.res.storage-containerimmutpolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                                      "properties": {
+                                                        "mode": "Incremental",
+                                                        "template": {
+                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                          "contentVersion": "1.0.0.0",
+                                                          "resources": [],
+                                                          "outputs": {
+                                                            "telemetry": {
+                                                              "type": "String",
+                                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                            }
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    {
+                                                      "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
+                                                      "apiVersion": "2025-01-01",
+                                                      "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), 'default')]",
+                                                      "properties": {
+                                                        "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]",
+                                                        "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]",
+                                                        "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]"
+                                                      }
+                                                    }
+                                                  ],
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the deployed immutability policy."
+                                                      },
+                                                      "value": "default"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the deployed immutability policy."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), 'default')]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group of the deployed immutability policy."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "container"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed container."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed container."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed container."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "blobServices"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed blob service."
+                                      },
+                                      "value": "[variables('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed blob service."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed blob service."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount_fileServices": {
+                              "condition": "[not(empty(parameters('fileServices')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]"
+                                  },
+                                  "protocolSettings": {
+                                    "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]"
+                                  },
+                                  "shareDeleteRetentionPolicy": {
+                                    "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]"
+                                  },
+                                  "shares": {
+                                    "value": "[tryGet(parameters('fileServices'), 'shares')]"
+                                  },
+                                  "corsRules": {
+                                    "value": "[tryGet(parameters('fileServices'), 'corsRules')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "17583198711200998285"
+                                    },
+                                    "name": "Storage Account File Share Services",
+                                    "description": "This module deploys a Storage Account File Share Service."
+                                  },
+                                  "definitions": {
+                                    "corsRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                          }
+                                        },
+                                        "allowedMethods": {
+                                          "type": "array",
+                                          "allowedValues": [
+                                            "CONNECT",
+                                            "DELETE",
+                                            "GET",
+                                            "HEAD",
+                                            "MERGE",
+                                            "OPTIONS",
+                                            "PATCH",
+                                            "POST",
+                                            "PUT",
+                                            "TRACE"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                          }
+                                        },
+                                        "allowedOrigins": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                          }
+                                        },
+                                        "exposedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of response headers to expose to CORS clients."
+                                          }
+                                        },
+                                        "maxAgeInSeconds": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a cors rule."
+                                      }
+                                    },
+                                    "fileShareType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the file share."
+                                          }
+                                        },
+                                        "accessTier": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Cool",
+                                            "Hot",
+                                            "Premium",
+                                            "TransactionOptimized"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
+                                          }
+                                        },
+                                        "enabledProtocols": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "NFS",
+                                            "SMB"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
+                                          }
+                                        },
+                                        "rootSquash": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AllSquash",
+                                            "NoRootSquash",
+                                            "RootSquash"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
+                                          }
+                                        },
+                                        "shareQuota": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
+                                          }
+                                        },
+                                        "provisionedBandwidthMibps": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "maxValue": 10340,
+                                          "metadata": {
+                                            "description": "Optional. The provisioned bandwidth of the share, in mebibytes per second. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 10340."
+                                          }
+                                        },
+                                        "provisionedIops": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "maxValue": 102400,
+                                          "metadata": {
+                                            "description": "Optional. The provisioned IOPS of the share. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 102400."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a file share."
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the file service."
+                                      }
+                                    },
+                                    "protocolSettings": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings"
+                                        },
+                                        "description": "Optional. Protocol settings for file service."
+                                      },
+                                      "defaultValue": {}
+                                    },
+                                    "shareDeleteRetentionPolicy": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy"
+                                        },
+                                        "description": "Optional. The service properties for soft delete."
+                                      },
+                                      "defaultValue": {
+                                        "enabled": true,
+                                        "days": 7
+                                      }
+                                    },
+                                    "corsRules": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/corsRuleType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    },
+                                    "shares": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/fileShareType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. File shares to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "enableReferencedModulesTelemetry": false
+                                  },
+                                  "resources": {
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "fileServices": {
+                                      "type": "Microsoft.Storage/storageAccounts/fileServices",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                                      "properties": {
+                                        "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
+                                        "protocolSettings": "[parameters('protocolSettings')]",
+                                        "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]"
+                                      }
+                                    },
+                                    "fileServices_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "fileServices_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "fileServices"
+                                      ]
+                                    },
+                                    "fileServices_shares": {
+                                      "copy": {
+                                        "name": "fileServices_shares",
+                                        "count": "[length(coalesce(parameters('shares'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-FileShare-{1}', deployment().name, copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('storageAccountName')]"
+                                          },
+                                          "fileServicesName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]"
+                                          },
+                                          "accessTier": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2025-06-01', 'full').kind, 'FileStorage'), if(startsWith(reference('storageAccount', '2025-06-01', 'full').sku.name, 'PremiumV2_'), null(), 'Premium'), 'TransactionOptimized'))]"
+                                          },
+                                          "enabledProtocols": {
+                                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]"
+                                          },
+                                          "rootSquash": {
+                                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]"
+                                          },
+                                          "shareQuota": {
+                                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]"
+                                          },
+                                          "provisionedBandwidthMibps": {
+                                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'provisionedBandwidthMibps')]"
+                                          },
+                                          "provisionedIops": {
+                                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'provisionedIops')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "10353179772982843397"
+                                            },
+                                            "name": "Storage Account File Shares",
+                                            "description": "This module deploys a Storage Account File Share."
+                                          },
+                                          "definitions": {
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "fileServicesName": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the file share to create."
+                                              }
+                                            },
+                                            "accessTier": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "Premium",
+                                                "Hot",
+                                                "Cool",
+                                                "TransactionOptimized"
+                                              ],
+                                              "metadata": {
+                                                "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized, Hot, and Cool."
+                                              }
+                                            },
+                                            "shareQuota": {
+                                              "type": "int",
+                                              "defaultValue": 5120,
+                                              "metadata": {
+                                                "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
+                                              }
+                                            },
+                                            "enabledProtocols": {
+                                              "type": "string",
+                                              "defaultValue": "SMB",
+                                              "allowedValues": [
+                                                "NFS",
+                                                "SMB"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
+                                              }
+                                            },
+                                            "rootSquash": {
+                                              "type": "string",
+                                              "defaultValue": "NoRootSquash",
+                                              "allowedValues": [
+                                                "AllSquash",
+                                                "NoRootSquash",
+                                                "RootSquash"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
+                                              }
+                                            },
+                                            "provisionedBandwidthMibps": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "maxValue": 10340,
+                                              "metadata": {
+                                                "description": "Optional. The provisioned bandwidth of the share, in mebibytes per second. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 10340."
+                                              }
+                                            },
+                                            "provisionedIops": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "maxValue": 102400,
+                                              "metadata": {
+                                                "description": "Optional. The provisioned IOPS of the share. Only applicable to FileStorage storage accounts (premium file shares). Must be between 0 and 102400."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                              "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+                                              "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+                                              "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+                                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "storageAccount::fileService": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts/fileServices",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]"
+                                            },
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "fileShare": {
+                                              "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]",
+                                              "properties": {
+                                                "accessTier": "[parameters('accessTier')]",
+                                                "shareQuota": "[parameters('shareQuota')]",
+                                                "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]",
+                                                "enabledProtocols": "[parameters('enabledProtocols')]",
+                                                "provisionedBandwidthMibps": "[if(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'FileStorage'), parameters('provisionedBandwidthMibps'), null())]",
+                                                "provisionedIops": "[if(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'FileStorage'), parameters('provisionedIops'), null())]"
+                                              },
+                                              "dependsOn": [
+                                                "storageAccount"
+                                              ]
+                                            },
+                                            "fileShare_roleAssignments": {
+                                              "copy": {
+                                                "name": "fileShare_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "scope": {
+                                                    "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]"
+                                                  },
+                                                  "name": {
+                                                    "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]"
+                                                  },
+                                                  "roleDefinitionId": {
+                                                    "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                                                  },
+                                                  "principalId": {
+                                                    "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                                  },
+                                                  "principalType": {
+                                                    "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]"
+                                                  },
+                                                  "condition": {
+                                                    "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]"
+                                                  },
+                                                  "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]",
+                                                  "delegatedManagedIdentityResourceId": {
+                                                    "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                                  },
+                                                  "description": {
+                                                    "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "parameters": {
+                                                    "scope": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The scope to deploy the role assignment to."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The name of the role assignment."
+                                                      }
+                                                    },
+                                                    "roleDefinitionId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The role definition Id to assign."
+                                                      }
+                                                    },
+                                                    "principalId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                      }
+                                                    },
+                                                    "principalType": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "Device",
+                                                        "ForeignGroup",
+                                                        "Group",
+                                                        "ServicePrincipal",
+                                                        "User",
+                                                        ""
+                                                      ],
+                                                      "defaultValue": "",
+                                                      "metadata": {
+                                                        "description": "Optional. The principal type of the assigned principal ID."
+                                                      }
+                                                    },
+                                                    "description": {
+                                                      "type": "string",
+                                                      "defaultValue": "",
+                                                      "metadata": {
+                                                        "description": "Optional. The description of the role assignment."
+                                                      }
+                                                    },
+                                                    "condition": {
+                                                      "type": "string",
+                                                      "defaultValue": "",
+                                                      "metadata": {
+                                                        "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\""
+                                                      }
+                                                    },
+                                                    "conditionVersion": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "2.0"
+                                                      ],
+                                                      "defaultValue": "2.0",
+                                                      "metadata": {
+                                                        "description": "Optional. Version of the condition."
+                                                      }
+                                                    },
+                                                    "delegatedManagedIdentityResourceId": {
+                                                      "type": "string",
+                                                      "defaultValue": "",
+                                                      "metadata": {
+                                                        "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                      }
+                                                    }
+                                                  },
+                                                  "resources": [
+                                                    {
+                                                      "type": "Microsoft.Authorization/roleAssignments",
+                                                      "apiVersion": "2022-04-01",
+                                                      "scope": "[parameters('scope')]",
+                                                      "name": "[parameters('name')]",
+                                                      "properties": {
+                                                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                                        "principalId": "[parameters('principalId')]",
+                                                        "description": "[parameters('description')]",
+                                                        "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]",
+                                                        "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]",
+                                                        "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]",
+                                                        "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]"
+                                                      }
+                                                    }
+                                                  ]
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "fileShare"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed file share."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed file share."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed file share."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "fileServices",
+                                        "storageAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed file share service."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed file share service."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed file share service."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount_queueServices": {
+                              "condition": "[not(empty(parameters('queueServices')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]"
+                                  },
+                                  "queues": {
+                                    "value": "[tryGet(parameters('queueServices'), 'queues')]"
+                                  },
+                                  "corsRules": {
+                                    "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "9644461291744477521"
+                                    },
+                                    "name": "Storage Account Queue Services",
+                                    "description": "This module deploys a Storage Account Queue Service."
+                                  },
+                                  "definitions": {
+                                    "corsRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                          }
+                                        },
+                                        "allowedMethods": {
+                                          "type": "array",
+                                          "allowedValues": [
+                                            "CONNECT",
+                                            "DELETE",
+                                            "GET",
+                                            "HEAD",
+                                            "MERGE",
+                                            "OPTIONS",
+                                            "PATCH",
+                                            "POST",
+                                            "PUT",
+                                            "TRACE"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                          }
+                                        },
+                                        "allowedOrigins": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                          }
+                                        },
+                                        "exposedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of response headers to expose to CORS clients."
+                                          }
+                                        },
+                                        "maxAgeInSeconds": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a cors rule."
+                                      }
+                                    },
+                                    "queueType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the queue."
+                                          }
+                                        },
+                                        "metadata": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
+                                            },
+                                            "description": "Optional. Metadata to set on the queue."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a queue."
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "queues": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/queueType"
+                                      },
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. Queues to create."
+                                      }
+                                    },
+                                    "corsRules": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/corsRuleType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "name": "default",
+                                    "enableReferencedModulesTelemetry": false
+                                  },
+                                  "resources": {
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "queueServices": {
+                                      "type": "Microsoft.Storage/storageAccounts/queueServices",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                                      "properties": {
+                                        "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
+                                      }
+                                    },
+                                    "queueServices_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "queueServices_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "queueServices"
+                                      ]
+                                    },
+                                    "queueServices_queues": {
+                                      "copy": {
+                                        "name": "queueServices_queues",
+                                        "count": "[length(coalesce(parameters('queues'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('storageAccountName')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]"
+                                          },
+                                          "metadata": {
+                                            "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "12812824360066955039"
+                                            },
+                                            "name": "Storage Account Queues",
+                                            "description": "This module deploys a Storage Account Queue."
+                                          },
+                                          "definitions": {
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the storage queue to deploy."
+                                              }
+                                            },
+                                            "metadata": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
+                                                },
+                                                "description": "Optional. A name-value pair that represents queue metadata."
+                                              },
+                                              "defaultValue": {}
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                              "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+                                              "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+                                              "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+                                              "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+                                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "storageAccount::queueServices": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts/queueServices",
+                                              "apiVersion": "2025-06-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
+                                            },
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.storage-queue.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2025-06-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "queue": {
+                                              "type": "Microsoft.Storage/storageAccounts/queueServices/queues",
+                                              "apiVersion": "2025-06-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                              "properties": {
+                                                "metadata": "[parameters('metadata')]"
+                                              }
+                                            },
+                                            "queue_roleAssignments": {
+                                              "copy": {
+                                                "name": "queue_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "queue"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed queue."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed queue."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed queue."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed queue service."
+                                      },
+                                      "value": "[variables('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed queue service."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed queue service."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount_tableServices": {
+                              "condition": "[not(empty(parameters('tableServices')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]"
+                                  },
+                                  "tables": {
+                                    "value": "[tryGet(parameters('tableServices'), 'tables')]"
+                                  },
+                                  "corsRules": {
+                                    "value": "[tryGet(parameters('tableServices'), 'corsRules')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "10320403358700650147"
+                                    },
+                                    "name": "Storage Account Table Services",
+                                    "description": "This module deploys a Storage Account Table Service."
+                                  },
+                                  "definitions": {
+                                    "corsRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                          }
+                                        },
+                                        "allowedMethods": {
+                                          "type": "array",
+                                          "allowedValues": [
+                                            "CONNECT",
+                                            "DELETE",
+                                            "GET",
+                                            "HEAD",
+                                            "MERGE",
+                                            "OPTIONS",
+                                            "PATCH",
+                                            "POST",
+                                            "PUT",
+                                            "TRACE"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                          }
+                                        },
+                                        "allowedOrigins": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                          }
+                                        },
+                                        "exposedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of response headers to expose to CORS clients."
+                                          }
+                                        },
+                                        "maxAgeInSeconds": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a cors rule."
+                                      }
+                                    },
+                                    "tableType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the table."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a table."
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "tables": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/tableType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tables to create."
+                                      }
+                                    },
+                                    "corsRules": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/corsRuleType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "name": "default",
+                                    "enableReferencedModulesTelemetry": false
+                                  },
+                                  "resources": {
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "tableServices": {
+                                      "type": "Microsoft.Storage/storageAccounts/tableServices",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                                      "properties": {
+                                        "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
+                                      }
+                                    },
+                                    "tableServices_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "tableServices_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "tableServices"
+                                      ]
+                                    },
+                                    "tableServices_tables": {
+                                      "copy": {
+                                        "name": "tableServices_tables",
+                                        "count": "[length(coalesce(parameters('tables'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                                          },
+                                          "storageAccountName": {
+                                            "value": "[parameters('storageAccountName')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "11362260974696477885"
+                                            },
+                                            "name": "Storage Account Table",
+                                            "description": "This module deploys a Storage Account Table."
+                                          },
+                                          "definitions": {
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the table."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                              "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                              "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                              "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                              "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+                                              "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+                                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "storageAccount::tableServices": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts/tableServices",
+                                              "apiVersion": "2025-06-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
+                                            },
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.storage-table.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2025-06-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "table": {
+                                              "type": "Microsoft.Storage/storageAccounts/tableServices/tables",
+                                              "apiVersion": "2025-06-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                            },
+                                            "table_roleAssignments": {
+                                              "copy": {
+                                                "name": "table_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "table"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed table."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed table."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed table."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed table service."
+                                      },
+                                      "value": "[variables('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed table service."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed table service."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "secretsExport": {
+                              "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                              "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "keyVaultName": {
+                                    "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                                  },
+                                  "secretsToSet": {
+                                    "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2025-06-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2025-06-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2025-06-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2025-06-01').keys[1].value, environment().suffixes.storage))), createArray()))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "13227497656004178962"
+                                    }
+                                  },
+                                  "definitions": {
+                                    "secretSetOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "secretResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resourceId of the exported secret."
+                                          }
+                                        },
+                                        "secretUri": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI of the exported secret."
+                                          }
+                                        },
+                                        "secretUriWithVersion": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI with version of the exported secret."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "secretToSetType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the secret to set."
+                                          }
+                                        },
+                                        "value": {
+                                          "type": "securestring",
+                                          "metadata": {
+                                            "description": "Required. The value of the secret to set."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "keyVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Key Vault to set the ecrets in."
+                                      }
+                                    },
+                                    "secretsToSet": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/secretToSetType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The secrets to set in the Key Vault."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "keyVault": {
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('keyVaultName')]"
+                                    },
+                                    "secrets": {
+                                      "copy": {
+                                        "name": "secrets",
+                                        "count": "[length(parameters('secretsToSet'))]"
+                                      },
+                                      "type": "Microsoft.KeyVault/vaults/secrets",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                                      "properties": {
+                                        "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "secretsSet": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/secretSetOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The references to the secrets exported to the provided Key Vault."
+                                      },
+                                      "copy": {
+                                        "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                        "input": {
+                                          "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                          "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                                          "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                                        }
+                                      }
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "storageAccount_objectReplicationPolicies": {
+                              "copy": {
+                                "name": "storageAccount_objectReplicationPolicies",
+                                "count": "[length(coalesce(parameters('objectReplicationPolicies'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Storage-ObjRepPolicy-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "destinationAccountResourceId": {
+                                    "value": "[coalesce(parameters('objectReplicationPolicies'), createArray())[copyIndex()].destinationStorageAccountResourceId]"
+                                  },
+                                  "enableMetrics": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('objectReplicationPolicies'), createArray())[copyIndex()], 'enableMetrics'), false())]"
+                                  },
+                                  "rules": {
+                                    "value": "[tryGet(coalesce(parameters('objectReplicationPolicies'), createArray())[copyIndex()], 'rules')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "1894366578172550759"
+                                    },
+                                    "name": "Storage Account Object Replication Policy",
+                                    "description": "This module deploys a Storage Account Object Replication Policy for both the source account and destination account."
+                                  },
+                                  "definitions": {
+                                    "objectReplicationPolicyRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ruleId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The ID of the rule. Auto-generated on destination account. Required for source account."
+                                          }
+                                        },
+                                        "containerName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the source container."
+                                          }
+                                        },
+                                        "destinationContainerName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the destination container. If not provided, the same name as the source container will be used."
+                                          }
+                                        },
+                                        "filters": {
+                                          "type": "object",
+                                          "properties": {
+                                            "prefixMatch": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The prefix to match for the replication policy rule."
+                                              }
+                                            },
+                                            "minCreationTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The minimum creation time to match for the replication policy rule."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The filters for the object replication policy rule."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of an object replication policy rule.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "policy/main.bicep"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name of the policy."
+                                      }
+                                    },
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Required. The name of the parent Storage Account."
+                                      }
+                                    },
+                                    "destinationAccountResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the destination storage account for replication."
+                                      }
+                                    },
+                                    "enableMetrics": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether metrics are enabled for the object replication policy."
+                                      }
+                                    },
+                                    "rules": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/objectReplicationPolicyRuleType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. Rules for the object replication policy."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "destAccountResourceIdParts": "[split(parameters('destinationAccountResourceId'), '/')]",
+                                    "destAccountName": "[if(not(empty(variables('destAccountResourceIdParts'))), last(variables('destAccountResourceIdParts')), parameters('destinationAccountResourceId'))]",
+                                    "destAccountSubscription": "[if(greater(length(variables('destAccountResourceIdParts')), 2), variables('destAccountResourceIdParts')[2], subscription().subscriptionId)]",
+                                    "destAccountResourceGroupName": "[if(greater(length(variables('destAccountResourceIdParts')), 4), variables('destAccountResourceIdParts')[4], resourceGroup().name)]"
+                                  },
+                                  "resources": {
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "destinationPolicy": {
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[take(format('{0}-ObjRep-Policy-dest-{1}', deployment().name, variables('destAccountName')), 64)]",
+                                      "subscriptionId": "[variables('destAccountSubscription')]",
+                                      "resourceGroup": "[variables('destAccountResourceGroupName')]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(parameters('name'), 'default')]"
+                                          },
+                                          "storageAccountName": {
+                                            "value": "[variables('destAccountName')]"
+                                          },
+                                          "sourceStorageAccountResourceId": {
+                                            "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
+                                          },
+                                          "destinationAccountResourceId": {
+                                            "value": "[parameters('destinationAccountResourceId')]"
+                                          },
+                                          "enableMetrics": {
+                                            "value": "[parameters('enableMetrics')]"
+                                          },
+                                          "rules": {
+                                            "value": "[parameters('rules')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "14995722372031126283"
+                                            },
+                                            "name": "Storage Account Object Replication Policy",
+                                            "description": "This module deploys a Storage Account Object Replication Policy for a provided storage account."
+                                          },
+                                          "definitions": {
+                                            "objectReplicationPolicyRuleType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "ruleId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The ID of the rule. Auto-generated on destination account. Required for source account."
+                                                  }
+                                                },
+                                                "containerName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the source container."
+                                                  }
+                                                },
+                                                "destinationContainerName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the destination container. If not provided, the same name as the source container will be used."
+                                                  }
+                                                },
+                                                "filters": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "prefixMatch": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The prefix to match for the replication policy rule."
+                                                      }
+                                                    },
+                                                    "minCreationTime": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The minimum creation time to match for the replication policy rule."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The filters for the object replication policy rule."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of an object replication policy rule."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the policy."
+                                              }
+                                            },
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Required. The name of the Storage Account on which to create the policy."
+                                              }
+                                            },
+                                            "sourceStorageAccountResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the source storage account for replication."
+                                              }
+                                            },
+                                            "destinationAccountResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the destination storage account for replication."
+                                              }
+                                            },
+                                            "enableMetrics": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Whether metrics are enabled for the object replication policy."
+                                              }
+                                            },
+                                            "rules": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/objectReplicationPolicyRuleType"
+                                              },
+                                              "metadata": {
+                                                "description": "Required. Rules for the object replication policy."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "objectReplicationPolicy": {
+                                              "type": "Microsoft.Storage/storageAccounts/objectReplicationPolicies",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "rules",
+                                                    "count": "[length(parameters('rules'))]",
+                                                    "input": {
+                                                      "ruleId": "[tryGet(parameters('rules')[copyIndex('rules')], 'ruleId')]",
+                                                      "sourceContainer": "[parameters('rules')[copyIndex('rules')].containerName]",
+                                                      "destinationContainer": "[coalesce(tryGet(parameters('rules')[copyIndex('rules')], 'destinationContainerName'), parameters('rules')[copyIndex('rules')].containerName)]",
+                                                      "filters": "[if(not(equals(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), null())), createObject('prefixMatch', tryGet(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), 'prefixMatch'), 'minCreationTime', tryGet(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), 'minCreationTime')), null())]"
+                                                    }
+                                                  }
+                                                ],
+                                                "destinationAccount": "[parameters('destinationAccountResourceId')]",
+                                                "metrics": {
+                                                  "enabled": "[coalesce(parameters('enableMetrics'), false())]"
+                                                },
+                                                "sourceAccount": "[parameters('sourceStorageAccountResourceId')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Resource group name of the provisioned resources."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "objectReplicationPolicyId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Resource ID of the created Object Replication Policy."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/objectReplicationPolicies', parameters('storageAccountName'), parameters('name'))]"
+                                            },
+                                            "policyId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Policy ID of the created Object Replication Policy."
+                                              },
+                                              "value": "[reference('objectReplicationPolicy').policyId]"
+                                            },
+                                            "rules": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Storage/storageAccounts/objectReplicationPolicies@2025-01-01#properties/properties/properties/rules",
+                                                  "output": true
+                                                },
+                                                "description": "Rules created Object Replication Policy."
+                                              },
+                                              "value": "[reference('objectReplicationPolicy').rules]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "sourcePolicy": {
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[take(format('{0}-ObjRep-Policy-source-{1}', deployment().name, parameters('storageAccountName')), 64)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[reference('destinationPolicy').outputs.policyId.value]"
+                                          },
+                                          "storageAccountName": {
+                                            "value": "[parameters('storageAccountName')]"
+                                          },
+                                          "sourceStorageAccountResourceId": {
+                                            "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
+                                          },
+                                          "destinationAccountResourceId": {
+                                            "value": "[parameters('destinationAccountResourceId')]"
+                                          },
+                                          "enableMetrics": {
+                                            "value": "[parameters('enableMetrics')]"
+                                          },
+                                          "rules": {
+                                            "copy": [
+                                              {
+                                                "name": "value",
+                                                "count": "[length(parameters('rules'))]",
+                                                "input": "[union(parameters('rules')[copyIndex('value')], createObject('ruleId', reference('destinationPolicy').outputs.rules.value[copyIndex('value')].ruleId))]"
+                                              }
+                                            ]
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "14995722372031126283"
+                                            },
+                                            "name": "Storage Account Object Replication Policy",
+                                            "description": "This module deploys a Storage Account Object Replication Policy for a provided storage account."
+                                          },
+                                          "definitions": {
+                                            "objectReplicationPolicyRuleType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "ruleId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The ID of the rule. Auto-generated on destination account. Required for source account."
+                                                  }
+                                                },
+                                                "containerName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the source container."
+                                                  }
+                                                },
+                                                "destinationContainerName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the destination container. If not provided, the same name as the source container will be used."
+                                                  }
+                                                },
+                                                "filters": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "prefixMatch": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The prefix to match for the replication policy rule."
+                                                      }
+                                                    },
+                                                    "minCreationTime": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The minimum creation time to match for the replication policy rule."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The filters for the object replication policy rule."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of an object replication policy rule."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the policy."
+                                              }
+                                            },
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Required. The name of the Storage Account on which to create the policy."
+                                              }
+                                            },
+                                            "sourceStorageAccountResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the source storage account for replication."
+                                              }
+                                            },
+                                            "destinationAccountResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the destination storage account for replication."
+                                              }
+                                            },
+                                            "enableMetrics": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Whether metrics are enabled for the object replication policy."
+                                              }
+                                            },
+                                            "rules": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/objectReplicationPolicyRuleType"
+                                              },
+                                              "metadata": {
+                                                "description": "Required. Rules for the object replication policy."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "objectReplicationPolicy": {
+                                              "type": "Microsoft.Storage/storageAccounts/objectReplicationPolicies",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "rules",
+                                                    "count": "[length(parameters('rules'))]",
+                                                    "input": {
+                                                      "ruleId": "[tryGet(parameters('rules')[copyIndex('rules')], 'ruleId')]",
+                                                      "sourceContainer": "[parameters('rules')[copyIndex('rules')].containerName]",
+                                                      "destinationContainer": "[coalesce(tryGet(parameters('rules')[copyIndex('rules')], 'destinationContainerName'), parameters('rules')[copyIndex('rules')].containerName)]",
+                                                      "filters": "[if(not(equals(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), null())), createObject('prefixMatch', tryGet(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), 'prefixMatch'), 'minCreationTime', tryGet(tryGet(parameters('rules')[copyIndex('rules')], 'filters'), 'minCreationTime')), null())]"
+                                                    }
+                                                  }
+                                                ],
+                                                "destinationAccount": "[parameters('destinationAccountResourceId')]",
+                                                "metrics": {
+                                                  "enabled": "[coalesce(parameters('enableMetrics'), false())]"
+                                                },
+                                                "sourceAccount": "[parameters('sourceStorageAccountResourceId')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Resource group name of the provisioned resources."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "objectReplicationPolicyId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Resource ID of the created Object Replication Policy."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/objectReplicationPolicies', parameters('storageAccountName'), parameters('name'))]"
+                                            },
+                                            "policyId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Policy ID of the created Object Replication Policy."
+                                              },
+                                              "value": "[reference('objectReplicationPolicy').policyId]"
+                                            },
+                                            "rules": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Storage/storageAccounts/objectReplicationPolicies@2025-01-01#properties/properties/properties/rules",
+                                                  "output": true
+                                                },
+                                                "description": "Rules created Object Replication Policy."
+                                              },
+                                              "value": "[reference('objectReplicationPolicy').rules]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "destinationPolicy"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Resource group name of the provisioned resources."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "objectReplicationPolicyId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Resource ID of the created Object Replication Policy in the source account."
+                                      },
+                                      "value": "[reference('sourcePolicy').outputs.objectReplicationPolicyId.value]"
+                                    },
+                                    "policyId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Policy ID of the created Object Replication Policy in the source account."
+                                      },
+                                      "value": "[reference('sourcePolicy').outputs.policyId.value]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "storageAccount",
+                                "storageAccount_blobServices"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed storage account."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed storage account."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed storage account."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "primaryBlobEndpoint": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The primary blob endpoint reference if blob services are deployed."
+                              },
+                              "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('storageAccount', '2025-06-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('storageAccount', '2025-06-01', 'full').location]"
+                            },
+                            "serviceEndpoints": {
+                              "type": "object",
+                              "metadata": {
+                                "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint."
+                              },
+                              "value": "[reference('storageAccount').primaryEndpoints]"
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the Storage Account."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            },
+                            "exportedSecrets": {
+                              "$ref": "#/definitions/secretsOutputType",
+                              "metadata": {
+                                "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                              },
+                              "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                            },
+                            "primaryAccessKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The primary access key of the storage account."
+                              },
+                              "value": "[listKeys('storageAccount', '2025-06-01').keys[0].value]"
+                            },
+                            "secondaryAccessKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The secondary access key of the storage account."
+                              },
+                              "value": "[listKeys('storageAccount', '2025-06-01').keys[1].value]"
+                            },
+                            "primaryConnectionString": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The primary connection string of the storage account."
+                              },
+                              "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2025-06-01').keys[0].value, environment().suffixes.storage)]"
+                            },
+                            "secondaryConnectionString": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The secondary connection string of the storage account."
+                              },
+                              "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2025-06-01').keys[1].value, environment().suffixes.storage)]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Storage Account."
+                      },
+                      "value": "[reference('storage').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the Storage Account."
+                      },
+                      "value": "[reference('storage').outputs.name.value]"
+                    },
+                    "blobEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Primary blob endpoint."
+                      },
+                      "value": "[reference('storage').outputs.primaryBlobEndpoint.value]"
+                    },
+                    "serviceEndpoints": {
+                      "type": "object",
+                      "metadata": {
+                        "description": "Service endpoints."
+                      },
+                      "value": "[reference('storage').outputs.serviceEndpoints.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "log_analytics",
+                "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageDfs)]",
+                "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageBlob)]",
+                "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageFile)]",
+                "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').storageQueue)]",
+                "virtualNetwork"
+              ]
+            },
+            "cosmosDBModule": {
+              "condition": "[parameters('deployCosmos')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "databaseName": {
+                    "value": "km-db"
+                  },
+                  "containers": {
+                    "value": [
+                      {
+                        "name": "chat_sessions",
+                        "partitionKeyPath": "/user_id"
+                      },
+                      {
+                        "name": "chat_messages",
+                        "partitionKeyPath": "/session_id"
+                      },
+                      {
+                        "name": "document_insights",
+                        "partitionKeyPath": "/dataset_id"
+                      },
+                      {
+                        "name": "enrichment_cache",
+                        "partitionKeyPath": "/doc_hash"
+                      }
+                    ]
+                  },
+                  "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                  "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+                  "zoneRedundant": {
+                    "value": "[parameters('enableRedundancy')]"
+                  },
+                  "enableAutomaticFailover": {
+                    "value": "[parameters('enableRedundancy')]"
+                  },
+                  "haLocation": {
+                    "value": "[variables('cosmosDbHaLocation')]"
+                  },
+                  "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-cosmos-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-cosmos-{0}', variables('solutionSuffix')), 'service', 'Sql', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').cosmosDB)).outputs.resourceId.value)))))), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "3082174065440100153"
+                    }
+                  },
+                  "definitions": {
+                    "_1.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_1.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('cosmos-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the Cosmos DB account."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "databaseName": {
+                      "type": "string",
+                      "defaultValue": "db_conversation_history",
+                      "metadata": {
+                        "description": "Database name."
+                      }
+                    },
+                    "containers": {
+                      "type": "array",
+                      "defaultValue": [
+                        {
+                          "name": "conversations",
+                          "partitionKeyPath": "/userId"
+                        }
+                      ],
+                      "metadata": {
+                        "description": "Container definitions."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Diagnostic settings for monitoring."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "zoneRedundant": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable zone redundancy."
+                      }
+                    },
+                    "enableAutomaticFailover": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable automatic failover."
+                      }
+                    },
+                    "haLocation": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. HA paired region for multi-region failover when redundancy is enabled."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "cosmosAccount": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.document-db.database-account.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "capabilitiesToAdd": "[if(parameters('zoneRedundant'), createObject('value', createArray()), createObject('value', createArray('EnableServerless')))]",
+                          "sqlDatabases": {
+                            "value": [
+                              {
+                                "copy": [
+                                  {
+                                    "name": "containers",
+                                    "count": "[length(parameters('containers'))]",
+                                    "input": {
+                                      "name": "[parameters('containers')[copyIndex('containers')].name]",
+                                      "paths": [
+                                        "[parameters('containers')[copyIndex('containers')].partitionKeyPath]"
+                                      ],
+                                      "kind": "Hash",
+                                      "version": 2
+                                    }
+                                  }
+                                ],
+                                "name": "[parameters('databaseName')]"
+                              }
+                            ]
+                          },
+                          "sqlRoleAssignments": {
+                            "value": []
+                          },
+                          "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]",
+                          "networkRestrictions": {
+                            "value": {
+                              "networkAclBypass": "None",
+                              "publicNetworkAccess": "[parameters('publicNetworkAccess')]"
+                            }
+                          },
+                          "privateEndpoints": {
+                            "value": "[parameters('privateEndpoints')]"
+                          },
+                          "zoneRedundant": {
+                            "value": "[parameters('zoneRedundant')]"
+                          },
+                          "enableAutomaticFailover": {
+                            "value": "[parameters('enableAutomaticFailover')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          },
+                          "failoverLocations": "[if(parameters('zoneRedundant'), createObject('value', createArray(createObject('failoverPriority', 0, 'isZoneRedundant', true(), 'locationName', parameters('location')), createObject('failoverPriority', 1, 'isZoneRedundant', true(), 'locationName', parameters('haLocation')))), createObject('value', createArray(createObject('locationName', parameters('location'), 'failoverPriority', 0, 'isZoneRedundant', false()))))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "1772014800591596213"
+                            },
+                            "name": "Azure Cosmos DB account",
+                            "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed."
+                          },
+                          "definitions": {
+                            "privateEndpointOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The group ID for the private endpoint group."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses for the private endpoint."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the private endpoint output."
+                              }
+                            },
+                            "failoverLocationType": {
+                              "type": "object",
+                              "properties": {
+                                "failoverPriority": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists."
+                                  }
+                                },
+                                "isZoneRedundant": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true."
+                                  }
+                                },
+                                "locationName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the region."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the failover location."
+                              }
+                            },
+                            "sqlRoleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The unique name of the role assignment."
+                                  }
+                                },
+                                "roleDefinitionId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                  }
+                                },
+                                "scope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment."
+                              }
+                            },
+                            "sqlRoleDefinitionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The unique identifier of the role-based access control definition."
+                                  }
+                                },
+                                "roleName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account."
+                                  }
+                                },
+                                "dataActions": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "minLength": 1,
+                                  "metadata": {
+                                    "description": "Required. An array of data actions that are allowed."
+                                  }
+                                },
+                                "assignableScopes": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope."
+                                  }
+                                },
+                                "assignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/nestedSqlRoleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. An array of role-based access control assignments to be created for the definition."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition."
+                              }
+                            },
+                            "networkRestrictionType": {
+                              "type": "object",
+                              "properties": {
+                                "ipRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`."
+                                  }
+                                },
+                                "networkAclBypass": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureServices",
+                                    "None"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"."
+                                  }
+                                },
+                                "publicNetworkAccess": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "Enabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"."
+                                  }
+                                },
+                                "virtualNetworkRules": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "subnetResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Resource ID of a subnet."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. List of virtual network access control list (ACL) rules configured for the account."
+                                  }
+                                },
+                                "networkAclBypassResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. An array that contains the Resource Ids for Network Acl Bypass for the Cosmos DB account."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the network restriction."
+                              }
+                            },
+                            "gremlinDatabaseType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the Gremlin database."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases@2024-11-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the Gremlin database resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "graphs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/graphType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of graphs to deploy in the Gremlin database."
+                                  }
+                                },
+                                "maxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a gremlin databae."
+                              }
+                            },
+                            "mongoDbType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the mongodb database."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                  }
+                                },
+                                "collections": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/collectionType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Collections in the mongodb database."
+                                  }
+                                },
+                                "autoscaleSettings": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases@2025-04-15#properties/properties/properties/options/properties/autoscaleSettings"
+                                    },
+                                    "description": "Optional. Specifies the Autoscale settings. Note: Either throughput or autoscaleSettings is required, but not both."
+                                  },
+                                  "nullable": true
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases@2025-04-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a mongo databae."
+                              }
+                            },
+                            "sqlDatabaseType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the SQL database ."
+                                  }
+                                },
+                                "containers": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/containerType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of containers to deploy in the SQL database."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                  }
+                                },
+                                "autoscaleSettingsMaxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2025-04-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the SQL database resource."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a sql database."
+                              }
+                            },
+                            "tableType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the table."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/tables@2025-04-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags for the table."
+                                  },
+                                  "nullable": true
+                                },
+                                "maxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a table."
+                              }
+                            },
+                            "cassandraStandaloneRoleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The unique name of the role assignment."
+                                  }
+                                },
+                                "roleDefinitionId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The unique identifier of the Azure Cosmos DB for Apache Cassandra native role-based access control definition."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                  }
+                                },
+                                "scope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The data plane resource path for which access is being granted through this role-based access control assignment. Defaults to the current account."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for an Azure Cosmos DB for Apache Cassandra native role-based access control assignment."
+                              }
+                            },
+                            "cassandraRoleDefinitionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The unique identifier of the role-based access control definition."
+                                  }
+                                },
+                                "roleName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. A user-friendly name for the role-based access control definition. Must be unique for the database account."
+                                  }
+                                },
+                                "dataActions": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. An array of data actions that are allowed. Note: Valid data action strings are currently undocumented (API version 2025-05-01-preview). Expected to follow format similar to SQL RBAC once documented by Microsoft."
+                                  }
+                                },
+                                "notDataActions": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. An array of data actions that are denied. Note: Unlike SQL RBAC, Cassandra supports deny rules for granular access control. Valid data action strings are currently undocumented (API version 2025-05-01-preview)."
+                                  }
+                                },
+                                "assignableScopes": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition."
+                                  }
+                                },
+                                "assignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/cassandraRoleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. An array of role-based access control assignments to be created for the definition."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for an Azure Cosmos DB for Apache Cassandra native role-based access control definition."
+                              }
+                            },
+                            "cassandraKeyspaceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the Cassandra keyspace."
+                                  }
+                                },
+                                "tables": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/cassandraTableType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of Cassandra tables to deploy in the keyspace."
+                                  }
+                                },
+                                "views": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/cassandraViewType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of Cassandra views (materialized views) to deploy in the keyspace."
+                                  }
+                                },
+                                "autoscaleSettingsMaxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the keyspace level is only recommended for development/test or when workload across all tables in the shared throughput keyspace is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the table level and not at the keyspace level."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `autoscaleSettingsMaxThroughput`. Setting throughput at the keyspace level is only recommended for development/test or when workload across all tables in the shared throughput keyspace is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the table level and not at the keyspace level."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces@2024-11-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the Cassandra keyspace resource."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for an Azure Cosmos DB Cassandra keyspace."
+                              }
+                            },
+                            "defaultIdentityType": {
+                              "type": "object",
+                              "discriminator": {
+                                "propertyName": "name",
+                                "mapping": {
+                                  "FirstPartyIdentity": {
+                                    "$ref": "#/definitions/defaultIdentityFirstPartyType"
+                                  },
+                                  "SystemAssignedIdentity": {
+                                    "$ref": "#/definitions/defaultIdentitySystemAssignedType"
+                                  },
+                                  "UserAssignedIdentity": {
+                                    "$ref": "#/definitions/defaultIdentityUserAssignedType"
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the default identity."
+                              }
+                            },
+                            "defaultIdentityFirstPartyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "FirstPartyIdentity"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of default identity to use."
+                                  }
+                                }
+                              }
+                            },
+                            "defaultIdentitySystemAssignedType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "SystemAssignedIdentity"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of default identity to use."
+                                  }
+                                }
+                              }
+                            },
+                            "defaultIdentityUserAssignedType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "UserAssignedIdentity"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of default identity to use."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the user assigned identity to use as the default identity."
+                                  }
+                                }
+                              }
+                            },
+                            "_1.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "cassandraRoleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The unique identifier of the role assignment."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The unique identifier for the associated AAD principal."
+                                  }
+                                },
+                                "scope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The data plane resource path for which access is being granted. Defaults to the current account."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "cassandra-role-definition/main.bicep"
+                                }
+                              }
+                            },
+                            "cassandraTableType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the table."
+                                  }
+                                },
+                                "schema": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/properties/properties/resource/properties/schema"
+                                    },
+                                    "description": "Required. Schema definition for the table."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags for the table."
+                                  },
+                                  "nullable": true
+                                },
+                                "defaultTtl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default TTL (Time To Live) in seconds for data in the table."
+                                  }
+                                },
+                                "analyticalStorageTtl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Analytical TTL for the table."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                                  }
+                                },
+                                "autoscaleSettingsMaxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum autoscale throughput for the table. Cannot be used with throughput."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a Cassandra table.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "cassandra-keyspace/main.bicep",
+                                  "originalIdentifier": "tableType"
+                                }
+                              }
+                            },
+                            "cassandraViewType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the view."
+                                  }
+                                },
+                                "viewDefinition": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. View definition (CQL statement)."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views@2025-05-01-preview#properties/tags"
+                                    },
+                                    "description": "Optional. Tags for the view."
+                                  },
+                                  "nullable": true
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                                  }
+                                },
+                                "autoscaleSettingsMaxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum autoscale throughput for the view. Cannot be used with throughput."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a Cassandra view (materialized view).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "cassandra-keyspace/main.bicep",
+                                  "originalIdentifier": "viewType"
+                                }
+                              }
+                            },
+                            "collectionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the collection."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                  }
+                                },
+                                "indexes": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/indexes"
+                                    },
+                                    "description": "Required. Indexes for the collection."
+                                  }
+                                },
+                                "shardKey": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/shardKey"
+                                    },
+                                    "description": "Required. ShardKey for the collection."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a collection.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "mongodb-database/main.bicep"
+                                }
+                              }
+                            },
+                            "containerType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the container."
+                                  }
+                                },
+                                "analyticalStorageTtl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                                  }
+                                },
+                                "conflictResolutionPolicy": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/conflictResolutionPolicy"
+                                    },
+                                    "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                                  },
+                                  "nullable": true
+                                },
+                                "defaultTtl": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "minValue": -1,
+                                  "maxValue": 2147483647,
+                                  "metadata": {
+                                    "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                                  }
+                                },
+                                "throughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                  }
+                                },
+                                "autoscaleSettingsMaxThroughput": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "maxValue": 1000000,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the SQL Database resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "paths": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "minLength": 1,
+                                  "maxLength": 3,
+                                  "metadata": {
+                                    "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                                  }
+                                },
+                                "indexingPolicy": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                    },
+                                    "description": "Optional. Indexing policy of the container."
+                                  },
+                                  "nullable": true
+                                },
+                                "uniqueKeyPolicyKeys": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/uniqueKeyPolicy/properties/uniqueKeys"
+                                    },
+                                    "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                                  },
+                                  "nullable": true
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Hash",
+                                    "MultiHash"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                                  }
+                                },
+                                "version": {
+                                  "type": "int",
+                                  "allowedValues": [
+                                    1,
+                                    2
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a container.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "sql-database/main.bicep"
+                                }
+                              }
+                            },
+                            "customerManagedKeyAndVaultOnlyType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                  }
+                                },
+                                "keyName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the customer managed key to use for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a customer-managed key. To be used if only the key vault & key may be specified.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "graphType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the graph."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the Gremlin graph resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "indexingPolicy": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                    },
+                                    "description": "Optional. Indexing policy of the graph."
+                                  },
+                                  "nullable": true
+                                },
+                                "partitionKeyPaths": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/partitionKey/properties/paths"
+                                    },
+                                    "description": "Optional. List of paths using which data within the container can be partitioned."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a graph.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "gremlin-database/main.bicep"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "nestedSqlRoleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                  }
+                                },
+                                "scope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for the SQL Role Assignments.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "sql-role-definition/main.bicep",
+                                  "originalIdentifier": "sqlRoleAssignmentType"
+                                }
+                              }
+                            },
+                            "privateEndpointMultiServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the private endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the account."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Defaults to the current resource group scope location. Location for all resources."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags"
+                                },
+                                "description": "Optional. Tags for the resource."
+                              },
+                              "nullable": true
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "databaseAccountOfferType": {
+                              "type": "string",
+                              "defaultValue": "Standard",
+                              "allowedValues": [
+                                "Standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The offer type for the account. Defaults to \"Standard\"."
+                              }
+                            },
+                            "failoverLocations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/failoverLocationType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed."
+                              }
+                            },
+                            "zoneRedundant": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts."
+                              }
+                            },
+                            "defaultConsistencyLevel": {
+                              "type": "string",
+                              "defaultValue": "Session",
+                              "allowedValues": [
+                                "Eventual",
+                                "ConsistentPrefix",
+                                "Session",
+                                "BoundedStaleness",
+                                "Strong"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The default consistency level of the account. Defaults to \"Session\"."
+                              }
+                            },
+                            "disableLocalAuthentication": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true."
+                              }
+                            },
+                            "enableAnalyticalStorage": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false."
+                              }
+                            },
+                            "enableAutomaticFailover": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable automatic failover for regions. Defaults to true."
+                              }
+                            },
+                            "enableFreeTier": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false."
+                              }
+                            },
+                            "enableMultipleWriteLocations": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false."
+                              }
+                            },
+                            "disableKeyBasedMetadataWriteAccess": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true."
+                              }
+                            },
+                            "maxStalenessPrefix": {
+                              "type": "int",
+                              "defaultValue": 100000,
+                              "minValue": 1,
+                              "maxValue": 2147483647,
+                              "metadata": {
+                                "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000."
+                              }
+                            },
+                            "maxIntervalInSeconds": {
+                              "type": "int",
+                              "defaultValue": 300,
+                              "minValue": 5,
+                              "maxValue": 86400,
+                              "metadata": {
+                                "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300."
+                              }
+                            },
+                            "serverVersion": {
+                              "type": "string",
+                              "defaultValue": "4.2",
+                              "allowedValues": [
+                                "3.2",
+                                "3.6",
+                                "4.0",
+                                "4.2",
+                                "5.0",
+                                "6.0",
+                                "7.0"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"."
+                              }
+                            },
+                            "sqlDatabases": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/sqlDatabaseType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL."
+                              }
+                            },
+                            "mongodbDatabases": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/mongoDbType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU."
+                              }
+                            },
+                            "gremlinDatabases": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/gremlinDatabaseType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin."
+                              }
+                            },
+                            "tables": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/tableType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table."
+                              }
+                            },
+                            "cassandraKeyspaces": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/cassandraKeyspaceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration for keyspaces when using Azure Cosmos DB for Apache Cassandra."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "totalThroughputLimit": {
+                              "type": "int",
+                              "defaultValue": -1,
+                              "metadata": {
+                                "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. An array of control plane Azure role-based access control assignments."
+                              }
+                            },
+                            "sqlRoleDefinitions": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/sqlRoleDefinitionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions."
+                              }
+                            },
+                            "sqlRoleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/sqlRoleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments."
+                              }
+                            },
+                            "cassandraRoleDefinitions": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/cassandraRoleDefinitionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configurations for Azure Cosmos DB for Apache Cassandra native role-based access control definitions. Allows the creations of custom role definitions."
+                              }
+                            },
+                            "cassandraRoleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/cassandraStandaloneRoleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Cosmos DB for Apache Cassandra native data plane role-based access control assignments. Each assignment references a role definition unique identifier and a principal identifier."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings for the service."
+                              }
+                            },
+                            "capabilitiesToAdd": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "allowedValues": [
+                                "EnableCassandra",
+                                "EnableTable",
+                                "EnableGremlin",
+                                "EnableMongo",
+                                "DisableRateLimitingResponses",
+                                "EnableServerless",
+                                "EnableNoSQLVectorSearch",
+                                "EnableNoSQLFullTextSearch",
+                                "EnableMaterializedViews",
+                                "DeleteAllItemsByPartitionKey"
+                              ],
+                              "metadata": {
+                                "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account."
+                              }
+                            },
+                            "backupPolicyType": {
+                              "type": "string",
+                              "defaultValue": "Continuous",
+                              "allowedValues": [
+                                "Periodic",
+                                "Continuous"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"."
+                              }
+                            },
+                            "backupPolicyContinuousTier": {
+                              "type": "string",
+                              "defaultValue": "Continuous30Days",
+                              "allowedValues": [
+                                "Continuous30Days",
+                                "Continuous7Days"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"."
+                              }
+                            },
+                            "backupIntervalInMinutes": {
+                              "type": "int",
+                              "defaultValue": 240,
+                              "minValue": 60,
+                              "maxValue": 1440,
+                              "metadata": {
+                                "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240."
+                              }
+                            },
+                            "backupRetentionIntervalInHours": {
+                              "type": "int",
+                              "defaultValue": 8,
+                              "minValue": 2,
+                              "maxValue": 720,
+                              "metadata": {
+                                "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8."
+                              }
+                            },
+                            "backupStorageRedundancy": {
+                              "type": "string",
+                              "defaultValue": "Local",
+                              "allowedValues": [
+                                "Geo",
+                                "Local",
+                                "Zone"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointMultiServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible."
+                              }
+                            },
+                            "networkRestrictions": {
+                              "$ref": "#/definitions/networkRestrictionType",
+                              "defaultValue": {
+                                "ipRules": [],
+                                "virtualNetworkRules": [],
+                                "publicNetworkAccess": "Disabled"
+                              },
+                              "metadata": {
+                                "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`."
+                              }
+                            },
+                            "minimumTlsVersion": {
+                              "type": "string",
+                              "defaultValue": "Tls12",
+                              "allowedValues": [
+                                "Tls12"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)."
+                              }
+                            },
+                            "enableBurstCapacity": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Flag to indicate enabling/disabling of Burst Capacity feature on the account. Cannot be enabled for serverless accounts."
+                              }
+                            },
+                            "enableCassandraConnector": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enables the cassandra connector on the Cosmos DB C* account."
+                              }
+                            },
+                            "enablePartitionMerge": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Flag to enable/disable the 'Partition Merge' feature on the account."
+                              }
+                            },
+                            "enablePerRegionPerPartitionAutoscale": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Flag to enable/disable the 'PerRegionPerPartitionAutoscale' feature on the account."
+                              }
+                            },
+                            "analyticalStorageConfiguration": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.DocumentDB/databaseAccounts@2025-04-15#properties/properties/properties/analyticalStorageConfiguration"
+                                },
+                                "description": "Optional. Analytical storage specific properties."
+                              },
+                              "nullable": true
+                            },
+                            "cors": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.DocumentDB/databaseAccounts@2025-04-15#properties/properties/properties/cors"
+                                },
+                                "description": "Optional. The CORS policy for the Cosmos DB database account."
+                              },
+                              "nullable": true
+                            },
+                            "defaultIdentity": {
+                              "$ref": "#/definitions/defaultIdentityType",
+                              "defaultValue": {
+                                "name": "FirstPartyIdentity"
+                              },
+                              "metadata": {
+                                "description": "Optional. The default identity for accessing key vault used in features like customer managed keys. Use `FirstPartyIdentity` to use the tenant-level CosmosDB enterprise application. The default identity needs to be explicitly set by the users."
+                              }
+                            },
+                            "customerManagedKey": {
+                              "$ref": "#/definitions/customerManagedKeyAndVaultOnlyType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The customer managed key definition. If specified, the parameter `defaultIdentity` must be configured as well."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(variables('formattedUserAssignedIdentities'))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(variables('formattedUserAssignedIdentities'))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInControlPlaneRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]",
+                              "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
+                              "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]",
+                              "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]",
+                              "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            },
+                            "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                          },
+                          "resources": {
+                            "cMKKeyVault::cMKKey": {
+                              "condition": "[and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults/keys",
+                              "apiVersion": "2024-11-01",
+                              "subscriptionId": "[split(parameters('customerManagedKey').keyVaultResourceId, '/')[2]]",
+                              "resourceGroup": "[split(parameters('customerManagedKey').keyVaultResourceId, '/')[4]]",
+                              "name": "[format('{0}/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName)]"
+                            },
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-07-01",
+                              "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.19.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "cMKKeyVault": {
+                              "condition": "[and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2024-11-01",
+                              "subscriptionId": "[split(parameters('customerManagedKey').keyVaultResourceId, '/')[2]]",
+                              "resourceGroup": "[split(parameters('customerManagedKey').keyVaultResourceId, '/')[4]]",
+                              "name": "[last(split(parameters('customerManagedKey').keyVaultResourceId, '/'))]"
+                            },
+                            "databaseAccount": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2025-04-15",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]",
+                              "properties": "[shallowMerge(createArray(createObject('enableBurstCapacity', if(not(contains(coalesce(parameters('capabilitiesToAdd'), createArray()), 'EnableServerless')), parameters('enableBurstCapacity'), false()), 'databaseAccountOfferType', parameters('databaseAccountOfferType'), 'analyticalStorageConfiguration', parameters('analyticalStorageConfiguration'), 'defaultIdentity', if(and(not(empty(parameters('defaultIdentity'))), not(equals(tryGet(parameters('defaultIdentity'), 'name'), 'UserAssignedIdentity'))), parameters('defaultIdentity').name, format('UserAssignedIdentity={0}', tryGet(parameters('defaultIdentity'), 'resourceId'))), 'keyVaultKeyUri', if(not(empty(parameters('customerManagedKey'))), if(not(variables('isHSMManagedCMK')), format('{0}', reference('cMKKeyVault::cMKKey').keyUri), format('https://{0}.managedhsm.azure.net/keys/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName)), null()), 'enablePartitionMerge', parameters('enablePartitionMerge'), 'enablePerRegionPerPartitionAutoscale', parameters('enablePerRegionPerPartitionAutoscale'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability'))))), if(not(empty(parameters('cors'))), createObject('cors', parameters('cors')), createObject()), if(contains(coalesce(parameters('capabilitiesToAdd'), createArray()), 'EnableCassandra'), createObject('connectorOffer', if(parameters('enableCassandraConnector'), 'Small', null()), 'enableCassandraConnector', parameters('enableCassandraConnector')), createObject()), createObject('minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant'))))), if(or(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), not(empty(parameters('cassandraKeyspaces')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'networkAclBypassResourceIds', tryGet(parameters('networkRestrictions'), 'networkAclBypassResourceIds'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('enableAutomaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('cassandraKeyspaces')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]",
+                              "dependsOn": [
+                                "cMKKeyVault::cMKKey"
+                              ]
+                            },
+                            "databaseAccount_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_diagnosticSettings": {
+                              "copy": {
+                                "name": "databaseAccount_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_roleAssignments": {
+                              "copy": {
+                                "name": "databaseAccount_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_sqlDatabases": {
+                              "copy": {
+                                "name": "databaseAccount_sqlDatabases",
+                                "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]"
+                                  },
+                                  "containers": {
+                                    "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]"
+                                  },
+                                  "throughput": {
+                                    "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]"
+                                  },
+                                  "databaseAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "autoscaleSettingsMaxThroughput": {
+                                    "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "3972888645334640168"
+                                    },
+                                    "name": "DocumentDB Database Account SQL Databases",
+                                    "description": "This module deploys a SQL Database in a CosmosDB Account."
+                                  },
+                                  "definitions": {
+                                    "containerType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of the container."
+                                          }
+                                        },
+                                        "analyticalStorageTtl": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                                          }
+                                        },
+                                        "conflictResolutionPolicy": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/conflictResolutionPolicy"
+                                            },
+                                            "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "defaultTtl": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "minValue": -1,
+                                          "maxValue": 2147483647,
+                                          "metadata": {
+                                            "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                                          }
+                                        },
+                                        "throughput": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                          }
+                                        },
+                                        "autoscaleSettingsMaxThroughput": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "maxValue": 1000000,
+                                          "metadata": {
+                                            "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the SQL Database resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "paths": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "minLength": 1,
+                                          "maxLength": 3,
+                                          "metadata": {
+                                            "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                                          }
+                                        },
+                                        "indexingPolicy": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                            },
+                                            "description": "Optional. Indexing policy of the container."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "uniqueKeyPolicyKeys": {
+                                          "type": "array",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/uniqueKeyPolicy/properties/uniqueKeys"
+                                            },
+                                            "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Hash",
+                                            "MultiHash"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                                          }
+                                        },
+                                        "version": {
+                                          "type": "int",
+                                          "allowedValues": [
+                                            1,
+                                            2
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a container."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the SQL database ."
+                                      }
+                                    },
+                                    "containers": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/containerType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of containers to deploy in the SQL database."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                      }
+                                    },
+                                    "autoscaleSettingsMaxThroughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2025-04-15#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the SQL database resource."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "sqlDatabase": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "resource": {
+                                          "id": "[parameters('name')]"
+                                        },
+                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "container": {
+                                      "copy": {
+                                        "name": "container",
+                                        "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "databaseAccountName": {
+                                            "value": "[parameters('databaseAccountName')]"
+                                          },
+                                          "sqlDatabaseName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
+                                          },
+                                          "analyticalStorageTtl": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]"
+                                          },
+                                          "autoscaleSettingsMaxThroughput": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                          },
+                                          "conflictResolutionPolicy": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]"
+                                          },
+                                          "defaultTtl": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]"
+                                          },
+                                          "indexingPolicy": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]"
+                                          },
+                                          "kind": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]"
+                                          },
+                                          "version": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]"
+                                          },
+                                          "paths": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]"
+                                          },
+                                          "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]",
+                                          "uniqueKeyPolicyKeys": {
+                                            "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.40.2.10011",
+                                              "templateHash": "4781880351108045502"
+                                            },
+                                            "name": "DocumentDB Database Account SQL Database Containers",
+                                            "description": "This module deploys a SQL Database Container in a CosmosDB Account."
+                                          },
+                                          "parameters": {
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "sqlDatabaseName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the container."
+                                              }
+                                            },
+                                            "analyticalStorageTtl": {
+                                              "type": "int",
+                                              "defaultValue": 0,
+                                              "metadata": {
+                                                "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                                              }
+                                            },
+                                            "conflictResolutionPolicy": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/conflictResolutionPolicy"
+                                                },
+                                                "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "defaultTtl": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": -1,
+                                              "maxValue": 2147483647,
+                                              "metadata": {
+                                                "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                                              }
+                                            },
+                                            "throughput": {
+                                              "type": "int",
+                                              "defaultValue": 400,
+                                              "metadata": {
+                                                "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                              }
+                                            },
+                                            "autoscaleSettingsMaxThroughput": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "maxValue": 1000000,
+                                              "metadata": {
+                                                "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/tags"
+                                                },
+                                                "description": "Optional. Tags of the SQL Database resource."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "paths": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 3,
+                                              "metadata": {
+                                                "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                                              }
+                                            },
+                                            "indexingPolicy": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                                },
+                                                "description": "Optional. Indexing policy of the container."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "uniqueKeyPolicyKeys": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2025-04-15#properties/properties/properties/resource/properties/uniqueKeyPolicy/properties/uniqueKeys"
+                                                },
+                                                "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "kind": {
+                                              "type": "string",
+                                              "defaultValue": "Hash",
+                                              "allowedValues": [
+                                                "Hash",
+                                                "MultiHash"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                                              }
+                                            },
+                                            "version": {
+                                              "type": "int",
+                                              "defaultValue": 1,
+                                              "allowedValues": [
+                                                1,
+                                                2
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "partitionKeyPaths",
+                                                "count": "[length(parameters('paths'))]",
+                                                "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]"
+                                              }
+                                            ]
+                                          },
+                                          "resources": {
+                                            "databaseAccount::sqlDatabase": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                                              "apiVersion": "2025-04-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]"
+                                            },
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2025-04-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "container": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
+                                              "apiVersion": "2025-04-15",
+                                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "resource": "[shallowMerge(createArray(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'id', parameters('name'), 'indexingPolicy', parameters('indexingPolicy'), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()), if(not(equals(parameters('defaultTtl'), null())), createObject('defaultTtl', parameters('defaultTtl')), createObject())))]",
+                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                                              },
+                                              "dependsOn": [
+                                                "databaseAccount"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the container."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the container."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the container was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "sqlDatabase"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the SQL database."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the SQL database."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the SQL database was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_sqlRoleDefinitions": {
+                              "copy": {
+                                "name": "databaseAccount_sqlRoleDefinitions",
+                                "count": "[length(coalesce(parameters('sqlRoleDefinitions'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "dataActions": {
+                                    "value": "[coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].dataActions]"
+                                  },
+                                  "roleName": {
+                                    "value": "[coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()].roleName]"
+                                  },
+                                  "assignableScopes": {
+                                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]"
+                                  },
+                                  "sqlRoleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('sqlRoleDefinitions'), createArray())[copyIndex()], 'assignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "8514367433037227852"
+                                    },
+                                    "name": "DocumentDB Database Account SQL Role Definitions.",
+                                    "description": "This module deploys a SQL Role Definision in a CosmosDB Account."
+                                  },
+                                  "definitions": {
+                                    "sqlRoleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                          }
+                                        },
+                                        "scope": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the SQL Role Assignments."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The unique identifier of the Role Definition."
+                                      }
+                                    },
+                                    "roleName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account."
+                                      }
+                                    },
+                                    "dataActions": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "minLength": 1,
+                                      "metadata": {
+                                        "description": "Required. An array of data actions that are allowed."
+                                      }
+                                    },
+                                    "assignableScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account."
+                                      }
+                                    },
+                                    "sqlRoleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/sqlRoleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "enableReferencedModulesTelemetry": false
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "sqlRoleDefinition": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]",
+                                      "properties": {
+                                        "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]",
+                                        "permissions": [
+                                          {
+                                            "dataActions": "[parameters('dataActions')]"
+                                          }
+                                        ],
+                                        "roleName": "[parameters('roleName')]",
+                                        "type": "CustomRole"
+                                      }
+                                    },
+                                    "databaseAccount_sqlRoleAssignments": {
+                                      "copy": {
+                                        "name": "databaseAccount_sqlRoleAssignments",
+                                        "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "databaseAccountName": {
+                                            "value": "[parameters('databaseAccountName')]"
+                                          },
+                                          "roleDefinitionIdOrName": {
+                                            "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]"
+                                          },
+                                          "principalId": {
+                                            "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                          },
+                                          "name": {
+                                            "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.40.2.10011",
+                                              "templateHash": "11817543900771838380"
+                                            },
+                                            "name": "DocumentDB Database Account SQL Role Assignments.",
+                                            "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
+                                          },
+                                          "parameters": {
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                              }
+                                            },
+                                            "principalId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                              }
+                                            },
+                                            "roleDefinitionIdOrName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The unique identifier of the associated SQL Role Definition."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            },
+                                            "scope": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "builtInDataPlaneRoleNames": {
+                                              "Cosmos DB Built-in Data Reader": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000001', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]",
+                                              "Cosmos DB Built-in Data Contributor": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
+                                            },
+                                            "formattedRoleDefinition": "[coalesce(tryGet(variables('builtInDataPlaneRoleNames'), parameters('roleDefinitionIdOrName')), if(contains(parameters('roleDefinitionIdOrName'), '/sqlRoleDefinitions/'), parameters('roleDefinitionIdOrName'), format('{0}/sqlRoleDefinitions/{1}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('roleDefinitionIdOrName'))))]",
+                                            "formattedScope": "[replace(replace(coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))), '/sqlDatabases/', '/dbs/'), '/containers/', '/colls/')]"
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "sqlRoleAssignment": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope'))))]",
+                                              "properties": {
+                                                "principalId": "[parameters('principalId')]",
+                                                "roleDefinitionId": "[variables('formattedRoleDefinition')]",
+                                                "scope": "[variables('formattedScope')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the SQL Role Assignment."
+                                              },
+                                              "value": "[coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope')))]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the SQL Role Assignment."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope'))))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the SQL Role Definition was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "sqlRoleDefinition"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the SQL Role Definition."
+                                      },
+                                      "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName')))]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the SQL Role Definition."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the SQL Role Definition was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "roleName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The role name of the SQL Role Definition."
+                                      },
+                                      "value": "[reference('sqlRoleDefinition').roleName]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_sqlRoleAssignments": {
+                              "copy": {
+                                "name": "databaseAccount_sqlRoleAssignments",
+                                "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "roleDefinitionIdOrName": {
+                                    "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                                  },
+                                  "principalId": {
+                                    "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "scope": {
+                                    "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'scope')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "11817543900771838380"
+                                    },
+                                    "name": "DocumentDB Database Account SQL Role Assignments.",
+                                    "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                      }
+                                    },
+                                    "principalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                      }
+                                    },
+                                    "roleDefinitionIdOrName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier of the associated SQL Role Definition."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "scope": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The data plane resource id for which access is being granted through this Role Assignment. Defaults to the root of the database account, but can also be scoped to e.g., the container and database level."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "builtInDataPlaneRoleNames": {
+                                      "Cosmos DB Built-in Data Reader": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000001', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]",
+                                      "Cosmos DB Built-in Data Contributor": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
+                                    },
+                                    "formattedRoleDefinition": "[coalesce(tryGet(variables('builtInDataPlaneRoleNames'), parameters('roleDefinitionIdOrName')), if(contains(parameters('roleDefinitionIdOrName'), '/sqlRoleDefinitions/'), parameters('roleDefinitionIdOrName'), format('{0}/sqlRoleDefinitions/{1}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('roleDefinitionIdOrName'))))]",
+                                    "formattedScope": "[replace(replace(coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))), '/sqlDatabases/', '/dbs/'), '/containers/', '/colls/')]"
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "sqlRoleAssignment": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope'))))]",
+                                      "properties": {
+                                        "principalId": "[parameters('principalId')]",
+                                        "roleDefinitionId": "[variables('formattedRoleDefinition')]",
+                                        "scope": "[variables('formattedScope')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the SQL Role Assignment."
+                                      },
+                                      "value": "[coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope')))]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the SQL Role Assignment."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(variables('formattedRoleDefinition'), parameters('principalId'), variables('formattedScope'))))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the SQL Role Definition was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount",
+                                "databaseAccount_sqlDatabases",
+                                "databaseAccount_sqlRoleDefinitions"
+                              ]
+                            },
+                            "databaseAccount_cassandraRoleDefinitions": {
+                              "copy": {
+                                "name": "databaseAccount_cassandraRoleDefinitions",
+                                "count": "[length(coalesce(parameters('cassandraRoleDefinitions'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-cassandra-rd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "roleName": {
+                                    "value": "[coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()].roleName]"
+                                  },
+                                  "dataActions": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]"
+                                  },
+                                  "notDataActions": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'notDataActions')]"
+                                  },
+                                  "assignableScopes": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]"
+                                  },
+                                  "cassandraRoleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraRoleDefinitions'), createArray())[copyIndex()], 'assignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "10787709019875067397"
+                                    },
+                                    "name": "DocumentDB Database Account Cassandra Role Definitions.",
+                                    "description": "This module deploys a Cassandra Role Definition in a CosmosDB Account."
+                                  },
+                                  "definitions": {
+                                    "cassandraRoleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The unique identifier of the role assignment."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The unique identifier for the associated AAD principal."
+                                          }
+                                        },
+                                        "scope": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The data plane resource path for which access is being granted. Defaults to the current account."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The unique identifier of the Role Definition."
+                                      }
+                                    },
+                                    "roleName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account."
+                                      }
+                                    },
+                                    "dataActions": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. An array of data actions that are allowed. Note: Valid data action strings for Cassandra API are currently undocumented (as of API version 2025-05-01-preview). Please refer to official Azure documentation once available."
+                                      }
+                                    },
+                                    "notDataActions": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. An array of data actions that are denied. Note: Unlike SQL RBAC, Cassandra RBAC supports deny rules (notDataActions) for granular access control. Valid data action strings are currently undocumented (as of API version 2025-05-01-preview)."
+                                      }
+                                    },
+                                    "assignableScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Keyspace. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account."
+                                      }
+                                    },
+                                    "cassandraRoleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/cassandraRoleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. An array of Cassandra Role Assignments to be created for the Cassandra Role Definition."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "cassandraRoleDefinition": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions",
+                                      "apiVersion": "2025-05-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]",
+                                      "properties": {
+                                        "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]",
+                                        "permissions": [
+                                          {
+                                            "dataActions": "[parameters('dataActions')]",
+                                            "notDataActions": "[parameters('notDataActions')]"
+                                          }
+                                        ],
+                                        "roleName": "[parameters('roleName')]",
+                                        "type": "CustomRole"
+                                      }
+                                    },
+                                    "databaseAccount_cassandraRoleAssignments": {
+                                      "copy": {
+                                        "name": "databaseAccount_cassandraRoleAssignments",
+                                        "count": "[length(coalesce(parameters('cassandraRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-cassandra-ra-{1}', uniqueString(deployment().name), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "databaseAccountName": {
+                                            "value": "[parameters('databaseAccountName')]"
+                                          },
+                                          "roleDefinitionId": {
+                                            "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]"
+                                          },
+                                          "principalId": {
+                                            "value": "[coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                          },
+                                          "name": {
+                                            "value": "[tryGet(coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                          },
+                                          "scope": {
+                                            "value": "[tryGet(coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()], 'scope')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.40.2.10011",
+                                              "templateHash": "14764024820910071147"
+                                            },
+                                            "name": "DocumentDB Database Account Cassandra Role Assignments.",
+                                            "description": "This module deploys a Cassandra Role Assignment in a CosmosDB Account."
+                                          },
+                                          "parameters": {
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Name unique identifier of the Cassandra Role Assignment."
+                                              }
+                                            },
+                                            "principalId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                              }
+                                            },
+                                            "roleDefinitionId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The unique identifier of the associated Cassandra Role Definition."
+                                              }
+                                            },
+                                            "scope": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The data plane resource path for which access is being granted through this Cassandra Role Assignment. Defaults to the current account."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "cassandraRoleAssignment": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments",
+                                              "apiVersion": "2025-05-01-preview",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
+                                              "properties": {
+                                                "principalId": "[parameters('principalId')]",
+                                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                                "scope": "[coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the Cassandra Role Assignment."
+                                              },
+                                              "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the Cassandra Role Assignment."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the Cassandra Role Assignment was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "cassandraRoleDefinition"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the cassandra role definition."
+                                      },
+                                      "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName')))]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the cassandra role definition."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), parameters('roleName'))))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the cassandra role definition was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_cassandraRoleAssignments": {
+                              "copy": {
+                                "name": "databaseAccount_cassandraRoleAssignments",
+                                "count": "[length(coalesce(parameters('cassandraRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-cassandra-ra-{1}', uniqueString(deployment().name), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "roleDefinitionId": {
+                                    "value": "[coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                                  },
+                                  "principalId": {
+                                    "value": "[coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "scope": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraRoleAssignments'), createArray())[copyIndex()], 'scope')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "14764024820910071147"
+                                    },
+                                    "name": "DocumentDB Database Account Cassandra Role Assignments.",
+                                    "description": "This module deploys a Cassandra Role Assignment in a CosmosDB Account."
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name unique identifier of the Cassandra Role Assignment."
+                                      }
+                                    },
+                                    "principalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                      }
+                                    },
+                                    "roleDefinitionId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier of the associated Cassandra Role Definition."
+                                      }
+                                    },
+                                    "scope": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The data plane resource path for which access is being granted through this Cassandra Role Assignment. Defaults to the current account."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "cassandraRoleAssignment": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments",
+                                      "apiVersion": "2025-05-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
+                                      "properties": {
+                                        "principalId": "[parameters('principalId')]",
+                                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                        "scope": "[coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Cassandra Role Assignment."
+                                      },
+                                      "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Cassandra Role Assignment."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the Cassandra Role Assignment was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount",
+                                "databaseAccount_cassandraKeyspaces",
+                                "databaseAccount_cassandraRoleDefinitions"
+                              ]
+                            },
+                            "databaseAccount_mongodbDatabases": {
+                              "copy": {
+                                "name": "databaseAccount_mongodbDatabases",
+                                "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "collections": {
+                                    "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]"
+                                  },
+                                  "throughput": {
+                                    "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]"
+                                  },
+                                  "autoscaleSettings": {
+                                    "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'autoscaleSettings')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "13897098552792121791"
+                                    },
+                                    "name": "DocumentDB Database Account MongoDB Databases",
+                                    "description": "This module deploys a MongoDB Database within a CosmosDB Account."
+                                  },
+                                  "definitions": {
+                                    "collectionType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of the collection."
+                                          }
+                                        },
+                                        "throughput": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                          }
+                                        },
+                                        "indexes": {
+                                          "type": "array",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/indexes"
+                                            },
+                                            "description": "Required. Indexes for the collection."
+                                          }
+                                        },
+                                        "shardKey": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/shardKey"
+                                            },
+                                            "description": "Required. ShardKey for the collection."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a collection."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the mongodb database."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "defaultValue": 400,
+                                      "metadata": {
+                                        "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                      }
+                                    },
+                                    "collections": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/collectionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Collections in the mongodb database."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases@2025-04-15#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "autoscaleSettings": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases@2025-04-15#properties/properties/properties/options/properties/autoscaleSettings"
+                                        },
+                                        "description": "Optional. Specifies the Autoscale settings. Note: Either throughput or autoscaleSettings is required, but not both."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "mongodbDatabase": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "resource": {
+                                          "id": "[parameters('name')]"
+                                        },
+                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput'), 'autoscaleSettings', parameters('autoscaleSettings')))]"
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "mongodbDatabase_collections": {
+                                      "copy": {
+                                        "name": "mongodbDatabase_collections",
+                                        "count": "[length(coalesce(parameters('collections'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "databaseAccountName": {
+                                            "value": "[parameters('databaseAccountName')]"
+                                          },
+                                          "mongodbDatabaseName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]"
+                                          },
+                                          "indexes": {
+                                            "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]"
+                                          },
+                                          "shardKey": {
+                                            "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]"
+                                          },
+                                          "throughput": {
+                                            "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.40.2.10011",
+                                              "templateHash": "16151461445994734468"
+                                            },
+                                            "name": "DocumentDB Database Account MongoDB Database Collections",
+                                            "description": "This module deploys a MongoDB Database Collection."
+                                          },
+                                          "parameters": {
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "mongodbDatabaseName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the collection."
+                                              }
+                                            },
+                                            "throughput": {
+                                              "type": "int",
+                                              "defaultValue": 400,
+                                              "metadata": {
+                                                "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                              }
+                                            },
+                                            "indexes": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/indexes"
+                                                },
+                                                "description": "Required. Indexes for the collection."
+                                              }
+                                            },
+                                            "shardKey": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections@2025-04-15#properties/properties/properties/resource/properties/shardKey"
+                                                },
+                                                "description": "Required. ShardKey for the collection."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections",
+                                              "apiVersion": "2025-04-15",
+                                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]",
+                                              "properties": {
+                                                "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2025-04-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]",
+                                                "resource": {
+                                                  "id": "[parameters('name')]",
+                                                  "indexes": "[parameters('indexes')]",
+                                                  "shardKey": "[parameters('shardKey')]"
+                                                }
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the mongodb database collection."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the mongodb database collection."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the mongodb database collection was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "mongodbDatabase"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the mongodb database."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the mongodb database."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the mongodb database was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_gremlinDatabases": {
+                              "copy": {
+                                "name": "databaseAccount_gremlinDatabases",
+                                "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "graphs": {
+                                    "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]"
+                                  },
+                                  "maxThroughput": {
+                                    "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]"
+                                  },
+                                  "throughput": {
+                                    "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "11959636451300474346"
+                                    },
+                                    "name": "DocumentDB Database Account Gremlin Databases",
+                                    "description": "This module deploys a Gremlin Database within a CosmosDB Account."
+                                  },
+                                  "definitions": {
+                                    "graphType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of the graph."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the Gremlin graph resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "indexingPolicy": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                            },
+                                            "description": "Optional. Indexing policy of the graph."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "partitionKeyPaths": {
+                                          "type": "array",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/partitionKey/properties/paths"
+                                            },
+                                            "description": "Optional. List of paths using which data within the container can be partitioned."
+                                          },
+                                          "nullable": true
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a graph."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the Gremlin database."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases@2024-11-15#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the Gremlin database resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "graphs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/graphType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of graphs to deploy in the Gremlin database."
+                                      }
+                                    },
+                                    "maxThroughput": {
+                                      "type": "int",
+                                      "defaultValue": 4000,
+                                      "metadata": {
+                                        "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "gremlinDatabase": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                        "resource": {
+                                          "id": "[parameters('name')]"
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "gremlinDatabase_gremlinGraphs": {
+                                      "copy": {
+                                        "name": "gremlinDatabase_gremlinGraphs",
+                                        "count": "[length(coalesce(parameters('graphs'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('graphs'), createArray())[copyIndex()].name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(parameters('graphs'), createArray())[copyIndex()].name]"
+                                          },
+                                          "gremlinDatabaseName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "databaseAccountName": {
+                                            "value": "[parameters('databaseAccountName')]"
+                                          },
+                                          "indexingPolicy": {
+                                            "value": "[tryGet(coalesce(parameters('graphs'), createArray())[copyIndex()], 'indexingPolicy')]"
+                                          },
+                                          "partitionKeyPaths": {
+                                            "value": "[tryGet(coalesce(parameters('graphs'), createArray())[copyIndex()], 'partitionKeyPaths')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.40.2.10011",
+                                              "templateHash": "10487122333182352122"
+                                            },
+                                            "name": "DocumentDB Database Accounts Gremlin Databases Graphs",
+                                            "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph."
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the graph."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/tags"
+                                                },
+                                                "description": "Optional. Tags of the Gremlin graph resource."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "gremlinDatabaseName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "indexingPolicy": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/indexingPolicy"
+                                                },
+                                                "description": "Optional. Indexing policy of the graph."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "partitionKeyPaths": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs@2025-04-15#properties/properties/properties/resource/properties/partitionKey/properties/paths"
+                                                },
+                                                "description": "Optional. List of paths using which data within the container can be partitioned."
+                                              },
+                                              "nullable": true
+                                            }
+                                          },
+                                          "resources": {
+                                            "databaseAccount::gremlinDatabase": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                                              "apiVersion": "2025-04-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]"
+                                            },
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2025-04-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "gremlinGraph": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs",
+                                              "apiVersion": "2025-04-15",
+                                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "resource": {
+                                                  "id": "[parameters('name')]",
+                                                  "indexingPolicy": "[parameters('indexingPolicy')]",
+                                                  "partitionKey": {
+                                                    "paths": "[parameters('partitionKeyPaths')]"
+                                                  }
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the graph."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the graph."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the graph was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "gremlinDatabase"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Gremlin database."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Gremlin database."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the Gremlin database was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_tables": {
+                              "copy": {
+                                "name": "databaseAccount_tables",
+                                "count": "[length(coalesce(parameters('tables'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "maxThroughput": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]"
+                                  },
+                                  "throughput": {
+                                    "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "1787500858429182824"
+                                    },
+                                    "name": "Azure Cosmos DB account tables",
+                                    "description": "This module deploys a table within an Azure Cosmos DB Account."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the table."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/tables@2025-04-15#properties/tags"
+                                        },
+                                        "description": "Optional. Tags for the table."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "maxThroughput": {
+                                      "type": "int",
+                                      "defaultValue": 4000,
+                                      "metadata": {
+                                        "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "table": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/tables",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                        "resource": {
+                                          "id": "[parameters('name')]"
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the table."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the table."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the table was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_cassandraKeyspaces": {
+                              "copy": {
+                                "name": "databaseAccount_cassandraKeyspaces",
+                                "count": "[length(coalesce(parameters('cassandraKeyspaces'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-cassandradb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()].name]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "tables": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'tables')]"
+                                  },
+                                  "views": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'views')]"
+                                  },
+                                  "autoscaleSettingsMaxThroughput": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                  },
+                                  "throughput": {
+                                    "value": "[tryGet(coalesce(parameters('cassandraKeyspaces'), createArray())[copyIndex()], 'throughput')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.40.2.10011",
+                                      "templateHash": "15257396763463366586"
+                                    },
+                                    "name": "DocumentDB Database Account Cassandra Keyspaces",
+                                    "description": "This module deploys a Cassandra Keyspace within a CosmosDB Account."
+                                  },
+                                  "definitions": {
+                                    "tableType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of the table."
+                                          }
+                                        },
+                                        "schema": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/properties/properties/resource/properties/schema"
+                                            },
+                                            "description": "Required. Schema definition for the table."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/tags"
+                                            },
+                                            "description": "Optional. Tags for the table."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "defaultTtl": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Default TTL (Time To Live) in seconds for data in the table."
+                                          }
+                                        },
+                                        "analyticalStorageTtl": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Analytical TTL for the table."
+                                          }
+                                        },
+                                        "throughput": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                                          }
+                                        },
+                                        "autoscaleSettingsMaxThroughput": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum autoscale throughput for the table. Cannot be used with throughput."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a Cassandra table."
+                                      }
+                                    },
+                                    "viewType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of the view."
+                                          }
+                                        },
+                                        "viewDefinition": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. View definition (CQL statement)."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views@2025-05-01-preview#properties/tags"
+                                            },
+                                            "description": "Optional. Tags for the view."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "throughput": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                                          }
+                                        },
+                                        "autoscaleSettingsMaxThroughput": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum autoscale throughput for the view. Cannot be used with throughput."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a Cassandra view (materialized view)."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the Cassandra keyspace."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces@2024-11-15#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the Cassandra keyspace resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Cosmos DB account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "tables": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/tableType"
+                                      },
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. Array of Cassandra tables to deploy in the keyspace."
+                                      }
+                                    },
+                                    "views": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/viewType"
+                                      },
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. Array of Cassandra views (materialized views) to deploy in the keyspace."
+                                      }
+                                    },
+                                    "autoscaleSettingsMaxThroughput": {
+                                      "type": "int",
+                                      "defaultValue": 4000,
+                                      "metadata": {
+                                        "description": "Optional. Maximum autoscale throughput for the keyspace. If not set, autoscale will be disabled. Setting throughput at the keyspace level is only recommended for development/test or when workload across all tables in the shared throughput keyspace is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the table level."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput. Setting throughput at the keyspace level is only recommended for development/test or when workload across all tables in the shared throughput keyspace is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the table level."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "cassandraKeyspace": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                        "resource": {
+                                          "id": "[parameters('name')]"
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "cassandraKeyspace_tables": {
+                                      "copy": {
+                                        "name": "cassandraKeyspace_tables",
+                                        "count": "[length(parameters('tables'))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-cassandradb-{1}', uniqueString(deployment().name, parameters('name')), parameters('tables')[copyIndex()].name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[parameters('tables')[copyIndex()].name]"
+                                          },
+                                          "cassandraKeyspaceName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "databaseAccountName": {
+                                            "value": "[parameters('databaseAccountName')]"
+                                          },
+                                          "schema": {
+                                            "value": "[parameters('tables')[copyIndex()].schema]"
+                                          },
+                                          "analyticalStorageTtl": {
+                                            "value": "[tryGet(parameters('tables')[copyIndex()], 'analyticalStorageTtl')]"
+                                          },
+                                          "throughput": {
+                                            "value": "[tryGet(parameters('tables')[copyIndex()], 'throughput')]"
+                                          },
+                                          "autoscaleSettingsMaxThroughput": {
+                                            "value": "[tryGet(parameters('tables')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                          },
+                                          "defaultTtl": {
+                                            "value": "[tryGet(parameters('tables')[copyIndex()], 'defaultTtl')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(parameters('tables')[copyIndex()], 'tags'), parameters('tags'))]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.40.2.10011",
+                                              "templateHash": "15998065591386988132"
+                                            },
+                                            "name": "DocumentDB Database Account Cassandra Keyspaces Tables",
+                                            "description": "This module deploys a Cassandra Table within a Cassandra Keyspace in a CosmosDB Account."
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the Cassandra table."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/tags"
+                                                },
+                                                "description": "Optional. Tags of the Cassandra table resource."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "cassandraKeyspaceName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Cassandra Keyspace. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "schema": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables@2024-11-15#properties/properties/properties/resource/properties/schema"
+                                                },
+                                                "description": "Required. Schema definition for the Cassandra table."
+                                              }
+                                            },
+                                            "analyticalStorageTtl": {
+                                              "type": "int",
+                                              "defaultValue": 0,
+                                              "metadata": {
+                                                "description": "Optional. Analytical TTL for the table. Default to 0 (disabled). Analytical store is enabled when set to a value other than 0. If set to -1, analytical store retains all historical data."
+                                              }
+                                            },
+                                            "throughput": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput. If not specified, the table will inherit throughput from the keyspace."
+                                              }
+                                            },
+                                            "autoscaleSettingsMaxThroughput": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Maximum autoscale throughput for the table. Cannot be used with throughput. If not specified, the table will inherit throughput from the keyspace."
+                                              }
+                                            },
+                                            "defaultTtl": {
+                                              "type": "int",
+                                              "defaultValue": 0,
+                                              "metadata": {
+                                                "description": "Optional. Default time to live in seconds. Default to 0 (disabled). If set to -1, items do not expire."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "databaseAccount::cassandraKeyspace": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'))]"
+                                            },
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "cassandraTable": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "resource": {
+                                                  "id": "[parameters('name')]",
+                                                  "schema": "[parameters('schema')]",
+                                                  "defaultTtl": "[parameters('defaultTtl')]",
+                                                  "analyticalStorageTtl": "[parameters('analyticalStorageTtl')]"
+                                                },
+                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(and(equals(parameters('throughput'), null()), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null()), 'throughput', parameters('throughput')))]"
+                                              },
+                                              "dependsOn": [
+                                                "databaseAccount"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the Cassandra table."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the Cassandra table."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/tables', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the Cassandra table was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "cassandraKeyspace"
+                                      ]
+                                    },
+                                    "cassandraKeyspace_views": {
+                                      "copy": {
+                                        "name": "cassandraKeyspace_views",
+                                        "count": "[length(parameters('views'))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-cassandraview-{1}', uniqueString(deployment().name, parameters('name')), parameters('views')[copyIndex()].name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[parameters('views')[copyIndex()].name]"
+                                          },
+                                          "cassandraKeyspaceName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "databaseAccountName": {
+                                            "value": "[parameters('databaseAccountName')]"
+                                          },
+                                          "viewDefinition": {
+                                            "value": "[parameters('views')[copyIndex()].viewDefinition]"
+                                          },
+                                          "throughput": {
+                                            "value": "[tryGet(parameters('views')[copyIndex()], 'throughput')]"
+                                          },
+                                          "autoscaleSettingsMaxThroughput": {
+                                            "value": "[tryGet(parameters('views')[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(parameters('views')[copyIndex()], 'tags'), parameters('tags'))]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.40.2.10011",
+                                              "templateHash": "6617803098467821091"
+                                            },
+                                            "name": "DocumentDB Database Account Cassandra Keyspaces Views",
+                                            "description": "This module deploys a Cassandra View (Materialized View) within a Cassandra Keyspace in a CosmosDB Account."
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the Cassandra view."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views@2025-05-01-preview#properties/tags"
+                                                },
+                                                "description": "Optional. Tags of the Cassandra view resource."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "cassandraKeyspaceName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Cassandra Keyspace. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "viewDefinition": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. View definition of the Cassandra view. This is the CQL statement that defines the materialized view."
+                                              }
+                                            },
+                                            "throughput": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Request units per second. Cannot be used with autoscaleSettingsMaxThroughput."
+                                              }
+                                            },
+                                            "autoscaleSettingsMaxThroughput": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Maximum autoscale throughput for the view. Cannot be used with throughput."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all resources."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "databaseAccount::cassandraKeyspace": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces",
+                                              "apiVersion": "2025-05-01-preview",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'))]"
+                                            },
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2025-05-01-preview",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "cassandraView": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views",
+                                              "apiVersion": "2025-05-01-preview",
+                                              "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "location": "[parameters('location')]",
+                                              "properties": {
+                                                "resource": {
+                                                  "id": "[parameters('name')]",
+                                                  "viewDefinition": "[parameters('viewDefinition')]"
+                                                },
+                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(and(equals(parameters('throughput'), null()), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null()), 'throughput', parameters('throughput')))]"
+                                              },
+                                              "dependsOn": [
+                                                "databaseAccount"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the Cassandra view."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the Cassandra view."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces/views', parameters('databaseAccountName'), parameters('cassandraKeyspaceName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the Cassandra view was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "cassandraKeyspace"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Cassandra keyspace."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Cassandra keyspace."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/cassandraKeyspaces', parameters('databaseAccountName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the Cassandra keyspace was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "databaseAccount_privateEndpoints": {
+                              "copy": {
+                                "name": "databaseAccount_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "16604612898799598358"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.38.5.1644",
+                                              "templateHash": "24141742673128945"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the database account."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the database account."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the database account was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('databaseAccount', '2025-04-15', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('databaseAccount', '2025-04-15', 'full').location]"
+                            },
+                            "endpoint": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The endpoint of the database account."
+                              },
+                              "value": "[reference('databaseAccount').documentEndpoint]"
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the database account."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            },
+                            "primaryReadWriteKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The primary read-write key."
+                              },
+                              "value": "[listKeys('databaseAccount', '2025-04-15').primaryMasterKey]"
+                            },
+                            "primaryReadOnlyKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The primary read-only key."
+                              },
+                              "value": "[listKeys('databaseAccount', '2025-04-15').primaryReadonlyMasterKey]"
+                            },
+                            "primaryReadWriteConnectionString": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The primary read-write connection string."
+                              },
+                              "value": "[listConnectionStrings('databaseAccount', '2025-04-15').connectionStrings[0].connectionString]"
+                            },
+                            "primaryReadOnlyConnectionString": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The primary read-only connection string."
+                              },
+                              "value": "[listConnectionStrings('databaseAccount', '2025-04-15').connectionStrings[2].connectionString]"
+                            },
+                            "secondaryReadWriteKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The secondary read-write key."
+                              },
+                              "value": "[listKeys('databaseAccount', '2025-04-15').secondaryMasterKey]"
+                            },
+                            "secondaryReadOnlyKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The secondary read-only key."
+                              },
+                              "value": "[listKeys('databaseAccount', '2025-04-15').secondaryReadonlyMasterKey]"
+                            },
+                            "secondaryReadWriteConnectionString": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The secondary read-write connection string."
+                              },
+                              "value": "[listConnectionStrings('databaseAccount', '2025-04-15').connectionStrings[1].connectionString]"
+                            },
+                            "secondaryReadOnlyConnectionString": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "The secondary read-only connection string."
+                              },
+                              "value": "[listConnectionStrings('databaseAccount', '2025-04-15').connectionStrings[3].connectionString]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Cosmos DB account."
+                      },
+                      "value": "[reference('cosmosAccount').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the Cosmos DB account."
+                      },
+                      "value": "[reference('cosmosAccount').outputs.name.value]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the Cosmos DB account."
+                      },
+                      "value": "[format('https://{0}.documents.azure.com:443/', parameters('name'))]"
+                    },
+                    "databaseName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Database name."
+                      },
+                      "value": "[parameters('databaseName')]"
+                    },
+                    "containerName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Container name (first container)."
+                      },
+                      "value": "[parameters('containers')[0].name]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "log_analytics",
+                "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').cosmosDB)]",
+                "virtualNetwork"
+              ]
+            },
+            "sqlDBModule": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.sql-db.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "name": {
+                    "value": "[format('sql-{0}', variables('solutionSuffix'))]"
+                  },
+                  "databaseName": {
+                    "value": "[format('sqldb-{0}', variables('solutionSuffix'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "deployerPrincipalId": {
+                    "value": "[variables('deployingUserPrincipalId')]"
+                  },
+                  "deployerPrincipalName": {
+                    "value": "[variables('deployingUserPrincipalName')]"
+                  },
+                  "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                  "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-sql-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-sql-{0}', variables('solutionSuffix')), 'service', 'sqlServer', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').sqlServer)).outputs.resourceId.value)))))), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "7082930119694232055"
+                    }
+                  },
+                  "definitions": {
+                    "_1.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_1.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('sql-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the SQL Server."
+                      }
+                    },
+                    "databaseName": {
+                      "type": "string",
+                      "defaultValue": "[format('sqldb-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the SQL Database."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "deployerPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Principal ID of the deployer for admin access."
+                      }
+                    },
+                    "deployerPrincipalName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Principal name of the deployer for admin access."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "GP_S_Gen5",
+                      "metadata": {
+                        "description": "SKU name for the database."
+                      }
+                    },
+                    "skuTier": {
+                      "type": "string",
+                      "defaultValue": "GeneralPurpose",
+                      "metadata": {
+                        "description": "SKU tier for the database."
+                      }
+                    },
+                    "skuFamily": {
+                      "type": "string",
+                      "defaultValue": "Gen5",
+                      "metadata": {
+                        "description": "SKU family."
+                      }
+                    },
+                    "skuCapacity": {
+                      "type": "int",
+                      "defaultValue": 2,
+                      "metadata": {
+                        "description": "vCore capacity."
+                      }
+                    },
+                    "autoPauseDelay": {
+                      "type": "int",
+                      "defaultValue": 60,
+                      "metadata": {
+                        "description": "Auto-pause delay in minutes."
+                      }
+                    },
+                    "minCapacity": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Minimum capacity (vCores)."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "sqlServer": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.sql.server.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "minimalTlsVersion": {
+                            "value": "1.2"
+                          },
+                          "publicNetworkAccess": {
+                            "value": "[parameters('publicNetworkAccess')]"
+                          },
+                          "restrictOutboundNetworkAccess": {
+                            "value": "Disabled"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          },
+                          "administrators": {
+                            "value": {
+                              "azureADOnlyAuthentication": true,
+                              "login": "[parameters('deployerPrincipalName')]",
+                              "principalType": "User",
+                              "sid": "[parameters('deployerPrincipalId')]",
+                              "tenantId": "[subscription().tenantId]"
+                            }
+                          },
+                          "databases": {
+                            "value": [
+                              {
+                                "name": "[parameters('databaseName')]",
+                                "availabilityZone": -1,
+                                "collation": "SQL_Latin1_General_CP1_CI_AS",
+                                "autoPauseDelay": "[parameters('autoPauseDelay')]",
+                                "minCapacity": "[format('{0}', parameters('minCapacity'))]",
+                                "zoneRedundant": false,
+                                "sku": {
+                                  "name": "[parameters('skuName')]",
+                                  "tier": "[parameters('skuTier')]",
+                                  "family": "[parameters('skuFamily')]",
+                                  "capacity": "[parameters('skuCapacity')]"
+                                }
+                              }
+                            ]
+                          },
+                          "firewallRules": "[if(equals(parameters('publicNetworkAccess'), 'Enabled'), createObject('value', createArray(createObject('name', 'AllowSpecificRange', 'startIpAddress', '0.0.0.0', 'endIpAddress', '255.255.255.255'), createObject('name', 'AllowAllAzureServicesAndResourcesWithinAzureIps', 'startIpAddress', '0.0.0.0', 'endIpAddress', '0.0.0.0'))), createObject('value', createArray()))]",
+                          "privateEndpoints": {
+                            "value": "[parameters('privateEndpoints')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.39.26.7824",
+                              "templateHash": "6339757823399774705"
+                            },
+                            "name": "Azure SQL Servers",
+                            "description": "This module deploys an Azure SQL Server."
+                          },
+                          "definitions": {
+                            "privateEndpointOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The group Id for the private endpoint Group."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "FQDN that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses of the private endpoint."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a private endpoint output."
+                              }
+                            },
+                            "auditSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the name of the audit settings."
+                                  }
+                                },
+                                "auditActionsAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the Actions-Groups and Actions to audit."
+                                  }
+                                },
+                                "isAzureMonitorTargetEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether audit events are sent to Azure Monitor."
+                                  }
+                                },
+                                "isDevopsAuditEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the state of devops audit. If state is Enabled, devops logs will be sent to Azure Monitor."
+                                  }
+                                },
+                                "isManagedIdentityInUse": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether Managed Identity is used to access blob storage."
+                                  }
+                                },
+                                "isStorageSecondaryKeyInUse": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether storageAccountAccessKey value is the storage's secondary key."
+                                  }
+                                },
+                                "queueDelayMs": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the amount of time in milliseconds that can elapse before audit actions are forced to be processed."
+                                  }
+                                },
+                                "retentionDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the number of days to keep in the audit logs in the storage account."
+                                  }
+                                },
+                                "state": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "Enabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the state of the audit. If state is Enabled, storageEndpoint or isAzureMonitorTargetEnabled are required."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the identifier key of the auditing storage account."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for audit settings."
+                              }
+                            },
+                            "secretsExportConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the key vault where to store the secrets of this module."
+                                  }
+                                },
+                                "sqlAdminPasswordSecretName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The sqlAdminPassword secret name to create."
+                                  }
+                                },
+                                "sqlAzureConnectionStringSecretName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The sqlAzureConnectionString secret name to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a secrets export configuration."
+                              }
+                            },
+                            "serverExternalAdministratorType": {
+                              "type": "object",
+                              "properties": {
+                                "administratorType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "ActiveDirectory"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Type of the sever administrator."
+                                  }
+                                },
+                                "azureADOnlyAuthentication": {
+                                  "type": "bool",
+                                  "metadata": {
+                                    "description": "Required. Azure Active Directory only Authentication enabled."
+                                  }
+                                },
+                                "login": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Login name of the server administrator."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Application",
+                                    "Group",
+                                    "User"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. Principal Type of the sever administrator."
+                                  }
+                                },
+                                "sid": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. SID (object ID) of the server administrator."
+                                  }
+                                },
+                                "tenantId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Tenant ID of the administrator."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a sever-external administrator."
+                              }
+                            },
+                            "databaseType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the Elastic Pool."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Sql/servers/databases@2023-08-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The lock settings of the database."
+                                  }
+                                },
+                                "managedIdentities": {
+                                  "$ref": "#/definitions/managedIdentityOnlyUserAssignedType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The managed identities for the database."
+                                  }
+                                },
+                                "sku": {
+                                  "$ref": "#/definitions/databaseSkuType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The database SKU."
+                                  }
+                                },
+                                "autoPauseDelay": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time in minutes after which database is automatically paused. A value of -1 means that automatic pause is disabled."
+                                  }
+                                },
+                                "availabilityZone": {
+                                  "type": "int",
+                                  "allowedValues": [
+                                    -1,
+                                    1,
+                                    2,
+                                    3
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                                  }
+                                },
+                                "catalogCollation": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Collation of the metadata catalog."
+                                  }
+                                },
+                                "collation": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The collation of the database."
+                                  }
+                                },
+                                "createMode": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Copy",
+                                    "Default",
+                                    "OnlineSecondary",
+                                    "PointInTimeRestore",
+                                    "Recovery",
+                                    "Restore",
+                                    "RestoreExternalBackup",
+                                    "RestoreExternalBackupSecondary",
+                                    "RestoreLongTermRetentionBackup",
+                                    "Secondary"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the mode of database creation."
+                                  }
+                                },
+                                "elasticPoolResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource identifier of the elastic pool containing this database."
+                                  }
+                                },
+                                "customerManagedKey": {
+                                  "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The customer managed key definition for database TDE."
+                                  }
+                                },
+                                "federatedClientId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "minLength": 36,
+                                  "maxLength": 36,
+                                  "metadata": {
+                                    "description": "Optional. The Client id used for cross tenant per database CMK scenario."
+                                  }
+                                },
+                                "freeLimitExhaustionBehavior": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AutoPause",
+                                    "BillOverUsage"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the behavior when monthly free limits are exhausted for the free database."
+                                  }
+                                },
+                                "highAvailabilityReplicaCount": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The number of secondary replicas associated with the database that are used to provide high availability. Not applicable to a Hyperscale database within an elastic pool."
+                                  }
+                                },
+                                "isLedgerOn": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether or not this database is a ledger database, which means all tables in the database are ledger tables."
+                                  }
+                                },
+                                "licenseType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "BasePrice",
+                                    "LicenseIncluded"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The license type to apply for this database."
+                                  }
+                                },
+                                "longTermRetentionBackupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource identifier of the long term retention backup associated with create operation of this database."
+                                  }
+                                },
+                                "maintenanceConfigurationId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maintenance configuration id assigned to the database. This configuration defines the period when the maintenance updates will occur."
+                                  }
+                                },
+                                "manualCutover": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether or not customer controlled manual cutover needs to be done during Update Database operation to Hyperscale tier."
+                                  }
+                                },
+                                "maxSizeBytes": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The max size of the database expressed in bytes."
+                                  }
+                                },
+                                "minCapacity": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Minimal capacity that database will always have allocated, if not paused."
+                                  }
+                                },
+                                "performCutover": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. To trigger customer controlled manual cutover during the wait state while Scaling operation is in progress."
+                                  }
+                                },
+                                "preferredEnclaveType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Default",
+                                    "VBS"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Type of enclave requested on the database."
+                                  }
+                                },
+                                "readScale": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "Enabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The state of read-only routing. If enabled, connections that have application intent set to readonly in their connection string may be routed to a readonly secondary replica in the same region. Not applicable to a Hyperscale database within an elastic pool."
+                                  }
+                                },
+                                "recoverableDatabaseResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource identifier of the recoverable database associated with create operation of this database."
+                                  }
+                                },
+                                "recoveryServicesRecoveryPointResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource identifier of the recovery point associated with create operation of this database."
+                                  }
+                                },
+                                "requestedBackupStorageRedundancy": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Geo",
+                                    "GeoZone",
+                                    "Local",
+                                    "Zone"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The storage account type to be used to store backups for this database."
+                                  }
+                                },
+                                "restorableDroppedDatabaseResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource identifier of the restorable dropped database associated with create operation of this database."
+                                  }
+                                },
+                                "restorePointInTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the point in time (ISO8601 format) of the source database that will be restored to create the new database."
+                                  }
+                                },
+                                "sampleName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the sample schema to apply when creating this database."
+                                  }
+                                },
+                                "secondaryType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Geo",
+                                    "Named",
+                                    "Standby"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The secondary type of the database if it is a secondary."
+                                  }
+                                },
+                                "sourceDatabaseDeletionDate": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the time that the database was deleted."
+                                  }
+                                },
+                                "sourceDatabaseResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource identifier of the source database associated with create operation of this database."
+                                  }
+                                },
+                                "sourceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource identifier of the source associated with the create operation of this database."
+                                  }
+                                },
+                                "useFreeLimit": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether or not the database uses free monthly limits. Allowed on one database in a subscription."
+                                  }
+                                },
+                                "zoneRedundant": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether or not this database is zone redundant, which means the replicas of this database will be spread across multiple availability zones."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the service."
+                                  }
+                                },
+                                "backupShortTermRetentionPolicy": {
+                                  "$ref": "#/definitions/shortTermBackupRetentionPolicyType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The short term backup retention policy for the database."
+                                  }
+                                },
+                                "backupLongTermRetentionPolicy": {
+                                  "$ref": "#/definitions/longTermBackupRetentionPolicyType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The long term backup retention policy for the database."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a database."
+                              }
+                            },
+                            "elasticPoolType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the Elastic Pool."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Tags of the resource."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The lock settings of the elastic pool."
+                                  }
+                                },
+                                "sku": {
+                                  "$ref": "#/definitions/skuType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The elastic pool SKU."
+                                  }
+                                },
+                                "autoPauseDelay": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time in minutes after which elastic pool is automatically paused. A value of -1 means that automatic pause is disabled."
+                                  }
+                                },
+                                "availabilityZone": {
+                                  "type": "int",
+                                  "allowedValues": [
+                                    -1,
+                                    1,
+                                    2,
+                                    3
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                                  }
+                                },
+                                "highAvailabilityReplicaCount": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The number of secondary replicas associated with the elastic pool that are used to provide high availability. Applicable only to Hyperscale elastic pools."
+                                  }
+                                },
+                                "licenseType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "BasePrice",
+                                    "LicenseIncluded"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The license type to apply for this elastic pool."
+                                  }
+                                },
+                                "maintenanceConfigurationId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maintenance configuration id assigned to the elastic pool. This configuration defines the period when the maintenance updates will will occur."
+                                  }
+                                },
+                                "maxSizeBytes": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The storage limit for the database elastic pool in bytes."
+                                  }
+                                },
+                                "minCapacity": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Minimal capacity that serverless pool will not shrink below, if not paused."
+                                  }
+                                },
+                                "perDatabaseSettings": {
+                                  "$ref": "#/definitions/perDatabaseSettingsType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The per database settings for the elastic pool."
+                                  }
+                                },
+                                "preferredEnclaveType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Default",
+                                    "VBS"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Type of enclave requested on the elastic pool."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "zoneRedundant": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether or not this elastic pool is zone redundant, which means the replicas of this elastic pool will be spread across multiple availability zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for an elastic pool property."
+                              }
+                            },
+                            "vulnerabilityAssessmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the vulnerability assessment."
+                                  }
+                                },
+                                "recurringScans": {
+                                  "$ref": "#/definitions/recurringScansType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The recurring scans settings."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the storage account to store the scan reports."
+                                  }
+                                },
+                                "useStorageAccountAccessKey": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether to use the storage account access key to access the storage account."
+                                  }
+                                },
+                                "createStorageRoleAssignment": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether to create a role assignment for the storage account."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a vulnerability assessment."
+                              }
+                            },
+                            "firewallRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the firewall rule."
+                                  }
+                                },
+                                "startIpAddress": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The start IP address of the firewall rule. Must be IPv4 format. Use value '0.0.0.0' for all Azure-internal IP addresses."
+                                  }
+                                },
+                                "endIpAddress": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. Use value '0.0.0.0' for all Azure-internal IP addresses."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a firewall rule."
+                              }
+                            },
+                            "keyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the key. Must follow the [<keyVaultName>_<keyName>_<keyVersion>] pattern."
+                                  }
+                                },
+                                "serverKeyType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureKeyVault",
+                                    "ServiceManaged"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The server key type."
+                                  }
+                                },
+                                "uri": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The URI of the server key. If the ServerKeyType is AzureKeyVault, then the URI is required. The AKV URI is required to be in this format: 'https://YourVaultName.azure.net/keys/YourKeyName/YourKeyVersion'."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a key."
+                              }
+                            },
+                            "virtualNetworkRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the Server Virtual Network Rule."
+                                  }
+                                },
+                                "virtualNetworkSubnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the virtual network subnet."
+                                  }
+                                },
+                                "ignoreMissingVnetServiceEndpoint": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Allow creating a firewall rule before the virtual network has vnet service endpoint enabled."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a virtual network rule."
+                              }
+                            },
+                            "securityAlertPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the Security Alert Policy."
+                                  }
+                                },
+                                "disabledAlerts": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "Access_Anomaly",
+                                    "Brute_Force",
+                                    "Data_Exfiltration",
+                                    "Sql_Injection",
+                                    "Sql_Injection_Vulnerability",
+                                    "Unsafe_Action"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Alerts to disable."
+                                  }
+                                },
+                                "emailAccountAdmins": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies that the alert is sent to the account administrators."
+                                  }
+                                },
+                                "emailAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies an array of email addresses to which the alert is sent."
+                                  }
+                                },
+                                "retentionDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the number of days to keep in the Threat Detection audit logs."
+                                  }
+                                },
+                                "state": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "Enabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the state of the policy, whether it is enabled or disabled or a policy has not been applied yet on the specific database."
+                                  }
+                                },
+                                "storageAccountAccessKey": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the identifier key of the Threat Detection audit storage account."
+                                  }
+                                },
+                                "storageEndpoint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies the blob storage endpoint. This blob storage will hold all Threat Detection audit logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a security alert policy."
+                              }
+                            },
+                            "failoverGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the failover group."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Tags of the resource."
+                                  }
+                                },
+                                "databases": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. List of databases in the failover group."
+                                  }
+                                },
+                                "partnerServerResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. List of the partner server Resource Id for the failover group."
+                                  }
+                                },
+                                "readOnlyEndpoint": {
+                                  "$ref": "#/definitions/readOnlyEndpointType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Read-only endpoint of the failover group instance."
+                                  }
+                                },
+                                "readWriteEndpoint": {
+                                  "$ref": "#/definitions/readWriteEndpointType",
+                                  "metadata": {
+                                    "description": "Required. Read-write endpoint of the failover group instance."
+                                  }
+                                },
+                                "secondaryType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Geo",
+                                    "Standby"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. Databases secondary type on partner server."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a failover group."
+                              }
+                            },
+                            "_1.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.secretSetOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "secretResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resourceId of the exported secret."
+                                  }
+                                },
+                                "secretUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI of the exported secret."
+                                  }
+                                },
+                                "secretUriWithVersion": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI with version of the exported secret."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "customerManagedKeyWithAutoRotateType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                  }
+                                },
+                                "keyName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the customer managed key to use for encryption."
+                                  }
+                                },
+                                "keyVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                                  }
+                                },
+                                "autoRotationEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                                  }
+                                },
+                                "userAssignedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "databaseSkuType": {
+                              "type": "object",
+                              "properties": {
+                                "capacity": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The capacity of the particular SKU."
+                                  }
+                                },
+                                "family": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the SKU, typically, a letter + Number code, e.g. P3."
+                                  }
+                                },
+                                "size": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Size of the particular SKU."
+                                  }
+                                },
+                                "tier": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The tier or edition of the particular SKU, e.g. Basic, Premium."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The database SKU.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "database/main.bicep"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "longTermBackupRetentionPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "monthlyRetention": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Monthly retention in ISO 8601 duration format."
+                                  }
+                                },
+                                "weeklyRetention": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Weekly retention in ISO 8601 duration format."
+                                  }
+                                },
+                                "weekOfYear": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Week of year backup to keep for yearly retention."
+                                  }
+                                },
+                                "yearlyRetention": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Yearly retention in ISO 8601 duration format."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The long-term backup retention policy for the database.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "database/main.bicep"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "managedIdentityOnlyUserAssignedType": {
+                              "type": "object",
+                              "properties": {
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if only user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "perDatabaseSettingsType": {
+                              "type": "object",
+                              "properties": {
+                                "autoPauseDelay": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Auto Pause Delay for per database within pool."
+                                  }
+                                },
+                                "maxCapacity": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The maximum capacity any one database can consume. Examples: '0.5', '2'."
+                                  }
+                                },
+                                "minCapacity": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The minimum capacity all databases are guaranteed. Examples: '0.5', '1'."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The per database settings for the elastic pool.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "elastic-pool/main.bicep"
+                                }
+                              }
+                            },
+                            "privateEndpointSingleServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private Endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the Private Endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "readOnlyEndpointType": {
+                              "type": "object",
+                              "properties": {
+                                "failoverPolicy": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "Enabled"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. Failover policy of the read-only endpoint for the failover group."
+                                  }
+                                },
+                                "targetServer": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The target partner server where the read-only endpoint points to."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a read-only endpoint.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "failover-group/main.bicep"
+                                }
+                              }
+                            },
+                            "readWriteEndpointType": {
+                              "type": "object",
+                              "properties": {
+                                "failoverPolicy": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Automatic",
+                                    "Manual"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. Failover policy of the read-write endpoint for the failover group. If failoverPolicy is Automatic then failoverWithDataLossGracePeriodMinutes is required."
+                                  }
+                                },
+                                "failoverWithDataLossGracePeriodMinutes": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Grace period before failover with data loss is attempted for the read-write endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a read-write endpoint.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "failover-group/main.bicep"
+                                }
+                              }
+                            },
+                            "recurringScansType": {
+                              "type": "object",
+                              "properties": {
+                                "emails": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Specifies an array of e-mail addresses to which the scan notification is sent."
+                                  }
+                                },
+                                "emailSubscriptionAdmins": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies that the schedule scan notification will be sent to the subscription administrators."
+                                  }
+                                },
+                                "isEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Recurring scans state."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for recurring scans.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "vulnerability-assessment/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "secretsOutputType": {
+                              "type": "object",
+                              "properties": {},
+                              "additionalProperties": {
+                                "$ref": "#/definitions/_1.secretSetOutputType",
+                                "metadata": {
+                                  "description": "An exported secret's references."
+                                }
+                              },
+                              "metadata": {
+                                "description": "A map of the exported secrets",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "shortTermBackupRetentionPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "diffBackupIntervalInHours": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Differential backup interval in hours. For Hyperscale tiers this value will be ignored."
+                                  }
+                                },
+                                "retentionDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Point-in-time retention in days."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The short-term backup retention policy for the database.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "database/main.bicep"
+                                }
+                              }
+                            },
+                            "skuType": {
+                              "type": "object",
+                              "properties": {
+                                "capacity": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The capacity of the particular SKU."
+                                  }
+                                },
+                                "family": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "BC_DC",
+                                    "BC_Gen5",
+                                    "BasicPool",
+                                    "GP_DC",
+                                    "GP_FSv2",
+                                    "GP_Gen5",
+                                    "HS_Gen5",
+                                    "HS_MOPRMS",
+                                    "HS_PRMS",
+                                    "PremiumPool",
+                                    "ServerlessPool",
+                                    "StandardPool"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The name of the SKU, typically, a letter + Number code, e.g. P3."
+                                  }
+                                },
+                                "size": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Size of the particular SKU."
+                                  }
+                                },
+                                "tier": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The tier or edition of the particular SKU, e.g. Basic, Premium."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The elastic pool SKU.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "elastic-pool/main.bicep"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "administratorLogin": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. The administrator username for the server. Required if no `administrators` object for AAD authentication is provided."
+                              }
+                            },
+                            "administratorLoginPassword": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. The administrator login password. Required if no `administrators` object for AAD authentication is provided."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the server."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "primaryUserAssignedIdentityResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. The resource ID of a user assigned identity to be used by default. Required if \"userAssignedIdentities\" is not empty."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Sql/servers@2023-08-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "databases": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/databaseType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The databases to create in the server."
+                              }
+                            },
+                            "elasticPools": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/elasticPoolType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Elastic Pools to create in the server."
+                              }
+                            },
+                            "firewallRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/firewallRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The firewall rules to create in the server."
+                              }
+                            },
+                            "virtualNetworkRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/virtualNetworkRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The virtual network rules to create in the server."
+                              }
+                            },
+                            "securityAlertPolicies": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/securityAlertPolicyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The security alert policies to create in the server."
+                              }
+                            },
+                            "keys": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/keyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The keys to configure."
+                              }
+                            },
+                            "customerManagedKey": {
+                              "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The customer managed key definition for server TDE."
+                              }
+                            },
+                            "administrators": {
+                              "$ref": "#/definitions/serverExternalAdministratorType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. The Azure Active Directory (AAD) administrator authentication. Required if no `administratorLogin` & `administratorLoginPassword` is provided."
+                              }
+                            },
+                            "federatedClientId": {
+                              "type": "string",
+                              "nullable": true,
+                              "minLength": 36,
+                              "maxLength": 36,
+                              "metadata": {
+                                "description": "Optional. The Client id used for cross tenant CMK scenario."
+                              }
+                            },
+                            "minimalTlsVersion": {
+                              "type": "string",
+                              "defaultValue": "1.2",
+                              "allowedValues": [
+                                "1.0",
+                                "1.1",
+                                "1.2",
+                                "1.3"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Minimal TLS version allowed."
+                              }
+                            },
+                            "isIPv6Enabled": {
+                              "type": "string",
+                              "defaultValue": "Disabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not to enable IPv6 support for this server."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointSingleServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "allowedValues": [
+                                "",
+                                "Enabled",
+                                "Disabled",
+                                "SecuredByPerimeter"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and neither firewall rules nor virtual network rules are set."
+                              }
+                            },
+                            "restrictOutboundNetworkAccess": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not to restrict outbound network access for this server."
+                              }
+                            },
+                            "connectionPolicy": {
+                              "type": "string",
+                              "defaultValue": "Default",
+                              "allowedValues": [
+                                "Default",
+                                "Redirect",
+                                "Proxy"
+                              ],
+                              "metadata": {
+                                "description": "Optional. SQL logical server connection policy."
+                              }
+                            },
+                            "vulnerabilityAssessmentsObj": {
+                              "$ref": "#/definitions/vulnerabilityAssessmentType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The vulnerability assessment configuration."
+                              }
+                            },
+                            "auditSettings": {
+                              "$ref": "#/definitions/auditSettingsType",
+                              "defaultValue": {
+                                "state": "Enabled"
+                              },
+                              "metadata": {
+                                "description": "Optional. The audit settings configuration. If you want to disable auditing, set the parmaeter to an empty object."
+                              }
+                            },
+                            "secretsExportConfiguration": {
+                              "$ref": "#/definitions/secretsExportConfigurationType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                              }
+                            },
+                            "failoverGroups": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/failoverGroupType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The failover groups configuration."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "enableReferencedModulesTelemetry": false,
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                              "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                              "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+                              "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                              "Reservation Purchaser": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f7b75c60-3036-4b75-91c3-6b41c27c1689')]",
+                              "Resource Policy Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '36243c78-bf99-498c-9df9-86d9f8d28608')]",
+                              "SQL DB Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9b7fa17d-e63e-47b0-bb0a-15c516ac86ec')]",
+                              "SQL Security Manager": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '056cd41c-7e88-42e1-933e-88ba6a50c9c3')]",
+                              "SQL Server Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437')]",
+                              "SqlDb Migration Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '189207d4-bb67-4208-a635-b06afe8b2c57')]"
+                            },
+                            "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                          },
+                          "resources": {
+                            "cMKKeyVault::cMKKey": {
+                              "condition": "[and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults/keys",
+                              "apiVersion": "2025-05-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                            },
+                            "cMKKeyVault": {
+                              "condition": "[and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2025-05-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                            },
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.sql-server.{0}.{1}', replace('0.21.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "server": {
+                              "type": "Microsoft.Sql/servers",
+                              "apiVersion": "2023-08-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "properties": {
+                                "administratorLogin": "[parameters('administratorLogin')]",
+                                "administratorLoginPassword": "[parameters('administratorLoginPassword')]",
+                                "administrators": "[union(createObject('administratorType', 'ActiveDirectory'), coalesce(parameters('administrators'), createObject()))]",
+                                "federatedClientId": "[parameters('federatedClientId')]",
+                                "isIPv6Enabled": "[parameters('isIPv6Enabled')]",
+                                "keyId": "[if(not(equals(parameters('customerManagedKey'), null())), if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), if(not(variables('isHSMManagedCMK')), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), format('https://{0}.managedhsm.azure.net/keys/{1}/{2}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName, parameters('customerManagedKey').keyVersion)), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault::cMKKey').keyUri, format('https://{0}.managedhsm.azure.net/keys/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName)), if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault::cMKKey').keyUriWithVersion, fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.')))), null())]",
+                                "version": "12.0",
+                                "minimalTlsVersion": "[parameters('minimalTlsVersion')]",
+                                "primaryUserAssignedIdentityId": "[parameters('primaryUserAssignedIdentityResourceId')]",
+                                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(and(not(empty(parameters('privateEndpoints'))), empty(parameters('firewallRules'))), empty(parameters('virtualNetworkRules'))), 'Disabled', null()))]",
+                                "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]"
+                              },
+                              "dependsOn": [
+                                "cMKKeyVault::cMKKey"
+                              ]
+                            },
+                            "server_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Sql/servers/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "server_roleAssignments": {
+                              "copy": {
+                                "name": "server_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Sql/servers/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Sql/servers', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "server_connection_policy": {
+                              "type": "Microsoft.Sql/servers/connectionPolicies",
+                              "apiVersion": "2023-08-01",
+                              "name": "[format('{0}/{1}', parameters('name'), 'default')]",
+                              "properties": {
+                                "connectionType": "[parameters('connectionPolicy')]"
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "server_databases": {
+                              "copy": {
+                                "name": "server_databases",
+                                "count": "[length(coalesce(parameters('databases'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-DB-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('databases'), createArray())[copyIndex()].name]"
+                                  },
+                                  "managedIdentities": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'managedIdentities')]"
+                                  },
+                                  "sku": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sku')]"
+                                  },
+                                  "autoPauseDelay": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'autoPauseDelay')]"
+                                  },
+                                  "availabilityZone": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'availabilityZone')]"
+                                  },
+                                  "catalogCollation": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'catalogCollation')]"
+                                  },
+                                  "collation": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'collation')]"
+                                  },
+                                  "createMode": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'createMode')]"
+                                  },
+                                  "elasticPoolResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'elasticPoolResourceId')]"
+                                  },
+                                  "customerManagedKey": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'customerManagedKey')]"
+                                  },
+                                  "federatedClientId": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'federatedClientId')]"
+                                  },
+                                  "freeLimitExhaustionBehavior": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'freeLimitExhaustionBehavior')]"
+                                  },
+                                  "highAvailabilityReplicaCount": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'highAvailabilityReplicaCount')]"
+                                  },
+                                  "isLedgerOn": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'isLedgerOn')]"
+                                  },
+                                  "licenseType": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'licenseType')]"
+                                  },
+                                  "lock": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'lock')]"
+                                  },
+                                  "longTermRetentionBackupResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'longTermRetentionBackupResourceId')]"
+                                  },
+                                  "maintenanceConfigurationId": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'maintenanceConfigurationId')]"
+                                  },
+                                  "manualCutover": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'manualCutover')]"
+                                  },
+                                  "maxSizeBytes": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'maxSizeBytes')]"
+                                  },
+                                  "minCapacity": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'minCapacity')]"
+                                  },
+                                  "performCutover": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'performCutover')]"
+                                  },
+                                  "preferredEnclaveType": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'preferredEnclaveType')]"
+                                  },
+                                  "readScale": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'readScale')]"
+                                  },
+                                  "recoverableDatabaseResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'recoverableDatabaseResourceId')]"
+                                  },
+                                  "recoveryServicesRecoveryPointResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'recoveryServicesRecoveryPointResourceId')]"
+                                  },
+                                  "requestedBackupStorageRedundancy": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'requestedBackupStorageRedundancy')]"
+                                  },
+                                  "restorableDroppedDatabaseResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'restorableDroppedDatabaseResourceId')]"
+                                  },
+                                  "restorePointInTime": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'restorePointInTime')]"
+                                  },
+                                  "sampleName": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sampleName')]"
+                                  },
+                                  "secondaryType": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'secondaryType')]"
+                                  },
+                                  "sourceDatabaseDeletionDate": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sourceDatabaseDeletionDate')]"
+                                  },
+                                  "sourceDatabaseResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sourceDatabaseResourceId')]"
+                                  },
+                                  "sourceResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'sourceResourceId')]"
+                                  },
+                                  "useFreeLimit": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'useFreeLimit')]"
+                                  },
+                                  "zoneRedundant": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'zoneRedundant')]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'diagnosticSettings')]"
+                                  },
+                                  "backupShortTermRetentionPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'backupShortTermRetentionPolicy')]"
+                                  },
+                                  "backupLongTermRetentionPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('databases'), createArray())[copyIndex()], 'backupLongTermRetentionPolicy')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "15166565101356255378"
+                                    },
+                                    "name": "SQL Server Database",
+                                    "description": "This module deploys an Azure SQL Server Database."
+                                  },
+                                  "definitions": {
+                                    "databaseSkuType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "capacity": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The capacity of the particular SKU."
+                                          }
+                                        },
+                                        "family": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the SKU, typically, a letter + Number code, e.g. P3."
+                                          }
+                                        },
+                                        "size": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Size of the particular SKU."
+                                          }
+                                        },
+                                        "tier": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The tier or edition of the particular SKU, e.g. Basic, Premium."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The database SKU."
+                                      }
+                                    },
+                                    "shortTermBackupRetentionPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "diffBackupIntervalInHours": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Differential backup interval in hours. For Hyperscale tiers this value will be ignored."
+                                          }
+                                        },
+                                        "retentionDays": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Point-in-time retention in days."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The short-term backup retention policy for the database."
+                                      }
+                                    },
+                                    "longTermBackupRetentionPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "monthlyRetention": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Monthly retention in ISO 8601 duration format."
+                                          }
+                                        },
+                                        "weeklyRetention": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Weekly retention in ISO 8601 duration format."
+                                          }
+                                        },
+                                        "weekOfYear": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Week of year backup to keep for yearly retention."
+                                          }
+                                        },
+                                        "yearlyRetention": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Yearly retention in ISO 8601 duration format."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The long-term backup retention policy for the database."
+                                      }
+                                    },
+                                    "customerManagedKeyWithAutoRotateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                          }
+                                        },
+                                        "keyName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the customer managed key to use for encryption."
+                                          }
+                                        },
+                                        "keyVersion": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                                          }
+                                        },
+                                        "autoRotationEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                                          }
+                                        },
+                                        "userAssignedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "managedIdentityOnlyUserAssignedType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "userAssignedResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if only user-assigned identities are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the database."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "sku": {
+                                      "$ref": "#/definitions/databaseSkuType",
+                                      "defaultValue": {
+                                        "name": "GP_Gen5_2",
+                                        "tier": "GeneralPurpose"
+                                      },
+                                      "metadata": {
+                                        "description": "Optional. The database SKU."
+                                      }
+                                    },
+                                    "autoPauseDelay": {
+                                      "type": "int",
+                                      "defaultValue": -1,
+                                      "metadata": {
+                                        "description": "Optional. Time in minutes after which database is automatically paused. A value of -1 means that automatic pause is disabled."
+                                      }
+                                    },
+                                    "availabilityZone": {
+                                      "type": "int",
+                                      "allowedValues": [
+                                        -1,
+                                        1,
+                                        2,
+                                        3
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                                      }
+                                    },
+                                    "catalogCollation": {
+                                      "type": "string",
+                                      "defaultValue": "DATABASE_DEFAULT",
+                                      "metadata": {
+                                        "description": "Optional. Collation of the metadata catalog."
+                                      }
+                                    },
+                                    "collation": {
+                                      "type": "string",
+                                      "defaultValue": "SQL_Latin1_General_CP1_CI_AS",
+                                      "metadata": {
+                                        "description": "Optional. The collation of the database."
+                                      }
+                                    },
+                                    "createMode": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Copy",
+                                        "Default",
+                                        "OnlineSecondary",
+                                        "PointInTimeRestore",
+                                        "Recovery",
+                                        "Restore",
+                                        "RestoreExternalBackup",
+                                        "RestoreExternalBackupSecondary",
+                                        "RestoreLongTermRetentionBackup",
+                                        "Secondary"
+                                      ],
+                                      "defaultValue": "Default",
+                                      "metadata": {
+                                        "description": "Optional. Specifies the mode of database creation."
+                                      }
+                                    },
+                                    "elasticPoolResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the elastic pool containing this database."
+                                      }
+                                    },
+                                    "federatedClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "minLength": 36,
+                                      "maxLength": 36,
+                                      "metadata": {
+                                        "description": "Optional. The Client id used for cross tenant per database CMK scenario."
+                                      }
+                                    },
+                                    "freeLimitExhaustionBehavior": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AutoPause",
+                                        "BillOverUsage"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the behavior when monthly free limits are exhausted for the free database."
+                                      }
+                                    },
+                                    "highAvailabilityReplicaCount": {
+                                      "type": "int",
+                                      "defaultValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. The number of readonly secondary replicas associated with the database."
+                                      }
+                                    },
+                                    "isLedgerOn": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Whether or not this database is a ledger database, which means all tables in the database are ledger tables. Note: the value of this property cannot be changed after the database has been created."
+                                      }
+                                    },
+                                    "licenseType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "BasePrice",
+                                        "LicenseIncluded"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The license type to apply for this database."
+                                      }
+                                    },
+                                    "longTermRetentionBackupResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource identifier of the long term retention backup associated with create operation of this database."
+                                      }
+                                    },
+                                    "maintenanceConfigurationId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Maintenance configuration ID assigned to the database. This configuration defines the period when the maintenance updates will occur."
+                                      }
+                                    },
+                                    "manualCutover": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether or not customer controlled manual cutover needs to be done during Update Database operation to Hyperscale tier."
+                                      }
+                                    },
+                                    "maxSizeBytes": {
+                                      "type": "int",
+                                      "defaultValue": 34359738368,
+                                      "metadata": {
+                                        "description": "Optional. The max size of the database expressed in bytes."
+                                      }
+                                    },
+                                    "minCapacity": {
+                                      "type": "string",
+                                      "defaultValue": "0",
+                                      "metadata": {
+                                        "description": "Optional. Minimal capacity that database will always have allocated."
+                                      }
+                                    },
+                                    "performCutover": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. To trigger customer controlled manual cutover during the wait state while Scaling operation is in progress."
+                                      }
+                                    },
+                                    "preferredEnclaveType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Default",
+                                        "VBS"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Type of enclave requested on the database i.e. Default or VBS enclaves."
+                                      }
+                                    },
+                                    "readScale": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "defaultValue": "Disabled",
+                                      "metadata": {
+                                        "description": "Optional. The state of read-only routing."
+                                      }
+                                    },
+                                    "recoverableDatabaseResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource identifier of the recoverable database associated with create operation of this database."
+                                      }
+                                    },
+                                    "recoveryServicesRecoveryPointResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource identifier of the recovery point associated with create operation of this database."
+                                      }
+                                    },
+                                    "requestedBackupStorageRedundancy": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Geo",
+                                        "GeoZone",
+                                        "Local",
+                                        "Zone"
+                                      ],
+                                      "defaultValue": "Local",
+                                      "metadata": {
+                                        "description": "Optional. The storage account type to be used to store backups for this database."
+                                      }
+                                    },
+                                    "restorableDroppedDatabaseResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource identifier of the restorable dropped database associated with create operation of this database."
+                                      }
+                                    },
+                                    "restorePointInTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Point in time (ISO8601 format) of the source database to restore when createMode set to Restore or PointInTimeRestore."
+                                      }
+                                    },
+                                    "sampleName": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The name of the sample schema to apply when creating this database."
+                                      }
+                                    },
+                                    "secondaryType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Geo",
+                                        "Named",
+                                        "Standby"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The secondary type of the database if it is a secondary."
+                                      }
+                                    },
+                                    "sourceDatabaseDeletionDate": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The time that the database was deleted when restoring a deleted database."
+                                      }
+                                    },
+                                    "sourceDatabaseResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource identifier of the source database associated with create operation of this database."
+                                      }
+                                    },
+                                    "sourceResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource identifier of the source associated with the create operation of this database."
+                                      }
+                                    },
+                                    "useFreeLimit": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether or not the database uses free monthly limits. Allowed on one database in a subscription."
+                                      }
+                                    },
+                                    "zoneRedundant": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether or not this database is zone redundant."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Sql/servers/database@2023-08-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the databse."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    },
+                                    "backupShortTermRetentionPolicy": {
+                                      "$ref": "#/definitions/shortTermBackupRetentionPolicyType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The short term backup retention policy to create for the database."
+                                      }
+                                    },
+                                    "backupLongTermRetentionPolicy": {
+                                      "$ref": "#/definitions/longTermBackupRetentionPolicyType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The long term backup retention policy to create for the database."
+                                      }
+                                    },
+                                    "managedIdentities": {
+                                      "$ref": "#/definitions/managedIdentityOnlyUserAssignedType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity definition for this resource."
+                                      }
+                                    },
+                                    "customerManagedKey": {
+                                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The customer managed key definition for database TDE."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null()), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                                    "isHSMManagedCMK": "[equals(tryGet(split(coalesce(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), ''), '/'), 7), 'managedHSMs')]"
+                                  },
+                                  "resources": {
+                                    "cMKKeyVault::cMKKey": {
+                                      "condition": "[and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))))]",
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults/keys",
+                                      "apiVersion": "2025-05-01",
+                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                                    },
+                                    "server": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('serverName')]"
+                                    },
+                                    "cMKKeyVault": {
+                                      "condition": "[and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2025-05-01",
+                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.sql-serverdb.{0}.{1}', replace('0.2.1', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "database": {
+                                      "type": "Microsoft.Sql/servers/databases",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "sku": "[parameters('sku')]",
+                                      "identity": "[variables('identity')]",
+                                      "properties": {
+                                        "autoPauseDelay": "[parameters('autoPauseDelay')]",
+                                        "availabilityZone": "[if(not(equals(parameters('availabilityZone'), -1)), string(parameters('availabilityZone')), 'NoPreference')]",
+                                        "catalogCollation": "[parameters('catalogCollation')]",
+                                        "collation": "[parameters('collation')]",
+                                        "createMode": "[parameters('createMode')]",
+                                        "elasticPoolId": "[parameters('elasticPoolResourceId')]",
+                                        "encryptionProtector": "[if(not(empty(parameters('customerManagedKey'))), if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), if(not(variables('isHSMManagedCMK')), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), format('https://{0}.managedhsm.azure.net/keys/{1}/{2}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName, parameters('customerManagedKey').keyVersion)), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault::cMKKey').keyUri, format('https://{0}.managedhsm.azure.net/keys/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName)), if(not(variables('isHSMManagedCMK')), reference('cMKKeyVault::cMKKey').keyUriWithVersion, fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.')))), null())]",
+                                        "encryptionProtectorAutoRotation": "[tryGet(parameters('customerManagedKey'), 'autoRotationEnabled')]",
+                                        "federatedClientId": "[parameters('federatedClientId')]",
+                                        "freeLimitExhaustionBehavior": "[parameters('freeLimitExhaustionBehavior')]",
+                                        "highAvailabilityReplicaCount": "[parameters('highAvailabilityReplicaCount')]",
+                                        "isLedgerOn": "[parameters('isLedgerOn')]",
+                                        "licenseType": "[parameters('licenseType')]",
+                                        "longTermRetentionBackupResourceId": "[parameters('longTermRetentionBackupResourceId')]",
+                                        "maintenanceConfigurationId": "[parameters('maintenanceConfigurationId')]",
+                                        "manualCutover": "[parameters('manualCutover')]",
+                                        "maxSizeBytes": "[parameters('maxSizeBytes')]",
+                                        "minCapacity": "[if(not(empty(parameters('minCapacity'))), json(parameters('minCapacity')), 0)]",
+                                        "performCutover": "[parameters('performCutover')]",
+                                        "preferredEnclaveType": "[parameters('preferredEnclaveType')]",
+                                        "readScale": "[parameters('readScale')]",
+                                        "recoverableDatabaseId": "[parameters('recoverableDatabaseResourceId')]",
+                                        "recoveryServicesRecoveryPointId": "[parameters('recoveryServicesRecoveryPointResourceId')]",
+                                        "requestedBackupStorageRedundancy": "[parameters('requestedBackupStorageRedundancy')]",
+                                        "restorableDroppedDatabaseId": "[parameters('restorableDroppedDatabaseResourceId')]",
+                                        "restorePointInTime": "[parameters('restorePointInTime')]",
+                                        "sampleName": "[parameters('sampleName')]",
+                                        "secondaryType": "[parameters('secondaryType')]",
+                                        "sourceDatabaseDeletionDate": "[parameters('sourceDatabaseDeletionDate')]",
+                                        "sourceDatabaseId": "[parameters('sourceDatabaseResourceId')]",
+                                        "sourceResourceId": "[parameters('sourceResourceId')]",
+                                        "useFreeLimit": "[parameters('useFreeLimit')]",
+                                        "zoneRedundant": "[parameters('zoneRedundant')]"
+                                      },
+                                      "dependsOn": [
+                                        "cMKKeyVault::cMKKey"
+                                      ]
+                                    },
+                                    "database_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "database_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[format('Microsoft.Sql/servers/{0}/databases/{1}', parameters('serverName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', replace(parameters('name'), ' ', '_')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "database"
+                                      ]
+                                    },
+                                    "database_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Sql/servers/{0}/databases/{1}', parameters('serverName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "database"
+                                      ]
+                                    },
+                                    "database_backupShortTermRetentionPolicy": {
+                                      "condition": "[not(empty(parameters('backupShortTermRetentionPolicy')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-shBakRetPol', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "serverName": {
+                                            "value": "[parameters('serverName')]"
+                                          },
+                                          "databaseName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "diffBackupIntervalInHours": {
+                                            "value": "[tryGet(parameters('backupShortTermRetentionPolicy'), 'diffBackupIntervalInHours')]"
+                                          },
+                                          "retentionDays": {
+                                            "value": "[tryGet(parameters('backupShortTermRetentionPolicy'), 'retentionDays')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.39.26.7824",
+                                              "templateHash": "13123232463186414429"
+                                            },
+                                            "name": "Azure SQL Server Database Short Term Backup Retention Policies",
+                                            "description": "This module deploys an Azure SQL Server Database Short-Term Backup Retention Policy."
+                                          },
+                                          "parameters": {
+                                            "serverName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the parent SQL Server."
+                                              }
+                                            },
+                                            "databaseName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the parent database."
+                                              }
+                                            },
+                                            "diffBackupIntervalInHours": {
+                                              "type": "int",
+                                              "defaultValue": 24,
+                                              "metadata": {
+                                                "description": "Optional. Differential backup interval in hours. For Hyperscal tiers this value will be ignored."
+                                              }
+                                            },
+                                            "retentionDays": {
+                                              "type": "int",
+                                              "defaultValue": 7,
+                                              "metadata": {
+                                                "description": "Optional. Poin-in-time retention in days."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.Sql/servers/databases/backupShortTermRetentionPolicies",
+                                              "apiVersion": "2023-08-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('serverName'), parameters('databaseName'), 'default')]",
+                                              "properties": {
+                                                "diffBackupIntervalInHours": "[if(equals(reference(resourceId('Microsoft.Sql/servers/databases', parameters('serverName'), parameters('databaseName')), '2023-08-01', 'full').sku.tier, 'Hyperscale'), null(), parameters('diffBackupIntervalInHours'))]",
+                                                "retentionDays": "[parameters('retentionDays')]"
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the short-term policy was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the short-term policy."
+                                              },
+                                              "value": "default"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the short-term policy."
+                                              },
+                                              "value": "[resourceId('Microsoft.Sql/servers/databases/backupShortTermRetentionPolicies', parameters('serverName'), parameters('databaseName'), 'default')]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "database"
+                                      ]
+                                    },
+                                    "database_backupLongTermRetentionPolicy": {
+                                      "condition": "[not(empty(parameters('backupLongTermRetentionPolicy')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-lgBakRetPol', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "serverName": {
+                                            "value": "[parameters('serverName')]"
+                                          },
+                                          "databaseName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "weeklyRetention": {
+                                            "value": "[tryGet(parameters('backupLongTermRetentionPolicy'), 'weeklyRetention')]"
+                                          },
+                                          "monthlyRetention": {
+                                            "value": "[tryGet(parameters('backupLongTermRetentionPolicy'), 'monthlyRetention')]"
+                                          },
+                                          "yearlyRetention": {
+                                            "value": "[tryGet(parameters('backupLongTermRetentionPolicy'), 'yearlyRetention')]"
+                                          },
+                                          "weekOfYear": {
+                                            "value": "[tryGet(parameters('backupLongTermRetentionPolicy'), 'weekOfYear')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.39.26.7824",
+                                              "templateHash": "15206682237606175692"
+                                            },
+                                            "name": "SQL Server Database Long Term Backup Retention Policies",
+                                            "description": "This module deploys an Azure SQL Server Database Long-Term Backup Retention Policy."
+                                          },
+                                          "parameters": {
+                                            "serverName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the parent SQL Server."
+                                              }
+                                            },
+                                            "databaseName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the parent database."
+                                              }
+                                            },
+                                            "monthlyRetention": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Monthly retention in ISO 8601 duration format."
+                                              }
+                                            },
+                                            "weeklyRetention": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Weekly retention in ISO 8601 duration format."
+                                              }
+                                            },
+                                            "weekOfYear": {
+                                              "type": "int",
+                                              "defaultValue": 1,
+                                              "metadata": {
+                                                "description": "Optional. Week of year backup to keep for yearly retention."
+                                              }
+                                            },
+                                            "yearlyRetention": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Yearly retention in ISO 8601 duration format."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "server::database": {
+                                              "existing": true,
+                                              "type": "Microsoft.Sql/servers/databases",
+                                              "apiVersion": "2023-08-01",
+                                              "name": "[format('{0}/{1}', parameters('serverName'), parameters('databaseName'))]"
+                                            },
+                                            "server": {
+                                              "existing": true,
+                                              "type": "Microsoft.Sql/servers",
+                                              "apiVersion": "2023-08-01",
+                                              "name": "[parameters('serverName')]"
+                                            },
+                                            "backupLongTermRetentionPolicy": {
+                                              "type": "Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies",
+                                              "apiVersion": "2023-08-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('serverName'), parameters('databaseName'), 'default')]",
+                                              "properties": {
+                                                "monthlyRetention": "[parameters('monthlyRetention')]",
+                                                "weeklyRetention": "[parameters('weeklyRetention')]",
+                                                "weekOfYear": "[parameters('weekOfYear')]",
+                                                "yearlyRetention": "[parameters('yearlyRetention')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the long-term policy was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the long-term policy."
+                                              },
+                                              "value": "default"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the long-term policy."
+                                              },
+                                              "value": "[resourceId('Microsoft.Sql/servers/databases/backupLongTermRetentionPolicies', parameters('serverName'), parameters('databaseName'), 'default')]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "database"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed database."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed database."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/databases', parameters('serverName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed database."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('database', '2023-08-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server",
+                                "server_elasticPools"
+                              ]
+                            },
+                            "server_elasticPools": {
+                              "copy": {
+                                "name": "server_elasticPools",
+                                "count": "[length(coalesce(parameters('elasticPools'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-SQLServer-ElasticPool-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('elasticPools'), createArray())[copyIndex()].name]"
+                                  },
+                                  "sku": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'sku')]"
+                                  },
+                                  "autoPauseDelay": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'autoPauseDelay')]"
+                                  },
+                                  "availabilityZone": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'availabilityZone')]"
+                                  },
+                                  "highAvailabilityReplicaCount": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'highAvailabilityReplicaCount')]"
+                                  },
+                                  "licenseType": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'licenseType')]"
+                                  },
+                                  "lock": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'lock')]"
+                                  },
+                                  "maintenanceConfigurationId": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'maintenanceConfigurationId')]"
+                                  },
+                                  "maxSizeBytes": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'maxSizeBytes')]"
+                                  },
+                                  "minCapacity": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'minCapacity')]"
+                                  },
+                                  "perDatabaseSettings": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'perDatabaseSettings')]"
+                                  },
+                                  "preferredEnclaveType": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'preferredEnclaveType')]"
+                                  },
+                                  "zoneRedundant": {
+                                    "value": "[tryGet(coalesce(parameters('elasticPools'), createArray())[copyIndex()], 'zoneRedundant')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "1733423336361222327"
+                                    },
+                                    "name": "SQL Server Elastic Pool",
+                                    "description": "This module deploys an Azure SQL Server Elastic Pool."
+                                  },
+                                  "definitions": {
+                                    "perDatabaseSettingsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "autoPauseDelay": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Auto Pause Delay for per database within pool."
+                                          }
+                                        },
+                                        "maxCapacity": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The maximum capacity any one database can consume. Examples: '0.5', '2'."
+                                          }
+                                        },
+                                        "minCapacity": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The minimum capacity all databases are guaranteed. Examples: '0.5', '1'."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The per database settings for the elastic pool."
+                                      }
+                                    },
+                                    "skuType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "capacity": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The capacity of the particular SKU."
+                                          }
+                                        },
+                                        "family": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If the service has different generations of hardware, for the same SKU, then that can be captured here."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "BC_DC",
+                                            "BC_Gen5",
+                                            "BasicPool",
+                                            "GP_DC",
+                                            "GP_FSv2",
+                                            "GP_Gen5",
+                                            "HS_Gen5",
+                                            "HS_MOPRMS",
+                                            "HS_PRMS",
+                                            "PremiumPool",
+                                            "ServerlessPool",
+                                            "StandardPool"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The name of the SKU, typically, a letter + Number code, e.g. P3."
+                                          }
+                                        },
+                                        "size": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Size of the particular SKU."
+                                          }
+                                        },
+                                        "tier": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The tier or edition of the particular SKU, e.g. Basic, Premium."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The elastic pool SKU."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Elastic Pool."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Sql/servers/elasticPools@2023-08-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the elastic pool."
+                                      }
+                                    },
+                                    "sku": {
+                                      "$ref": "#/definitions/skuType",
+                                      "defaultValue": {
+                                        "capacity": 2,
+                                        "name": "GP_Gen5",
+                                        "tier": "GeneralPurpose"
+                                      },
+                                      "metadata": {
+                                        "description": "Optional. The elastic pool SKU."
+                                      }
+                                    },
+                                    "autoPauseDelay": {
+                                      "type": "int",
+                                      "defaultValue": -1,
+                                      "metadata": {
+                                        "description": "Optional. Time in minutes after which elastic pool is automatically paused. A value of -1 means that automatic pause is disabled."
+                                      }
+                                    },
+                                    "availabilityZone": {
+                                      "type": "int",
+                                      "allowedValues": [
+                                        -1,
+                                        1,
+                                        2,
+                                        3
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. If set to 1, 2 or 3, the availability zone is hardcoded to that value. If set to -1, no zone is defined. Note that the availability zone numbers here are the logical availability zone in your Azure subscription. Different subscriptions might have a different mapping of the physical zone and logical zone. To understand more, please refer to [Physical and logical availability zones](https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview?tabs=azure-cli#physical-and-logical-availability-zones)."
+                                      }
+                                    },
+                                    "highAvailabilityReplicaCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of secondary replicas associated with the elastic pool that are used to provide high availability. Applicable only to Hyperscale elastic pools."
+                                      }
+                                    },
+                                    "licenseType": {
+                                      "type": "string",
+                                      "defaultValue": "LicenseIncluded",
+                                      "allowedValues": [
+                                        "BasePrice",
+                                        "LicenseIncluded"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The license type to apply for this elastic pool."
+                                      }
+                                    },
+                                    "maintenanceConfigurationId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Maintenance configuration resource ID assigned to the elastic pool. This configuration defines the period when the maintenance updates will will occur."
+                                      }
+                                    },
+                                    "maxSizeBytes": {
+                                      "type": "int",
+                                      "defaultValue": 34359738368,
+                                      "metadata": {
+                                        "description": "Optional. The storage limit for the database elastic pool in bytes."
+                                      }
+                                    },
+                                    "minCapacity": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Minimal capacity that serverless pool will not shrink below, if not paused."
+                                      }
+                                    },
+                                    "perDatabaseSettings": {
+                                      "$ref": "#/definitions/perDatabaseSettingsType",
+                                      "defaultValue": {
+                                        "autoPauseDelay": -1,
+                                        "maxCapacity": "2",
+                                        "minCapacity": "0"
+                                      },
+                                      "metadata": {
+                                        "description": "Optional. The per database settings for the elastic pool."
+                                      }
+                                    },
+                                    "preferredEnclaveType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Default",
+                                        "VBS"
+                                      ],
+                                      "defaultValue": "Default",
+                                      "metadata": {
+                                        "description": "Optional. Type of enclave requested on the elastic pool."
+                                      }
+                                    },
+                                    "zoneRedundant": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether or not this elastic pool is zone redundant, which means the replicas of this elastic pool will be spread across multiple availability zones."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                                      "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                                      "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+                                      "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                                      "Reservation Purchaser": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f7b75c60-3036-4b75-91c3-6b41c27c1689')]",
+                                      "Resource Policy Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '36243c78-bf99-498c-9df9-86d9f8d28608')]",
+                                      "SQL DB Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9b7fa17d-e63e-47b0-bb0a-15c516ac86ec')]",
+                                      "SQL Security Manager": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '056cd41c-7e88-42e1-933e-88ba6a50c9c3')]",
+                                      "SQL Server Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6d8ee4ec-f05a-4a1d-8b00-a9b17e38b437')]",
+                                      "SqlDb Migration Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '189207d4-bb67-4208-a635-b06afe8b2c57')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "server": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('serverName')]"
+                                    },
+                                    "elasticPool": {
+                                      "type": "Microsoft.Sql/servers/elasticPools",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "sku": "[parameters('sku')]",
+                                      "properties": {
+                                        "autoPauseDelay": "[parameters('autoPauseDelay')]",
+                                        "availabilityZone": "[if(not(equals(parameters('availabilityZone'), -1)), string(parameters('availabilityZone')), 'NoPreference')]",
+                                        "highAvailabilityReplicaCount": "[parameters('highAvailabilityReplicaCount')]",
+                                        "licenseType": "[parameters('licenseType')]",
+                                        "maintenanceConfigurationId": "[parameters('maintenanceConfigurationId')]",
+                                        "maxSizeBytes": "[parameters('maxSizeBytes')]",
+                                        "minCapacity": "[parameters('minCapacity')]",
+                                        "perDatabaseSettings": "[if(not(empty(parameters('perDatabaseSettings'))), createObject('autoPauseDelay', tryGet(parameters('perDatabaseSettings'), 'autoPauseDelay'), 'maxCapacity', json(tryGet(parameters('perDatabaseSettings'), 'maxCapacity')), 'minCapacity', json(tryGet(parameters('perDatabaseSettings'), 'minCapacity'))), null())]",
+                                        "preferredEnclaveType": "[parameters('preferredEnclaveType')]",
+                                        "zoneRedundant": "[parameters('zoneRedundant')]"
+                                      }
+                                    },
+                                    "elasticPool_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Sql/servers/{0}/elasticPools/{1}', parameters('serverName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "elasticPool"
+                                      ]
+                                    },
+                                    "elasticPool_roleAssignments": {
+                                      "copy": {
+                                        "name": "elasticPool_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Sql/servers/{0}/elasticPools/{1}', parameters('serverName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Sql/servers', parameters('serverName')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "elasticPool"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed Elastic Pool."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed Elastic Pool."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/elasticPools', parameters('serverName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed Elastic Pool."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('elasticPool', '2023-08-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "server_privateEndpoints": {
+                              "copy": {
+                                "name": "server_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-server-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Sql/servers', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer'), copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Sql/servers', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Sql/servers', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer')))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Sql/servers', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Sql/servers', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sqlServer')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.5.1644",
+                                      "templateHash": "16604612898799598358"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-10-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.38.5.1644",
+                                              "templateHash": "24141742673128945"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2024-10-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "server_firewallRules": {
+                              "copy": {
+                                "name": "server_firewallRules",
+                                "count": "[length(coalesce(parameters('firewallRules'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-FirewallRules-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('firewallRules'), createArray())[copyIndex()].name]"
+                                  },
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "endIpAddress": {
+                                    "value": "[tryGet(coalesce(parameters('firewallRules'), createArray())[copyIndex()], 'endIpAddress')]"
+                                  },
+                                  "startIpAddress": {
+                                    "value": "[tryGet(coalesce(parameters('firewallRules'), createArray())[copyIndex()], 'startIpAddress')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "3841110712005924932"
+                                    },
+                                    "name": "Azure SQL Server Firewall Rule",
+                                    "description": "This module deploys an Azure SQL Server Firewall Rule."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Server Firewall Rule."
+                                      }
+                                    },
+                                    "endIpAddress": {
+                                      "type": "string",
+                                      "defaultValue": "0.0.0.0",
+                                      "metadata": {
+                                        "description": "Optional. The end IP address of the firewall rule. Must be IPv4 format. Must be greater than or equal to startIpAddress. Use value '0.0.0.0' for all Azure-internal IP addresses."
+                                      }
+                                    },
+                                    "startIpAddress": {
+                                      "type": "string",
+                                      "defaultValue": "0.0.0.0",
+                                      "metadata": {
+                                        "description": "Optional. The start IP address of the firewall rule. Must be IPv4 format. Use value '0.0.0.0' for all Azure-internal IP addresses."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Sql/servers/firewallRules",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                                      "properties": {
+                                        "endIpAddress": "[parameters('endIpAddress')]",
+                                        "startIpAddress": "[parameters('startIpAddress')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed firewall rule."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed firewall rule."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/firewallRules', parameters('serverName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed firewall rule."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "server_virtualNetworkRules": {
+                              "copy": {
+                                "name": "server_virtualNetworkRules",
+                                "count": "[length(coalesce(parameters('virtualNetworkRules'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-VirtualNetworkRules-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('virtualNetworkRules'), createArray())[copyIndex()].name]"
+                                  },
+                                  "ignoreMissingVnetServiceEndpoint": {
+                                    "value": "[tryGet(coalesce(parameters('virtualNetworkRules'), createArray())[copyIndex()], 'ignoreMissingVnetServiceEndpoint')]"
+                                  },
+                                  "virtualNetworkSubnetResourceId": {
+                                    "value": "[coalesce(parameters('virtualNetworkRules'), createArray())[copyIndex()].virtualNetworkSubnetResourceId]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "8492844379308217081"
+                                    },
+                                    "name": "Azure SQL Server Virtual Network Rules",
+                                    "description": "This module deploys an Azure SQL Server Virtual Network Rule."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Server Virtual Network Rule."
+                                      }
+                                    },
+                                    "ignoreMissingVnetServiceEndpoint": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Allow creating a firewall rule before the virtual network has vnet service endpoint enabled."
+                                      }
+                                    },
+                                    "virtualNetworkSubnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the virtual network subnet."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Sql/servers/virtualNetworkRules",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                                      "properties": {
+                                        "ignoreMissingVnetServiceEndpoint": "[parameters('ignoreMissingVnetServiceEndpoint')]",
+                                        "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed virtual network rule."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed virtual network rule."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/virtualNetworkRules', parameters('serverName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed virtual network rule."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "server_securityAlertPolicies": {
+                              "copy": {
+                                "name": "server_securityAlertPolicies",
+                                "count": "[length(coalesce(parameters('securityAlertPolicies'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-SecAlertPolicy-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()].name]"
+                                  },
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "disabledAlerts": {
+                                    "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'disabledAlerts')]"
+                                  },
+                                  "emailAccountAdmins": {
+                                    "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'emailAccountAdmins')]"
+                                  },
+                                  "emailAddresses": {
+                                    "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'emailAddresses')]"
+                                  },
+                                  "retentionDays": {
+                                    "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'retentionDays')]"
+                                  },
+                                  "state": {
+                                    "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'state')]"
+                                  },
+                                  "storageAccountAccessKey": {
+                                    "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'storageAccountAccessKey')]"
+                                  },
+                                  "storageEndpoint": {
+                                    "value": "[tryGet(coalesce(parameters('securityAlertPolicies'), createArray())[copyIndex()], 'storageEndpoint')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "5279550187376165695"
+                                    },
+                                    "name": "Azure SQL Server Security Alert Policies",
+                                    "description": "This module deploys an Azure SQL Server Security Alert Policy."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Security Alert Policy."
+                                      }
+                                    },
+                                    "disabledAlerts": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "defaultValue": [],
+                                      "allowedValues": [
+                                        "Sql_Injection",
+                                        "Sql_Injection_Vulnerability",
+                                        "Access_Anomaly",
+                                        "Data_Exfiltration",
+                                        "Unsafe_Action",
+                                        "Brute_Force"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Alerts to disable."
+                                      }
+                                    },
+                                    "emailAccountAdmins": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Specifies that the alert is sent to the account administrators."
+                                      }
+                                    },
+                                    "emailAddresses": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. Specifies an array of email addresses to which the alert is sent."
+                                      }
+                                    },
+                                    "retentionDays": {
+                                      "type": "int",
+                                      "defaultValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the number of days to keep in the Threat Detection audit logs."
+                                      }
+                                    },
+                                    "state": {
+                                      "type": "string",
+                                      "defaultValue": "Disabled",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Specifies the state of the policy, whether it is enabled or disabled or a policy has not been applied yet on the specific database."
+                                      }
+                                    },
+                                    "storageAccountAccessKey": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the identifier key of the Threat Detection audit storage account."
+                                      }
+                                    },
+                                    "storageEndpoint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the blob storage endpoint. This blob storage will hold all Threat Detection audit logs."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent SQL Server. Required if the template is used in a standalone deployment."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "server": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('serverName')]"
+                                    },
+                                    "securityAlertPolicy": {
+                                      "type": "Microsoft.Sql/servers/securityAlertPolicies",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                                      "properties": {
+                                        "disabledAlerts": "[parameters('disabledAlerts')]",
+                                        "emailAccountAdmins": "[parameters('emailAccountAdmins')]",
+                                        "emailAddresses": "[parameters('emailAddresses')]",
+                                        "retentionDays": "[parameters('retentionDays')]",
+                                        "state": "[parameters('state')]",
+                                        "storageAccountAccessKey": "[parameters('storageAccountAccessKey')]",
+                                        "storageEndpoint": "[parameters('storageEndpoint')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed security alert policy."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed security alert policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/securityAlertPolicies', parameters('serverName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed security alert policy."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "server_vulnerabilityAssessment": {
+                              "condition": "[not(equals(parameters('vulnerabilityAssessmentsObj'), null()))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-VulnAssessm', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[parameters('vulnerabilityAssessmentsObj').name]"
+                                  },
+                                  "recurringScans": {
+                                    "value": "[tryGet(parameters('vulnerabilityAssessmentsObj'), 'recurringScans')]"
+                                  },
+                                  "storageAccountResourceId": {
+                                    "value": "[parameters('vulnerabilityAssessmentsObj').storageAccountResourceId]"
+                                  },
+                                  "useStorageAccountAccessKey": {
+                                    "value": "[tryGet(parameters('vulnerabilityAssessmentsObj'), 'useStorageAccountAccessKey')]"
+                                  },
+                                  "createStorageRoleAssignment": {
+                                    "value": "[tryGet(parameters('vulnerabilityAssessmentsObj'), 'createStorageRoleAssignment')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "10092162295370595463"
+                                    },
+                                    "name": "Azure SQL Server Vulnerability Assessments",
+                                    "description": "This module deploys an Azure SQL Server Vulnerability Assessment."
+                                  },
+                                  "definitions": {
+                                    "recurringScansType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "emails": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Specifies an array of e-mail addresses to which the scan notification is sent."
+                                          }
+                                        },
+                                        "emailSubscriptionAdmins": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specifies that the schedule scan notification will be sent to the subscription administrators."
+                                          }
+                                        },
+                                        "isEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Recurring scans state."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for recurring scans."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the vulnerability assessment."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The Name of SQL Server. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "recurringScans": {
+                                      "$ref": "#/definitions/recurringScansType",
+                                      "defaultValue": {
+                                        "emails": [],
+                                        "emailSubscriptionAdmins": false,
+                                        "isEnabled": false
+                                      },
+                                      "metadata": {
+                                        "description": "Optional. The recurring scans settings."
+                                      }
+                                    },
+                                    "storageAccountResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A blob storage to hold the scan results."
+                                      }
+                                    },
+                                    "useStorageAccountAccessKey": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Use Access Key to access the storage account. The storage account cannot be behind a firewall or virtual network. If an access key is not used, the SQL Server system assigned managed identity must be assigned the Storage Blob Data Contributor role on the storage account."
+                                      }
+                                    },
+                                    "createStorageRoleAssignment": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Create the Storage Blob Data Contributor role assignment on the storage account. Note, the role assignment must not already exist on the storage account."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "server": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('serverName')]"
+                                    },
+                                    "vulnerabilityAssessment": {
+                                      "type": "Microsoft.Sql/servers/vulnerabilityAssessments",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                                      "properties": {
+                                        "storageContainerPath": "[format('https://{0}.blob.{1}/vulnerability-assessment/', last(split(parameters('storageAccountResourceId'), '/')), environment().suffixes.storage)]",
+                                        "storageAccountAccessKey": "[if(parameters('useStorageAccountAccessKey'), listKeys(parameters('storageAccountResourceId'), '2019-06-01').keys[0].value, null())]",
+                                        "recurringScans": "[parameters('recurringScans')]"
+                                      }
+                                    },
+                                    "storageAccount_sbdc_rbac": {
+                                      "condition": "[and(not(parameters('useStorageAccountAccessKey')), parameters('createStorageRoleAssignment'))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-sbdc-rbac', parameters('serverName'))]",
+                                      "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                          },
+                                          "managedInstanceIdentityPrincipalId": {
+                                            "value": "[reference('server', '2023-08-01', 'full').identity.principalId]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.39.26.7824",
+                                              "templateHash": "2185022990623310445"
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string"
+                                            },
+                                            "managedInstanceIdentityPrincipalId": {
+                                              "type": "string"
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
+                                              "name": "[guid(format('{0}-{1}-Storage-Blob-Data-Contributor', resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), parameters('managedInstanceIdentityPrincipalId')))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                                "principalId": "[parameters('managedInstanceIdentityPrincipalId')]",
+                                                "principalType": "ServicePrincipal"
+                                              }
+                                            }
+                                          ]
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "server"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed vulnerability assessment."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed vulnerability assessment."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/vulnerabilityAssessments', parameters('serverName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed vulnerability assessment."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server",
+                                "server_securityAlertPolicies"
+                              ]
+                            },
+                            "server_keys": {
+                              "copy": {
+                                "name": "server_keys",
+                                "count": "[length(coalesce(parameters('keys'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-Key-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "serverKeyType": {
+                                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'serverKeyType')]"
+                                  },
+                                  "uri": {
+                                    "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'uri')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "7398069928503308425"
+                                    },
+                                    "name": "Azure SQL Server Keys",
+                                    "description": "This module deploys an Azure SQL Server Key."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The name of the key. Must follow the [<keyVaultName>_<keyName>_<keyVersion>] pattern."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent SQL server. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "serverKeyType": {
+                                      "type": "string",
+                                      "defaultValue": "ServiceManaged",
+                                      "allowedValues": [
+                                        "AzureKeyVault",
+                                        "ServiceManaged"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The server key type."
+                                      }
+                                    },
+                                    "uri": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The URI of the server key. If the ServerKeyType is AzureKeyVault, then the URI is required. The AKV URI is required to be in this format: 'https://YourVaultName.azure.net/keys/YourKeyName/YourKeyVersion'."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "splittedKeyUri": "[split(parameters('uri'), '/')]",
+                                    "serverKeyName": "[if(empty(parameters('uri')), 'ServiceManaged', format('{0}_{1}_{2}', split(variables('splittedKeyUri')[2], '.')[0], variables('splittedKeyUri')[4], variables('splittedKeyUri')[5]))]"
+                                  },
+                                  "resources": {
+                                    "server": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('serverName')]"
+                                    },
+                                    "key": {
+                                      "type": "Microsoft.Sql/servers/keys",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), coalesce(parameters('name'), variables('serverKeyName')))]",
+                                      "properties": {
+                                        "serverKeyType": "[parameters('serverKeyType')]",
+                                        "uri": "[parameters('uri')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed server key."
+                                      },
+                                      "value": "[coalesce(parameters('name'), variables('serverKeyName'))]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed server key."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/keys', parameters('serverName'), coalesce(parameters('name'), variables('serverKeyName')))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed server key."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "cmk_key": {
+                              "condition": "[not(equals(parameters('customerManagedKey'), null()))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-Key', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[format('{0}_{1}_{2}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'), if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), tryGet(parameters('customerManagedKey'), 'keyVersion'), if(not(variables('isHSMManagedCMK')), last(split(coalesce(tryGet(if(and(and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK'))), and(not(empty(parameters('customerManagedKey'))), not(variables('isHSMManagedCMK')))), reference('cMKKeyVault::cMKKey', '2025-05-01', 'full'), null()), 'properties', 'keyUriWithVersion'), ''), '/')), fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.'))))]"
+                                  },
+                                  "serverKeyType": {
+                                    "value": "AzureKeyVault"
+                                  },
+                                  "uri": "[if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), if(not(variables('isHSMManagedCMK')), createObject('value', format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion)), createObject('value', format('https://{0}.managedhsm.azure.net/keys/{1}/{2}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName, parameters('customerManagedKey').keyVersion))), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), if(not(variables('isHSMManagedCMK')), createObject('value', reference('cMKKeyVault::cMKKey').keyUri), createObject('value', format('https://{0}.managedhsm.azure.net/keys/{1}', last(split(parameters('customerManagedKey').keyVaultResourceId, '/')), parameters('customerManagedKey').keyName))), if(not(variables('isHSMManagedCMK')), createObject('value', reference('cMKKeyVault::cMKKey').keyUriWithVersion), createObject('value', fail('Managed HSM CMK encryption requires either specifying the ''keyVersion'' or omitting the ''autoRotationEnabled'' property. Setting ''autoRotationEnabled'' to false without a ''keyVersion'' is not allowed.')))))]"
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "7398069928503308425"
+                                    },
+                                    "name": "Azure SQL Server Keys",
+                                    "description": "This module deploys an Azure SQL Server Key."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The name of the key. Must follow the [<keyVaultName>_<keyName>_<keyVersion>] pattern."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent SQL server. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "serverKeyType": {
+                                      "type": "string",
+                                      "defaultValue": "ServiceManaged",
+                                      "allowedValues": [
+                                        "AzureKeyVault",
+                                        "ServiceManaged"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The server key type."
+                                      }
+                                    },
+                                    "uri": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The URI of the server key. If the ServerKeyType is AzureKeyVault, then the URI is required. The AKV URI is required to be in this format: 'https://YourVaultName.azure.net/keys/YourKeyName/YourKeyVersion'."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "splittedKeyUri": "[split(parameters('uri'), '/')]",
+                                    "serverKeyName": "[if(empty(parameters('uri')), 'ServiceManaged', format('{0}_{1}_{2}', split(variables('splittedKeyUri')[2], '.')[0], variables('splittedKeyUri')[4], variables('splittedKeyUri')[5]))]"
+                                  },
+                                  "resources": {
+                                    "server": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('serverName')]"
+                                    },
+                                    "key": {
+                                      "type": "Microsoft.Sql/servers/keys",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), coalesce(parameters('name'), variables('serverKeyName')))]",
+                                      "properties": {
+                                        "serverKeyType": "[parameters('serverKeyType')]",
+                                        "uri": "[parameters('uri')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed server key."
+                                      },
+                                      "value": "[coalesce(parameters('name'), variables('serverKeyName'))]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed server key."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/keys', parameters('serverName'), coalesce(parameters('name'), variables('serverKeyName')))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed server key."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "cMKKeyVault::cMKKey",
+                                "server"
+                              ]
+                            },
+                            "server_encryptionProtector": {
+                              "condition": "[not(equals(parameters('customerManagedKey'), null()))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-EncryProtector', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "sqlServerName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "serverKeyName": {
+                                    "value": "[coalesce(tryGet(if(not(equals(parameters('customerManagedKey'), null())), reference('cmk_key'), null()), 'outputs', 'name', 'value'), '')]"
+                                  },
+                                  "serverKeyType": {
+                                    "value": "AzureKeyVault"
+                                  },
+                                  "autoRotationEnabled": {
+                                    "value": "[tryGet(parameters('customerManagedKey'), 'autoRotationEnabled')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "443247778605325916"
+                                    },
+                                    "name": "Azure SQL Server Encryption Protector",
+                                    "description": "This module deploys an Azure SQL Server Encryption Protector."
+                                  },
+                                  "parameters": {
+                                    "sqlServerName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the sql server. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "serverKeyName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the server key."
+                                      }
+                                    },
+                                    "autoRotationEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Key auto rotation opt-in flag."
+                                      }
+                                    },
+                                    "serverKeyType": {
+                                      "type": "string",
+                                      "defaultValue": "ServiceManaged",
+                                      "allowedValues": [
+                                        "AzureKeyVault",
+                                        "ServiceManaged"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The encryption protector type."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Sql/servers/encryptionProtector",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('sqlServerName'), 'current')]",
+                                      "properties": {
+                                        "serverKeyType": "[parameters('serverKeyType')]",
+                                        "autoRotationEnabled": "[parameters('autoRotationEnabled')]",
+                                        "serverKeyName": "[parameters('serverKeyName')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed encryption protector."
+                                      },
+                                      "value": "current"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the encryption protector."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/encryptionProtector', parameters('sqlServerName'), 'current')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed encryption protector."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "cmk_key",
+                                "server"
+                              ]
+                            },
+                            "server_audit_settings": {
+                              "condition": "[not(empty(parameters('auditSettings')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-AuditSettings', uniqueString(deployment().name, parameters('location')))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(tryGet(parameters('auditSettings'), 'name'), 'default')]"
+                                  },
+                                  "state": {
+                                    "value": "[tryGet(parameters('auditSettings'), 'state')]"
+                                  },
+                                  "auditActionsAndGroups": {
+                                    "value": "[tryGet(parameters('auditSettings'), 'auditActionsAndGroups')]"
+                                  },
+                                  "isAzureMonitorTargetEnabled": {
+                                    "value": "[tryGet(parameters('auditSettings'), 'isAzureMonitorTargetEnabled')]"
+                                  },
+                                  "isDevopsAuditEnabled": {
+                                    "value": "[tryGet(parameters('auditSettings'), 'isDevopsAuditEnabled')]"
+                                  },
+                                  "isManagedIdentityInUse": {
+                                    "value": "[tryGet(parameters('auditSettings'), 'isManagedIdentityInUse')]"
+                                  },
+                                  "isStorageSecondaryKeyInUse": {
+                                    "value": "[tryGet(parameters('auditSettings'), 'isStorageSecondaryKeyInUse')]"
+                                  },
+                                  "queueDelayMs": {
+                                    "value": "[tryGet(parameters('auditSettings'), 'queueDelayMs')]"
+                                  },
+                                  "retentionDays": {
+                                    "value": "[tryGet(parameters('auditSettings'), 'retentionDays')]"
+                                  },
+                                  "storageAccountResourceId": {
+                                    "value": "[tryGet(parameters('auditSettings'), 'storageAccountResourceId')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "16723116616667912196"
+                                    },
+                                    "name": "Azure SQL Server Audit Settings",
+                                    "description": "This module deploys an Azure SQL Server Audit Settings."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the audit settings."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The Name of SQL Server. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "state": {
+                                      "type": "string",
+                                      "defaultValue": "Enabled",
+                                      "allowedValues": [
+                                        "Enabled",
+                                        "Disabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Specifies the state of the audit. If state is Enabled, storageEndpoint or isAzureMonitorTargetEnabled are required."
+                                      }
+                                    },
+                                    "auditActionsAndGroups": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "defaultValue": [
+                                        "BATCH_COMPLETED_GROUP",
+                                        "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
+                                        "FAILED_DATABASE_AUTHENTICATION_GROUP"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Specifies the Actions-Groups and Actions to audit."
+                                      }
+                                    },
+                                    "isAzureMonitorTargetEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies whether audit events are sent to Azure Monitor."
+                                      }
+                                    },
+                                    "isDevopsAuditEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the state of devops audit. If state is Enabled, devops logs will be sent to Azure Monitor."
+                                      }
+                                    },
+                                    "isManagedIdentityInUse": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Specifies whether Managed Identity is used to access blob storage."
+                                      }
+                                    },
+                                    "isStorageSecondaryKeyInUse": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Specifies whether storageAccountAccessKey value is the storage's secondary key."
+                                      }
+                                    },
+                                    "queueDelayMs": {
+                                      "type": "int",
+                                      "defaultValue": 1000,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the amount of time in milliseconds that can elapse before audit actions are forced to be processed."
+                                      }
+                                    },
+                                    "retentionDays": {
+                                      "type": "int",
+                                      "defaultValue": 90,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the number of days to keep in the audit logs in the storage account."
+                                      }
+                                    },
+                                    "storageAccountResourceId": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. A blob storage to hold the auditing storage account."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "server": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('serverName')]"
+                                    },
+                                    "auditSettings": {
+                                      "type": "Microsoft.Sql/servers/auditingSettings",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                                      "properties": {
+                                        "state": "[parameters('state')]",
+                                        "auditActionsAndGroups": "[parameters('auditActionsAndGroups')]",
+                                        "isAzureMonitorTargetEnabled": "[parameters('isAzureMonitorTargetEnabled')]",
+                                        "isDevopsAuditEnabled": "[parameters('isDevopsAuditEnabled')]",
+                                        "isManagedIdentityInUse": "[parameters('isManagedIdentityInUse')]",
+                                        "isStorageSecondaryKeyInUse": "[parameters('isStorageSecondaryKeyInUse')]",
+                                        "queueDelayMs": "[parameters('queueDelayMs')]",
+                                        "retentionDays": "[parameters('retentionDays')]",
+                                        "storageAccountAccessKey": "[if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('isManagedIdentityInUse'))), listKeys(parameters('storageAccountResourceId'), '2019-06-01').keys[0].value, null())]",
+                                        "storageAccountSubscriptionId": "[if(not(empty(parameters('storageAccountResourceId'))), split(parameters('storageAccountResourceId'), '/')[2], null())]",
+                                        "storageEndpoint": "[if(not(empty(parameters('storageAccountResourceId'))), format('https://{0}.blob.{1}', last(split(parameters('storageAccountResourceId'), '/')), environment().suffixes.storage), null())]"
+                                      }
+                                    },
+                                    "storageAccount_sbdc_rbac": {
+                                      "condition": "[and(parameters('isManagedIdentityInUse'), not(empty(parameters('storageAccountResourceId'))))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('storageAccount_sbdc_rbac-{0}', uniqueString('storageAccount_sbdc_rbac', deployment().name))]",
+                                      "subscriptionId": "[split(coalesce(parameters('storageAccountResourceId'), resourceGroup().id), '/')[2]]",
+                                      "resourceGroup": "[split(coalesce(parameters('storageAccountResourceId'), resourceGroup().id), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                          },
+                                          "managedIdentityPrincipalId": "[if(equals(reference('server', '2023-08-01', 'full').identity.type, 'UserAssigned'), createObject('value', filter(items(reference('server', '2023-08-01', 'full').identity.userAssignedIdentities), lambda('identity', equals(lambdaVariables('identity').key, reference('server').primaryUserAssignedIdentityId)))[0].value.principalId), createObject('value', reference('server', '2023-08-01', 'full').identity.principalId))]"
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.39.26.7824",
+                                              "templateHash": "623303847189521629"
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string"
+                                            },
+                                            "managedIdentityPrincipalId": {
+                                              "type": "string"
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
+                                              "name": "[guid(format('{0}-{1}-Storage-Blob-Data-Contributor', resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), parameters('managedIdentityPrincipalId')))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                                "principalId": "[parameters('managedIdentityPrincipalId')]",
+                                                "principalType": "ServicePrincipal"
+                                              }
+                                            }
+                                          ]
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "server"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed audit settings."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed audit settings."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/auditingSettings', parameters('serverName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed audit settings."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "secretsExport": {
+                              "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                              "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "keyVaultName": {
+                                    "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                                  },
+                                  "secretsToSet": {
+                                    "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'sqlAdminPasswordSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'sqlAdminPasswordSecretName'), 'value', parameters('administratorLoginPassword'))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'sqlAzureConnectionStringSecretName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'sqlAzureConnectionStringSecretName'), 'value', format('Server={0}; Database={1}; User={2}; Password={3}', reference('server').fullyQualifiedDomainName, if(not(empty(parameters('databases'))), tryGet(parameters('databases'), 0, 'name'), ''), parameters('administratorLogin'), parameters('administratorLoginPassword')))), createArray()))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "13065384800228530324"
+                                    }
+                                  },
+                                  "definitions": {
+                                    "secretSetOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "secretResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resourceId of the exported secret."
+                                          }
+                                        },
+                                        "secretUri": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI of the exported secret."
+                                          }
+                                        },
+                                        "secretUriWithVersion": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI with version of the exported secret."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "secretToSetType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the secret to set."
+                                          }
+                                        },
+                                        "value": {
+                                          "type": "securestring",
+                                          "metadata": {
+                                            "description": "Required. The value of the secret to set."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "keyVaultName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Key Vault to set the secrets in."
+                                      }
+                                    },
+                                    "secretsToSet": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/secretToSetType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The secrets to set in the Key Vault."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "keyVault": {
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('keyVaultName')]"
+                                    },
+                                    "secrets": {
+                                      "copy": {
+                                        "name": "secrets",
+                                        "count": "[length(parameters('secretsToSet'))]"
+                                      },
+                                      "type": "Microsoft.KeyVault/vaults/secrets",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                                      "properties": {
+                                        "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "secretsSet": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/secretSetOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The references to the secrets exported to the provided Key Vault."
+                                      },
+                                      "copy": {
+                                        "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                        "input": {
+                                          "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                          "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                                          "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                                        }
+                                      }
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server"
+                              ]
+                            },
+                            "failover_groups": {
+                              "copy": {
+                                "name": "failover_groups",
+                                "count": "[length(coalesce(parameters('failoverGroups'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Sql-FailoverGroup-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].name]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('failoverGroups'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "serverName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "databases": {
+                                    "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].databases]"
+                                  },
+                                  "partnerServerResourceIds": {
+                                    "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].partnerServerResourceIds]"
+                                  },
+                                  "readOnlyEndpoint": {
+                                    "value": "[tryGet(coalesce(parameters('failoverGroups'), createArray())[copyIndex()], 'readOnlyEndpoint')]"
+                                  },
+                                  "readWriteEndpoint": {
+                                    "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].readWriteEndpoint]"
+                                  },
+                                  "secondaryType": {
+                                    "value": "[coalesce(parameters('failoverGroups'), createArray())[copyIndex()].secondaryType]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.39.26.7824",
+                                      "templateHash": "11585026026133533203"
+                                    },
+                                    "name": "Azure SQL Server failover group",
+                                    "description": "This module deploys Azure SQL Server failover group."
+                                  },
+                                  "definitions": {
+                                    "readOnlyEndpointType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "failoverPolicy": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Disabled",
+                                            "Enabled"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. Failover policy of the read-only endpoint for the failover group."
+                                          }
+                                        },
+                                        "targetServer": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The target partner server where the read-only endpoint points to."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a read-only endpoint."
+                                      }
+                                    },
+                                    "readWriteEndpointType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "failoverPolicy": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Automatic",
+                                            "Manual"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. Failover policy of the read-write endpoint for the failover group. If failoverPolicy is Automatic then failoverWithDataLossGracePeriodMinutes is required."
+                                          }
+                                        },
+                                        "failoverWithDataLossGracePeriodMinutes": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Grace period before failover with data loss is attempted for the read-write endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a read-write endpoint."
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the failover group."
+                                      }
+                                    },
+                                    "serverName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The Name of SQL Server. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "databases": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. List of databases in the failover group."
+                                      }
+                                    },
+                                    "partnerServerResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. List of the partner server Resource Ids for the failover group."
+                                      }
+                                    },
+                                    "readOnlyEndpoint": {
+                                      "$ref": "#/definitions/readOnlyEndpointType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Read-only endpoint of the failover group instance."
+                                      }
+                                    },
+                                    "readWriteEndpoint": {
+                                      "$ref": "#/definitions/readWriteEndpointType",
+                                      "metadata": {
+                                        "description": "Required. Read-write endpoint of the failover group instance."
+                                      }
+                                    },
+                                    "secondaryType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Geo",
+                                        "Standby"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Databases secondary type on partner server."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Sql/servers/failoverGroups@2023-08-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "resources": {
+                                    "server": {
+                                      "existing": true,
+                                      "type": "Microsoft.Sql/servers",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('serverName')]"
+                                    },
+                                    "failoverGroup": {
+                                      "type": "Microsoft.Sql/servers/failoverGroups",
+                                      "apiVersion": "2024-05-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('serverName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "databases",
+                                            "count": "[length(parameters('databases'))]",
+                                            "input": "[resourceId('Microsoft.Sql/servers/databases', parameters('serverName'), parameters('databases')[copyIndex('databases')])]"
+                                          },
+                                          {
+                                            "name": "partnerServers",
+                                            "count": "[length(parameters('partnerServerResourceIds'))]",
+                                            "input": {
+                                              "id": "[parameters('partnerServerResourceIds')[copyIndex('partnerServers')]]"
+                                            }
+                                          }
+                                        ],
+                                        "readOnlyEndpoint": "[if(not(empty(parameters('readOnlyEndpoint'))), createObject('failoverPolicy', parameters('readOnlyEndpoint').failoverPolicy, 'targetServer', resourceId(resourceGroup().name, 'Microsoft.Sql/servers', parameters('readOnlyEndpoint').targetServer)), null())]",
+                                        "readWriteEndpoint": "[parameters('readWriteEndpoint')]",
+                                        "secondaryType": "[parameters('secondaryType')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed failover group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed failover group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Sql/servers/failoverGroups', parameters('serverName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed failover group."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "server",
+                                "server_databases"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed SQL server."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed SQL server."
+                              },
+                              "value": "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+                            },
+                            "fullyQualifiedDomainName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The fully qualified domain name of the deployed SQL server."
+                              },
+                              "value": "[reference('server').fullyQualifiedDomainName]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed SQL server."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('server', '2023-08-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('server', '2023-08-01', 'full').location]"
+                            },
+                            "exportedSecrets": {
+                              "$ref": "#/definitions/secretsOutputType",
+                              "metadata": {
+                                "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                              },
+                              "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(coalesce(tryGet(tryGet(tryGet(if(not(equals(parameters('secretsExportConfiguration'), null())), reference('secretsExport'), null()), 'outputs'), 'secretsSet'), 'value'), createArray()), lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the SQL server."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('server_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "serverFqdn": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Fully qualified domain name of the SQL Server."
+                      },
+                      "value": "[format('{0}.database.windows.net', parameters('name'))]"
+                    },
+                    "databaseName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the SQL Database."
+                      },
+                      "value": "[parameters('databaseName')]"
+                    },
+                    "serverResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the SQL Server."
+                      },
+                      "value": "[reference('sqlServer').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the SQL Server."
+                      },
+                      "value": "[reference('sqlServer').outputs.name.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').sqlServer)]",
+                "virtualNetwork"
+              ]
+            },
+            "hostingplan": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.app-service-plan.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "skuName": "[if(or(parameters('enableScalability'), parameters('enableRedundancy')), createObject('value', 'P1v3'), createObject('value', parameters('appServicePlanSku')))]",
+                  "skuCapacity": "[if(parameters('enableScalability'), createObject('value', 3), createObject('value', 1))]",
+                  "zoneRedundant": {
+                    "value": "[parameters('enableRedundancy')]"
+                  },
+                  "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "15442179113759093660"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('asp-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the App Service Plan."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "B2",
+                      "allowedValues": [
+                        "F1",
+                        "D1",
+                        "B1",
+                        "B2",
+                        "B3",
+                        "S1",
+                        "S2",
+                        "S3",
+                        "P1",
+                        "P2",
+                        "P3",
+                        "P4",
+                        "P0v3",
+                        "P0v4",
+                        "P1v3",
+                        "P1v4",
+                        "P2v3",
+                        "P3v3"
+                      ],
+                      "metadata": {
+                        "description": "SKU name for the App Service Plan."
+                      }
+                    },
+                    "reserved": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Whether the plan is Linux-based."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "linux",
+                      "metadata": {
+                        "description": "Kind of the App Service Plan."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "skuCapacity": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Number of instances (workers)."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Diagnostic settings for monitoring."
+                      }
+                    },
+                    "zoneRedundant": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable zone redundancy. Requires Premium SKU (P1v3+)."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.web.serverfarm.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "skuName": {
+                            "value": "[parameters('skuName')]"
+                          },
+                          "skuCapacity": {
+                            "value": "[parameters('skuCapacity')]"
+                          },
+                          "reserved": {
+                            "value": "[parameters('reserved')]"
+                          },
+                          "kind": {
+                            "value": "[parameters('kind')]"
+                          },
+                          "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]",
+                          "zoneRedundant": {
+                            "value": "[parameters('zoneRedundant')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.40.2.10011",
+                              "templateHash": "17925345736511474747"
+                            },
+                            "name": "App Service Plan",
+                            "description": "This module deploys an App Service Plan."
+                          },
+                          "definitions": {
+                            "diagnosticSettingMetricsOnlyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of diagnostic setting."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "minLength": 1,
+                              "maxLength": 60,
+                              "metadata": {
+                                "description": "Required. Name of the app service plan."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "skuName": {
+                              "type": "string",
+                              "defaultValue": "P1v3",
+                              "metadata": {
+                                "example": "  'F1'\n  'B1'\n  'P1v3'\n  'I1v2'\n  'FC1'\n  ",
+                                "description": "Optional. The name of the SKU will Determine the tier, size, family of the App Service Plan. This defaults to P1v3 to leverage availability zones."
+                              }
+                            },
+                            "skuCapacity": {
+                              "type": "int",
+                              "defaultValue": 3,
+                              "metadata": {
+                                "description": "Optional. Number of workers associated with the App Service Plan. This defaults to 3, to leverage availability zones."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/kind"
+                                },
+                                "description": "Optional. Kind of server OS."
+                              },
+                              "defaultValue": "app"
+                            },
+                            "reserved": {
+                              "type": "bool",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/reserved"
+                                },
+                                "description": "Conditional. Defaults to false when creating Windows/app App Service Plan. Required if creating a Linux App Service Plan and must be set to true."
+                              },
+                              "defaultValue": "[equals(parameters('kind'), 'linux')]"
+                            },
+                            "appServiceEnvironmentResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The Resource ID of the App Service Environment to use for the App Service Plan."
+                              }
+                            },
+                            "workerTierName": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/workerTierName"
+                                },
+                                "description": "Optional. Target worker tier assigned to the App Service plan."
+                              },
+                              "nullable": true
+                            },
+                            "perSiteScaling": {
+                              "type": "bool",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/perSiteScaling"
+                                },
+                                "description": "Optional. If true, apps assigned to this App Service plan can be scaled independently. If false, apps assigned to this App Service plan will scale to all instances of the plan."
+                              },
+                              "defaultValue": false
+                            },
+                            "elasticScaleEnabled": {
+                              "type": "bool",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/elasticScaleEnabled"
+                                },
+                                "description": "Optional. Enable/Disable ElasticScaleEnabled App Service Plan."
+                              },
+                              "defaultValue": "[greater(parameters('maximumElasticWorkerCount'), 1)]"
+                            },
+                            "maximumElasticWorkerCount": {
+                              "type": "int",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/maximumElasticWorkerCount"
+                                },
+                                "description": "Optional. Maximum number of total workers allowed for this ElasticScaleEnabled App Service Plan."
+                              },
+                              "defaultValue": 1
+                            },
+                            "targetWorkerCount": {
+                              "type": "int",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/targetWorkerCount"
+                                },
+                                "description": "Optional. Scaling worker count."
+                              },
+                              "defaultValue": 0
+                            },
+                            "targetWorkerSize": {
+                              "type": "int",
+                              "defaultValue": 0,
+                              "allowedValues": [
+                                0,
+                                1,
+                                2
+                              ],
+                              "metadata": {
+                                "description": "Optional. The instance size of the hosting plan (small, medium, or large)."
+                              }
+                            },
+                            "zoneRedundant": {
+                              "type": "bool",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/zoneRedundant"
+                                },
+                                "description": "Optional. Zone Redundant server farms can only be used on Premium or ElasticPremium SKU tiers within ZRS Supported regions (https://learn.microsoft.com/en-us/azure/storage/common/redundancy-regions-zrs)."
+                              },
+                              "defaultValue": "[if(or(startsWith(parameters('skuName'), 'P'), startsWith(parameters('skuName'), 'EP')), true(), false())]"
+                            },
+                            "hyperV": {
+                              "type": "bool",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/hyperV"
+                                },
+                                "description": "Optional. If Hyper-V container app service plan true, false otherwise."
+                              },
+                              "nullable": true
+                            },
+                            "virtualNetworkSubnetId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the subnet to integrate the App Service Plan with for VNet integration."
+                              }
+                            },
+                            "isCustomMode": {
+                              "type": "bool",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/isCustomMode"
+                                },
+                                "description": "Optional. Set to true to enable Managed Instance custom mode. Required for App Service Managed Instance plans."
+                              },
+                              "defaultValue": false
+                            },
+                            "rdpEnabled": {
+                              "type": "bool",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/rdpEnabled"
+                                },
+                                "description": "Optional. Whether RDP is enabled for Managed Instance plans. Only applicable when isCustomMode is true. Requires a Bastion host deployed in the VNet."
+                              },
+                              "nullable": true
+                            },
+                            "installScripts": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/installScripts"
+                                },
+                                "description": "Optional. A list of install scripts for Managed Instance plans. Only applicable when isCustomMode is true."
+                              },
+                              "nullable": true
+                            },
+                            "planDefaultIdentity": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/planDefaultIdentity"
+                                },
+                                "description": "Optional. The default identity configuration for Managed Instance plans. Only applicable when isCustomMode is true."
+                              },
+                              "nullable": true
+                            },
+                            "registryAdapters": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/registryAdapters"
+                                },
+                                "description": "Optional. A list of registry adapters for Managed Instance plans. Only applicable when isCustomMode is true."
+                              },
+                              "nullable": true
+                            },
+                            "storageMounts": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/properties/properties/storageMounts"
+                                },
+                                "description": "Optional. A list of storage mounts for Managed Instance plans. Only applicable when isCustomMode is true."
+                              },
+                              "nullable": true
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/serverfarms@2025-03-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                              "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                              "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                            },
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.web-serverfarm.{0}.{1}', replace('0.7.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "appServicePlan": {
+                              "type": "Microsoft.Web/serverfarms",
+                              "apiVersion": "2025-03-01",
+                              "name": "[parameters('name')]",
+                              "kind": "[parameters('kind')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "sku": "[if(equals(parameters('skuName'), 'FC1'), createObject('name', parameters('skuName'), 'tier', 'FlexConsumption'), createObject('name', parameters('skuName'), 'capacity', parameters('skuCapacity')))]",
+                              "properties": {
+                                "workerTierName": "[parameters('workerTierName')]",
+                                "hostingEnvironmentProfile": "[if(not(equals(parameters('appServiceEnvironmentResourceId'), null())), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                                "perSiteScaling": "[parameters('perSiteScaling')]",
+                                "maximumElasticWorkerCount": "[parameters('maximumElasticWorkerCount')]",
+                                "elasticScaleEnabled": "[parameters('elasticScaleEnabled')]",
+                                "reserved": "[parameters('reserved')]",
+                                "targetWorkerCount": "[parameters('targetWorkerCount')]",
+                                "targetWorkerSizeId": "[parameters('targetWorkerSize')]",
+                                "zoneRedundant": "[parameters('zoneRedundant')]",
+                                "hyperV": "[parameters('hyperV')]",
+                                "isCustomMode": "[parameters('isCustomMode')]",
+                                "network": "[if(not(equals(parameters('virtualNetworkSubnetId'), null())), createObject('virtualNetworkSubnetId', parameters('virtualNetworkSubnetId')), null())]",
+                                "rdpEnabled": "[if(parameters('isCustomMode'), parameters('rdpEnabled'), null())]",
+                                "installScripts": "[if(parameters('isCustomMode'), parameters('installScripts'), null())]",
+                                "planDefaultIdentity": "[if(parameters('isCustomMode'), parameters('planDefaultIdentity'), null())]",
+                                "registryAdapters": "[if(parameters('isCustomMode'), parameters('registryAdapters'), null())]",
+                                "storageMounts": "[if(parameters('isCustomMode'), parameters('storageMounts'), null())]"
+                              }
+                            },
+                            "appServicePlan_diagnosticSettings": {
+                              "copy": {
+                                "name": "appServicePlan_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "appServicePlan"
+                              ]
+                            },
+                            "appServicePlan_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "appServicePlan"
+                              ]
+                            },
+                            "appServicePlan_roleAssignments": {
+                              "copy": {
+                                "name": "appServicePlan_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/serverfarms', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "appServicePlan"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the app service plan was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the app service plan."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the app service plan."
+                              },
+                              "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('appServicePlan', '2025-03-01', 'full').location]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('appServicePlan', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                            }
+                          }
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the App Service Plan."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.web.serverfarm.{0}', parameters('name')), 64)), '2025-04-01').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the App Service Plan."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('avm.res.web.serverfarm.{0}', parameters('name')), 64)), '2025-04-01').outputs.name.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "log_analytics"
+              ]
+            },
+            "container_registry": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.container-registry.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "name": {
+                    "value": "[variables('containerRegistryResourceName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "sku": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Premium'), createObject('value', 'Standard'))]",
+                  "adminUserEnabled": {
+                    "value": false
+                  },
+                  "acrPushPrincipalIds": {
+                    "value": [
+                      "[variables('deployingUserPrincipalId')]"
+                    ]
+                  },
+                  "acrPushPrincipalType": "[if(equals(parameters('deployingUserPrincipalType'), 'User'), createObject('value', 'User'), createObject('value', 'ServicePrincipal'))]",
+                  "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                  "networkRuleSetDefaultAction": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Deny'), createObject('value', 'Allow'))]",
+                  "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-{0}', variables('containerRegistryResourceName')), 'customNetworkInterfaceName', format('nic-{0}', variables('containerRegistryResourceName')), 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'service', 'registry', 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').containerRegistry)).outputs.resourceId.value)))))), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "3930444124847538270"
+                    }
+                  },
+                  "definitions": {
+                    "_1.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_1.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name used for naming convention."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[replace(format('cr{0}', parameters('solutionName')), '-', '')]",
+                      "metadata": {
+                        "description": "Name of the container registry."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for deployment."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Resource tags."
+                      }
+                    },
+                    "sku": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "allowedValues": [
+                        "Basic",
+                        "Standard",
+                        "Premium"
+                      ],
+                      "metadata": {
+                        "description": "SKU for the container registry."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    },
+                    "exportPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "enabled",
+                      "metadata": {
+                        "description": "Export policy status. Must be \"enabled\" when publicNetworkAccess is \"Enabled\"."
+                      }
+                    },
+                    "azureADAuthenticationAsArmPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "enabled",
+                      "allowedValues": [
+                        "enabled",
+                        "disabled"
+                      ],
+                      "metadata": {
+                        "description": "ARM-audience AAD token policy status. Keep \"enabled\" for App Service managed-identity ACR pulls."
+                      }
+                    },
+                    "acrPullPrincipalIds": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Principal IDs to assign AcrPull role."
+                      }
+                    },
+                    "acrPushPrincipalIds": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Principal IDs to assign AcrPush role (typically the deployer)."
+                      }
+                    },
+                    "acrPushPrincipalType": {
+                      "type": "string",
+                      "defaultValue": "User",
+                      "allowedValues": [
+                        "User",
+                        "ServicePrincipal",
+                        "Group"
+                      ],
+                      "metadata": {
+                        "description": "Principal type for AcrPush assignments (User for azd user, ServicePrincipal for CI)."
+                      }
+                    },
+                    "adminUserEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable the ACR admin user (username/password). Used by App Service for reliable image pulls behind a private VNet."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "networkRuleSetDefaultAction": {
+                      "type": "string",
+                      "defaultValue": "Allow",
+                      "allowedValues": [
+                        "Allow",
+                        "Deny"
+                      ],
+                      "metadata": {
+                        "description": "Default action for the network rule set. Use Allow when no private endpoint is in place; Deny for private-only."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Enable Azure telemetry collection."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "pullRoleAssignments",
+                        "count": "[length(parameters('acrPullPrincipalIds'))]",
+                        "input": {
+                          "principalId": "[parameters('acrPullPrincipalIds')[copyIndex('pullRoleAssignments')]]",
+                          "roleDefinitionIdOrName": "[variables('acrPullRoleId')]",
+                          "principalType": "ServicePrincipal"
+                        }
+                      },
+                      {
+                        "name": "pushRoleAssignments",
+                        "count": "[length(parameters('acrPushPrincipalIds'))]",
+                        "input": {
+                          "principalId": "[parameters('acrPushPrincipalIds')[copyIndex('pushRoleAssignments')]]",
+                          "roleDefinitionIdOrName": "[variables('acrPushRoleId')]",
+                          "principalType": "[parameters('acrPushPrincipalType')]"
+                        }
+                      }
+                    ],
+                    "acrPullRoleId": "7f951dda-4ed3-4680-a7ca-43fe172d538d",
+                    "acrPushRoleId": "8311e382-0749-4cb8-b61a-304f252e45ec",
+                    "roleAssignments": "[concat(if(not(empty(parameters('acrPullPrincipalIds'))), variables('pullRoleAssignments'), createArray()), if(not(empty(parameters('acrPushPrincipalIds'))), variables('pushRoleAssignments'), createArray()))]"
+                  },
+                  "resources": {
+                    "containerRegistry": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.containerregistry.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "acrSku": {
+                            "value": "[parameters('sku')]"
+                          },
+                          "acrAdminUserEnabled": {
+                            "value": "[parameters('adminUserEnabled')]"
+                          },
+                          "publicNetworkAccess": {
+                            "value": "[parameters('publicNetworkAccess')]"
+                          },
+                          "exportPolicyStatus": {
+                            "value": "[parameters('exportPolicyStatus')]"
+                          },
+                          "azureADAuthenticationAsArmPolicyStatus": {
+                            "value": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
+                          },
+                          "roleAssignments": "[if(not(empty(variables('roleAssignments'))), createObject('value', variables('roleAssignments')), createObject('value', createArray()))]",
+                          "privateEndpoints": {
+                            "value": "[parameters('privateEndpoints')]"
+                          },
+                          "networkRuleSetDefaultAction": {
+                            "value": "[parameters('networkRuleSetDefaultAction')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.42.1.51946",
+                              "templateHash": "1509121545318808417"
+                            },
+                            "name": "Azure Container Registries (ACR)",
+                            "description": "This module deploys an Azure Container Registry (ACR)."
+                          },
+                          "definitions": {
+                            "privateEndpointOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The group Id for the private endpoint Group."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "FQDN that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses of the private endpoint."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "credentialSetType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the credential set."
+                                  }
+                                },
+                                "managedIdentities": {
+                                  "$ref": "#/definitions/managedIdentityOnlySysAssignedType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The managed identity definition for this resource."
+                                  }
+                                },
+                                "authCredentials": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/authCredentialsType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential."
+                                  }
+                                },
+                                "loginServer": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The credentials are stored for this upstream or login server."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a credential set."
+                              }
+                            },
+                            "scopeMapsType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the scope map."
+                                  }
+                                },
+                                "actions": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/scopeMaps@2025-03-01-preview#properties/properties/properties/actions"
+                                    },
+                                    "description": "Required. The list of scoped permissions for registry artifacts."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The user friendly description of the scope map."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a scope map."
+                              }
+                            },
+                            "cacheRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined."
+                                  }
+                                },
+                                "sourceRepository": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Source repository pulled from upstream."
+                                  }
+                                },
+                                "targetRepository": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                                  }
+                                },
+                                "credentialSetResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the credential store which is associated with the cache rule."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cache rule."
+                              }
+                            },
+                            "replicationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the replication."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location for all resources."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/replications@2025-03-01-preview#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "regionEndpointEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                                  }
+                                },
+                                "zoneRedundancy": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries@2025-03-01-preview#properties/properties/properties/zoneRedundancy"
+                                    },
+                                    "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                                  },
+                                  "nullable": true
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a replication."
+                              }
+                            },
+                            "taskType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the task."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location for all resources."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "platform": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/platform"
+                                    },
+                                    "description": "Optional. The platform properties for the task."
+                                  },
+                                  "nullable": true
+                                },
+                                "step": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/step"
+                                    },
+                                    "description": "Optional. The step properties for the task."
+                                  },
+                                  "nullable": true
+                                },
+                                "trigger": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/trigger"
+                                    },
+                                    "description": "Optional. The trigger properties for the task."
+                                  },
+                                  "nullable": true
+                                },
+                                "status": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/status"
+                                    },
+                                    "description": "Optional. The status of the task at the time the operation was called."
+                                  },
+                                  "nullable": true
+                                },
+                                "timeout": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timeout in seconds for the task to run before it is automatically disabled."
+                                  }
+                                },
+                                "agentConfiguration": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/agentConfiguration"
+                                    },
+                                    "description": "Optional. The agent configuration for the task."
+                                  },
+                                  "nullable": true
+                                },
+                                "agentPoolName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the agent pool to run the task on. If not specified, the task will run on Microsoft-hosted agents."
+                                  }
+                                },
+                                "isSystemTask": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether this is a system task or not. System tasks have some additional restrictions and are used for internal purposes by Microsoft services, such as Azure DevOps pipelines integration."
+                                  }
+                                },
+                                "logTemplate": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The log template for the task to use when creating logs in Log Analytics."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a task."
+                              }
+                            },
+                            "tokenType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the token."
+                                  }
+                                },
+                                "scopeMapResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the scope map which defines the permissions for this token."
+                                  }
+                                },
+                                "status": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/tokens@2025-11-01#properties/properties/properties/status"
+                                    },
+                                    "description": "Optional. The status of the token at the time the operation was called."
+                                  },
+                                  "nullable": true
+                                },
+                                "credentials": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/authCredentialsType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The list of credentials associated with the token. Usually consists of a primary and an optional secondary credential."
+                                  }
+                                }
+                              }
+                            },
+                            "webhookType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "minLength": 5,
+                                  "maxLength": 50,
+                                  "metadata": {
+                                    "description": "Optional. The name of the registry webhook."
+                                  }
+                                },
+                                "serviceUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The service URI for the webhook to post notifications."
+                                  }
+                                },
+                                "status": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/webhooks@2025-03-01-preview#properties/properties/properties/status"
+                                    },
+                                    "description": "Optional. The status of the webhook at the time the operation was called."
+                                  },
+                                  "nullable": true
+                                },
+                                "action": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The list of actions that trigger the webhook to post notifications."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location for all resources."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/webhooks@2025-03-01-preview#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "customHeaders": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.ContainerRegistry/registries/webhooks@2025-03-01-preview#properties/properties/properties/customHeaders"
+                                    },
+                                    "description": "Optional. Custom headers that will be added to the webhook notifications."
+                                  },
+                                  "nullable": true
+                                },
+                                "scope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a webhook."
+                              }
+                            },
+                            "_1.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "authCredentialsType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the credential."
+                                  }
+                                },
+                                "usernameSecretIdentifier": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. KeyVault Secret URI for accessing the username."
+                                  }
+                                },
+                                "passwordSecretIdentifier": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. KeyVault Secret URI for accessing the password."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for auth credentials.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "credential-set/main.bicep"
+                                }
+                              }
+                            },
+                            "customerManagedKeyWithAutoRotateType": {
+                              "type": "object",
+                              "properties": {
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                  }
+                                },
+                                "keyName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the customer managed key to use for encryption."
+                                  }
+                                },
+                                "keyVersion": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                                  }
+                                },
+                                "autoRotationEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                                  }
+                                },
+                                "userAssignedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "managedIdentityOnlySysAssignedType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "privateEndpointSingleServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private Endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the Private Endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "minLength": 5,
+                              "maxLength": 50,
+                              "metadata": {
+                                "description": "Required. Name of your Azure Container Registry."
+                              }
+                            },
+                            "acrAdminUserEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enable admin user that have push / pull permission to the registry."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "autoGeneratedDomainNameLabelScope": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "NoReuse",
+                                "ResourceGroupReuse",
+                                "SubscriptionReuse",
+                                "TenantReuse",
+                                "Unsecure"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The domain name label reuse scope."
+                              }
+                            },
+                            "roleAssignmentMode": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "AbacRepositoryPermissions",
+                                "LegacyRegistryPermissions"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The registry permissions role assignment mode."
+                              }
+                            },
+                            "acrSku": {
+                              "type": "string",
+                              "defaultValue": "Premium",
+                              "allowedValues": [
+                                "Basic",
+                                "Premium",
+                                "Standard"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Tier of your Azure container registry."
+                              }
+                            },
+                            "exportPolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "disabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the export policy is enabled or not."
+                              }
+                            },
+                            "quarantinePolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "disabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "trustPolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "disabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "retentionPolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "enabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the retention policy is enabled or not."
+                              }
+                            },
+                            "retentionPolicyDays": {
+                              "type": "int",
+                              "defaultValue": 15,
+                              "metadata": {
+                                "description": "Optional. The number of days to retain an untagged manifest after which it gets purged."
+                              }
+                            },
+                            "azureADAuthenticationAsArmPolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "disabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registry is enabled or not. Default is disabled."
+                              }
+                            },
+                            "softDeletePolicyStatus": {
+                              "type": "string",
+                              "defaultValue": "disabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Soft Delete policy status. Default is disabled."
+                              }
+                            },
+                            "softDeletePolicyDays": {
+                              "type": "int",
+                              "defaultValue": 7,
+                              "metadata": {
+                                "description": "Optional. The number of days after which a soft-deleted item is permanently deleted."
+                              }
+                            },
+                            "dataEndpointEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "Enabled",
+                                "Disabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set.  Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "networkRuleBypassOptions": {
+                              "type": "string",
+                              "defaultValue": "AzureServices",
+                              "allowedValues": [
+                                "AzureServices",
+                                "None"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry."
+                              }
+                            },
+                            "networkRuleSetDefaultAction": {
+                              "type": "string",
+                              "defaultValue": "Deny",
+                              "allowedValues": [
+                                "Allow",
+                                "Deny"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The default action of allow or deny when no other rules match."
+                              }
+                            },
+                            "networkRuleSetIpRules": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'. Set to an empty array to explicitly configure no allowed IPs."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointSingleServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'."
+                              }
+                            },
+                            "zoneRedundancy": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                              }
+                            },
+                            "replications": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/replicationType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. All replications to create."
+                              }
+                            },
+                            "webhooks": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/webhookType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. All webhooks to create."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.ContainerRegistry/registries@2025-04-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service. If neither metrics nor logs are specified, all metrics & logs are configured by default. If either one is specified, the other is ignored."
+                              }
+                            },
+                            "anonymousPullEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers."
+                              }
+                            },
+                            "customerManagedKey": {
+                              "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The customer managed key definition."
+                              }
+                            },
+                            "cacheRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/cacheRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of Cache Rules."
+                              }
+                            },
+                            "credentialSets": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/credentialSetType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of Credential Sets."
+                              }
+                            },
+                            "scopeMaps": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/scopeMapsType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Scope maps setting."
+                              }
+                            },
+                            "tokens": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/tokenType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tokens to create for the container registry."
+                              }
+                            },
+                            "tasks": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/taskType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of ACR Tasks to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]",
+                              "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]",
+                              "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
+                              "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]",
+                              "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]",
+                              "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]",
+                              "Container Registry Repository Catalog Lister": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'bfdb9389-c9a5-478a-bb2f-ba9ca092c3c7')]",
+                              "Container Registry Repository Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2efddaa5-3f1f-4df3-97df-af3f13818f4c')]",
+                              "Container Registry Repository Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b93aa761-3e63-49ed-ac28-beffa264f7ac')]",
+                              "Container Registry Repository Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a1e307c-b015-4ebd-883e-5b7698a07328')]",
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            },
+                            "publicNetworkAccessMode": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]",
+                            "shouldConfigureNetworkRuleSet": "[or(not(equals(parameters('networkRuleSetIpRules'), null())), and(equals(variables('publicNetworkAccessMode'), 'Enabled'), equals(parameters('networkRuleSetDefaultAction'), 'Deny')))]"
+                          },
+                          "resources": {
+                            "cMKKeyVault::cMKKey": {
+                              "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults/keys",
+                              "apiVersion": "2024-11-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                            },
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.12.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "cMKKeyVault": {
+                              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2024-11-01",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                            },
+                            "cMKUserAssignedIdentity": {
+                              "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                              "apiVersion": "2024-11-30",
+                              "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                              "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                              "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                            },
+                            "registry": {
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2025-06-01-preview",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "identity": "[variables('identity')]",
+                              "tags": "[parameters('tags')]",
+                              "sku": {
+                                "name": "[parameters('acrSku')]"
+                              },
+                              "properties": {
+                                "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]",
+                                "adminUserEnabled": "[parameters('acrAdminUserEnabled')]",
+                                "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                                "roleAssignmentMode": "[parameters('roleAssignmentMode')]",
+                                "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, tryGet(parameters('customerManagedKey'), 'keyVersion')), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), reference('cMKKeyVault::cMKKey').keyUri, reference('cMKKeyVault::cMKKey').keyUriWithVersion)))), null())]",
+                                "policies": {
+                                  "azureADAuthenticationAsArmPolicy": {
+                                    "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
+                                  },
+                                  "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]",
+                                  "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]",
+                                  "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]",
+                                  "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]",
+                                  "softDeletePolicy": {
+                                    "retentionDays": "[parameters('softDeletePolicyDays')]",
+                                    "status": "[parameters('softDeletePolicyStatus')]"
+                                  }
+                                },
+                                "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]",
+                                "publicNetworkAccess": "[variables('publicNetworkAccessMode')]",
+                                "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]",
+                                "networkRuleSet": "[if(variables('shouldConfigureNetworkRuleSet'), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', coalesce(parameters('networkRuleSetIpRules'), createArray())), null())]",
+                                "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]"
+                              },
+                              "dependsOn": [
+                                "cMKKeyVault::cMKKey",
+                                "cMKUserAssignedIdentity"
+                              ]
+                            },
+                            "registry_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_diagnosticSettings": {
+                              "copy": {
+                                "name": "registry_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups')), createArray(createObject('category', 'AllMetrics')), createArray())))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups')), createArray(createObject('category', 'AllMetrics')), createArray()))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups')), createArray(createObject('category', 'AllMetrics')), createArray()))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories')), createArray(createObject('categoryGroup', 'allLogs')), createArray())))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories')), createArray(createObject('categoryGroup', 'allLogs')), createArray()))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories')), createArray(createObject('categoryGroup', 'allLogs')), createArray()))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), if(empty(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories')), createArray(createObject('categoryGroup', 'allLogs')), createArray()))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_roleAssignments": {
+                              "copy": {
+                                "name": "registry_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_scopeMaps": {
+                              "copy": {
+                                "name": "registry_scopeMaps",
+                                "count": "[length(coalesce(parameters('scopeMaps'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Registry-Scope-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "actions": {
+                                    "value": "[coalesce(parameters('scopeMaps'), createArray())[copyIndex()].actions]"
+                                  },
+                                  "description": {
+                                    "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'description')]"
+                                  },
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.42.1.51946",
+                                      "templateHash": "3787322352564227867"
+                                    },
+                                    "name": "Container Registries scope maps",
+                                    "description": "This module deploys an Azure Container Registry (ACR) scope map."
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[format('{0}-scopemaps', parameters('registryName'))]",
+                                      "metadata": {
+                                        "description": "Optional. The name of the scope map."
+                                      }
+                                    },
+                                    "actions": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The list of scoped permissions for registry artifacts."
+                                      }
+                                    },
+                                    "description": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The user friendly description of the scope map."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.containerregistry-registry-scopemap.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "scopeMap": {
+                                      "type": "Microsoft.ContainerRegistry/registries/scopeMaps",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "properties": {
+                                        "actions": "[parameters('actions')]",
+                                        "description": "[parameters('description')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the scope map."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the scope map was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the scope map."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/scopeMaps', parameters('registryName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_replications": {
+                              "copy": {
+                                "name": "registry_replications",
+                                "count": "[length(coalesce(parameters('replications'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]"
+                                  },
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]"
+                                  },
+                                  "regionEndpointEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]"
+                                  },
+                                  "zoneRedundancy": {
+                                    "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.42.1.51946",
+                                      "templateHash": "6219097750044645017"
+                                    },
+                                    "name": "Azure Container Registry (ACR) Replications",
+                                    "description": "This module deploys an Azure Container Registry (ACR) Replication."
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the replication."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.ContainerRegistry/registries/replications@2025-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "regionEndpointEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                                      }
+                                    },
+                                    "zoneRedundancy": {
+                                      "type": "string",
+                                      "defaultValue": "Disabled",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.containerregistry-registry-repl.{0}.{1}', replace('0.1.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "replication": {
+                                      "type": "Microsoft.ContainerRegistry/registries/replications",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]",
+                                        "zoneRedundancy": "[parameters('zoneRedundancy')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the replication."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the replication."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the replication was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('replication', '2025-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_credentialSets": {
+                              "copy": {
+                                "name": "registry_credentialSets",
+                                "count": "[length(coalesce(parameters('credentialSets'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Registry-CredentialSet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].name]"
+                                  },
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "managedIdentities": {
+                                    "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].managedIdentities]"
+                                  },
+                                  "authCredentials": {
+                                    "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].authCredentials]"
+                                  },
+                                  "loginServer": {
+                                    "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].loginServer]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.42.1.51946",
+                                      "templateHash": "13412699468141336519"
+                                    },
+                                    "name": "Container Registries Credential Sets",
+                                    "description": "This module deploys an ACR Credential Set."
+                                  },
+                                  "definitions": {
+                                    "authCredentialsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the credential."
+                                          }
+                                        },
+                                        "usernameSecretIdentifier": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. KeyVault Secret URI for accessing the username."
+                                          }
+                                        },
+                                        "passwordSecretIdentifier": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. KeyVault Secret URI for accessing the password."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for auth credentials."
+                                      }
+                                    },
+                                    "managedIdentityOnlySysAssignedType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "systemAssigned": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enables system assigned managed identity on the resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the credential set."
+                                      }
+                                    },
+                                    "managedIdentities": {
+                                      "$ref": "#/definitions/managedIdentityOnlySysAssignedType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity definition for this resource."
+                                      }
+                                    },
+                                    "authCredentials": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/authCredentialsType"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential."
+                                      }
+                                    },
+                                    "loginServer": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The credentials are stored for this upstream or login server."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.containerregistry-registry-credset.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "credentialSet": {
+                                      "type": "Microsoft.ContainerRegistry/registries/credentialSets",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', null())), null())]",
+                                      "properties": {
+                                        "authCredentials": "[parameters('authCredentials')]",
+                                        "loginServer": "[parameters('loginServer')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The Name of the Credential Set."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Credential Set."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Credential Set."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/credentialSets', parameters('registryName'), parameters('name'))]"
+                                    },
+                                    "systemAssignedMIPrincipalId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The principal ID of the system assigned identity."
+                                      },
+                                      "value": "[tryGet(tryGet(reference('credentialSet', '2025-11-01', 'full'), 'identity'), 'principalId')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_cacheRules": {
+                              "copy": {
+                                "name": "registry_cacheRules",
+                                "count": "[length(coalesce(parameters('cacheRules'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "sourceRepository": {
+                                    "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "targetRepository": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]"
+                                  },
+                                  "credentialSetResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.42.1.51946",
+                                      "templateHash": "1319901650921923538"
+                                    },
+                                    "name": "Container Registry Cache",
+                                    "description": "The cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache))."
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[replace(replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-'), '*', '')]",
+                                      "metadata": {
+                                        "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined."
+                                      }
+                                    },
+                                    "sourceRepository": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Source repository pulled from upstream."
+                                      }
+                                    },
+                                    "targetRepository": {
+                                      "type": "string",
+                                      "defaultValue": "[parameters('sourceRepository')]",
+                                      "metadata": {
+                                        "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                                      }
+                                    },
+                                    "credentialSetResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the credential store which is associated with the cache rule. Required only when pulling from authenticated upstream registries (e.g., Docker Hub). Omit for anonymous public registries such as MCR (mcr.microsoft.com)."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.containerregistry-registry-cacherule.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "cacheRule": {
+                                      "type": "Microsoft.ContainerRegistry/registries/cacheRules",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "properties": {
+                                        "sourceRepository": "[parameters('sourceRepository')]",
+                                        "targetRepository": "[parameters('targetRepository')]",
+                                        "credentialSetResourceId": "[parameters('credentialSetResourceId')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The Name of the Cache Rule."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Cache Rule."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the Cache Rule."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry",
+                                "registry_credentialSets"
+                              ]
+                            },
+                            "registry_tokens": {
+                              "copy": {
+                                "name": "registry_tokens",
+                                "count": "[length(coalesce(parameters('tokens'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Registry-Token-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('tokens'), createArray())[copyIndex()].name]"
+                                  },
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "scopeMapResourceId": {
+                                    "value": "[coalesce(parameters('tokens'), createArray())[copyIndex()].scopeMapResourceId]"
+                                  },
+                                  "status": {
+                                    "value": "[tryGet(coalesce(parameters('tokens'), createArray())[copyIndex()], 'status')]"
+                                  },
+                                  "credentials": {
+                                    "value": "[tryGet(coalesce(parameters('tokens'), createArray())[copyIndex()], 'credentials')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.42.1.51946",
+                                      "templateHash": "5970335582661416899"
+                                    },
+                                    "name": "Container Registries Tokens",
+                                    "description": "Deploys an Azure Container Registry (ACR) Token."
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "minLength": 5,
+                                      "maxLength": 50,
+                                      "metadata": {
+                                        "description": "Required. The name of the token."
+                                      }
+                                    },
+                                    "scopeMapResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the scope map to which the token will be associated with."
+                                      }
+                                    },
+                                    "status": {
+                                      "type": "string",
+                                      "defaultValue": "enabled",
+                                      "allowedValues": [
+                                        "disabled",
+                                        "enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The status of the token. Default is enabled."
+                                      }
+                                    },
+                                    "credentials": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.ContainerRegistry/registries/tokens@2025-11-01#properties/properties/properties/credentials"
+                                        },
+                                        "description": "Optional. The credentials associated with the token for authentication."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.containerregistry-registry-token.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "token": {
+                                      "type": "Microsoft.ContainerRegistry/registries/tokens",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "properties": {
+                                        "scopeMapId": "[parameters('scopeMapResourceId')]",
+                                        "status": "[parameters('status')]",
+                                        "credentials": "[if(not(empty(coalesce(parameters('credentials'), createArray()))), createObject('certificates', tryGet(parameters('credentials'), 'certificates'), 'passwords', tryGet(parameters('credentials'), 'passwords')), null())]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the token."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the token was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the token."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/tokens', parameters('registryName'), parameters('name'))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry",
+                                "registry_scopeMaps"
+                              ]
+                            },
+                            "registry_tasks": {
+                              "copy": {
+                                "name": "registry_tasks",
+                                "count": "[length(coalesce(parameters('tasks'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Registry-Task-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('tasks'), createArray())[copyIndex()].name]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "platform": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'platform')]"
+                                  },
+                                  "step": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'step')]"
+                                  },
+                                  "trigger": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'trigger')]"
+                                  },
+                                  "status": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'status')]"
+                                  },
+                                  "timeout": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'timeout')]"
+                                  },
+                                  "agentConfiguration": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'agentConfiguration')]"
+                                  },
+                                  "agentPoolName": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'agentPoolName')]"
+                                  },
+                                  "credentials": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'credentials')]"
+                                  },
+                                  "isSystemTask": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'isSystemTask')]"
+                                  },
+                                  "logTemplate": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'logTemplate')]"
+                                  },
+                                  "managedIdentities": {
+                                    "value": "[tryGet(coalesce(parameters('tasks'), createArray())[copyIndex()], 'managedIdentities')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.42.1.51946",
+                                      "templateHash": "2468771835002458415"
+                                    },
+                                    "name": "Container Registries Tasks",
+                                    "description": "Deploys an Azure Container Registry (ACR) Task that can be used to automate container image builds and other workflows ([ref](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tasks-overview))."
+                                  },
+                                  "definitions": {
+                                    "managedIdentityAllType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "systemAssigned": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enables system assigned managed identity on the resource."
+                                          }
+                                        },
+                                        "userAssignedResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "minLength": 5,
+                                      "maxLength": 50,
+                                      "metadata": {
+                                        "description": "Required. The name of the task."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "platform": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/platform"
+                                        },
+                                        "description": "Optional. The platform properties against which the task has to run."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "step": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/step"
+                                        },
+                                        "description": "Optional. The task step properties. Exactly one of dockerBuildStep, encodedTaskStep, or fileTaskStep must be provided."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "trigger": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/trigger"
+                                        },
+                                        "description": "Optional. The properties that describe all triggers for the task."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "status": {
+                                      "type": "string",
+                                      "defaultValue": "Enabled",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The current status of task."
+                                      }
+                                    },
+                                    "timeout": {
+                                      "type": "int",
+                                      "defaultValue": 3600,
+                                      "minValue": 300,
+                                      "maxValue": 28800,
+                                      "metadata": {
+                                        "description": "Optional. Run timeout in seconds."
+                                      }
+                                    },
+                                    "agentConfiguration": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/agentConfiguration"
+                                        },
+                                        "description": "Optional. The machine configuration of the run agent."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "agentPoolName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The dedicated agent pool for the task."
+                                      }
+                                    },
+                                    "credentials": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.ContainerRegistry/registries/tasks@2025-03-01-preview#properties/properties/properties/credentials"
+                                        },
+                                        "description": "Optional. The properties that describe the credentials that will be used when the task is invoked."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "isSystemTask": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The value of this property indicates whether the task resource is system task or not."
+                                      }
+                                    },
+                                    "logTemplate": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The template that describes the repository and tag information for run log artifact."
+                                      }
+                                    },
+                                    "managedIdentities": {
+                                      "$ref": "#/definitions/managedIdentityAllType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity definition for this resource."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.containerregistry-registry-task.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "task": {
+                                      "type": "Microsoft.ContainerRegistry/registries/tasks",
+                                      "apiVersion": "2025-03-01-preview",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "identity": "[variables('identity')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "agentConfiguration": "[parameters('agentConfiguration')]",
+                                        "agentPoolName": "[parameters('agentPoolName')]",
+                                        "credentials": "[parameters('credentials')]",
+                                        "isSystemTask": "[parameters('isSystemTask')]",
+                                        "logTemplate": "[parameters('logTemplate')]",
+                                        "platform": "[parameters('platform')]",
+                                        "status": "[parameters('status')]",
+                                        "step": "[parameters('step')]",
+                                        "timeout": "[parameters('timeout')]",
+                                        "trigger": "[parameters('trigger')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the task."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the task was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the task."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/tasks', parameters('registryName'), parameters('name'))]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('task', '2025-03-01-preview', 'full').location]"
+                                    },
+                                    "systemAssignedMIPrincipalId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The principal ID of the system assigned identity."
+                                      },
+                                      "value": "[tryGet(tryGet(reference('task', '2025-03-01-preview', 'full'), 'identity'), 'principalId')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_webhooks": {
+                              "copy": {
+                                "name": "registry_webhooks",
+                                "count": "[length(coalesce(parameters('webhooks'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]"
+                                  },
+                                  "registryName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
+                                  },
+                                  "action": {
+                                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action')]"
+                                  },
+                                  "customHeaders": {
+                                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]"
+                                  },
+                                  "scope": {
+                                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]"
+                                  },
+                                  "status": {
+                                    "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]"
+                                  },
+                                  "serviceUri": {
+                                    "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.42.1.51946",
+                                      "templateHash": "3200175097987099858"
+                                    },
+                                    "name": "Azure Container Registry (ACR) Webhooks",
+                                    "description": "This module deploys an Azure Container Registry (ACR) Webhook."
+                                  },
+                                  "parameters": {
+                                    "registryName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "[format('{0}webhook', parameters('registryName'))]",
+                                      "minLength": 5,
+                                      "maxLength": 50,
+                                      "metadata": {
+                                        "description": "Optional. The name of the registry webhook."
+                                      }
+                                    },
+                                    "serviceUri": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "Required. The service URI for the webhook to post notifications."
+                                      }
+                                    },
+                                    "status": {
+                                      "type": "string",
+                                      "defaultValue": "enabled",
+                                      "allowedValues": [
+                                        "disabled",
+                                        "enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The status of the webhook at the time the operation was called."
+                                      }
+                                    },
+                                    "action": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "defaultValue": [
+                                        "chart_delete",
+                                        "chart_push",
+                                        "delete",
+                                        "push",
+                                        "quarantine"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The list of actions that trigger the webhook to post notifications."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.ContainerRegistry/registries/webhooks@2025-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customHeaders": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Custom headers that will be added to the webhook notifications."
+                                      }
+                                    },
+                                    "scope": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.containerregistry-registry-webhook.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "registry": {
+                                      "existing": true,
+                                      "type": "Microsoft.ContainerRegistry/registries",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[parameters('registryName')]"
+                                    },
+                                    "webhook": {
+                                      "type": "Microsoft.ContainerRegistry/registries/webhooks",
+                                      "apiVersion": "2025-11-01",
+                                      "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "actions": "[parameters('action')]",
+                                        "customHeaders": "[parameters('customHeaders')]",
+                                        "scope": "[parameters('scope')]",
+                                        "serviceUri": "[parameters('serviceUri')]",
+                                        "status": "[parameters('status')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the webhook."
+                                      },
+                                      "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the webhook."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the Azure container registry."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "actions": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "description": "The actions of the webhook."
+                                      },
+                                      "value": "[reference('webhook').actions]"
+                                    },
+                                    "status": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The status of the webhook."
+                                      },
+                                      "value": "[reference('webhook').status]"
+                                    },
+                                    "provistioningState": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The provisioning state of the webhook."
+                                      },
+                                      "value": "[reference('webhook').provisioningState]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('webhook', '2025-11-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry"
+                              ]
+                            },
+                            "registry_privateEndpoints": {
+                              "copy": {
+                                "name": "registry_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "18436885663402767850"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipVersionType": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                        },
+                                        "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                                      },
+                                      "defaultValue": "IPv4"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        },
+                                        "ipVersionType": "[parameters('ipVersionType')]"
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "9935179114830442414"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "registry",
+                                "registry_replications"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The Name of the Azure container registry."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "loginServer": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The reference to the Azure container registry."
+                              },
+                              "value": "[reference('registry').loginServer]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Azure container registry."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Azure container registry."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('registry', '2025-06-01-preview', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('registry', '2025-06-01-preview', 'full').location]"
+                            },
+                            "credentialSetsSystemAssignedMIPrincipalIds": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "The Principal IDs of the ACR Credential Sets system-assigned identities."
+                              },
+                              "copy": {
+                                "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]",
+                                "input": "[tryGet(tryGet(reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+                              }
+                            },
+                            "credentialSetsResourceIds": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "The Resource IDs of the ACR Credential Sets."
+                              },
+                              "copy": {
+                                "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]",
+                                "input": "[reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs.resourceId.value]"
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the Azure container registry."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the container registry."
+                      },
+                      "value": "[reference('containerRegistry').outputs.name.value]"
+                    },
+                    "loginServer": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The login server URL."
+                      },
+                      "value": "[reference('containerRegistry').outputs.loginServer.value]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the container registry."
+                      },
+                      "value": "[reference('containerRegistry').outputs.resourceId.value]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').containerRegistry)]",
+                "virtualNetwork"
+              ]
+            },
+            "backend_docker": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[format('api-{0}', variables('solutionSuffix'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[union(parameters('tags'), createObject('azd-service-name', 'api'))]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "serverFarmResourceId": {
+                    "value": "[reference('hostingplan').outputs.resourceId.value]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "linuxFxVersion": {
+                    "value": "[variables('placeholderImageName')]"
+                  },
+                  "virtualNetworkSubnetId": "[if(parameters('enablePrivateNetworking'), createObject('value', reference('virtualNetwork').outputs.webserverfarmSubnetResourceId.value), createObject('value', ''))]",
+                  "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                  "vnetRouteAllEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+                  "imagePullTraffic": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+                  "contentShareTraffic": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+                  "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-api-{0}', variables('solutionSuffix')), 'customNetworkInterfaceName', format('nic-api-{0}', variables('solutionSuffix')), 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value, 'service', 'sites', 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').webApp)).outputs.resourceId.value)))))), createObject('value', createArray()))]",
+                  "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+                  "managedIdentities": {
+                    "value": {
+                      "systemAssigned": true
+                    }
+                  },
+                  "acrUseManagedIdentityCreds": {
+                    "value": true
+                  },
+                  "appSettings": {
+                    "value": {
+                      "WEBSITES_PORT": "8000",
+                      "AZURE_OPENAI_ENDPOINT": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.endpoint.value, reference('ai_foundry_project').outputs.endpoint.value)]",
+                      "AZURE_OPENAI_CHAT_DEPLOYMENT": "[parameters('gptModelName')]",
+                      "AZURE_OPENAI_EMBEDDING_DEPLOYMENT": "[parameters('embeddingModel')]",
+                      "AZURE_SEARCH_ENDPOINT": "[reference('ai_search').outputs.endpoint.value]",
+                      "AZURE_SEARCH_INDEX_NAME": "knowledge-mining-index",
+                      "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.azureOpenAiCuEndpoint.value, reference('ai_foundry_project').outputs.azureOpenAiCuEndpoint.value)]",
+                      "AZURE_STORAGE_ACCOUNT": "[reference('storage_account').outputs.name.value]",
+                      "AZURE_SQL_SERVER": "[reference('sqlDBModule').outputs.serverFqdn.value]",
+                      "AZURE_SQL_DATABASE": "[reference('sqlDBModule').outputs.databaseName.value]",
+                      "AZURE_COSMOS_ENDPOINT": "[if(parameters('deployCosmos'), reference('cosmosDBModule').outputs.endpoint.value, '')]",
+                      "AZURE_COSMOS_DATABASE": "[if(parameters('deployCosmos'), 'km-db', '')]",
+                      "AZURE_AD_TENANT_ID": "[parameters('azureAdTenantId')]",
+                      "AZURE_AD_CLIENT_ID": "[parameters('azureAdClientId')]",
+                      "AZURE_AI_AGENT_ENDPOINT": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.projectEndpoint.value, reference('ai_foundry_project').outputs.projectEndpoint.value)]",
+                      "AZURE_AI_SEARCH_CONNECTION_NAME": "[reference('foundry_search_connection').outputs.connectionName.value]",
+                      "API_APP_NAME": "[format('api-{0}', variables('solutionSuffix'))]",
+                      "APP_FRONTEND_HOSTNAME": "[format('https://app-{0}.azurewebsites.net', variables('solutionSuffix'))]",
+                      "APP_ENV": "Prod",
+                      "ADMIN_API_KEY": "[parameters('adminApiKey')]",
+                      "SOLUTION_SUFFIX": "[variables('solutionSuffix')]",
+                      "APPLICATIONINSIGHTS_CONNECTION_STRING": "[if(parameters('enableMonitoring'), reference('app_insights').outputs.connectionString.value, '')]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "7275312158093319855"
+                    }
+                  },
+                  "definitions": {
+                    "_1.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_1.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[parameters('solutionName')]",
+                      "metadata": {
+                        "description": "Name of the App Service."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "serverFarmResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the App Service Plan."
+                      }
+                    },
+                    "linuxFxVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag)."
+                      }
+                    },
+                    "appSettings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Application settings key-value pairs."
+                      }
+                    },
+                    "applicationInsightResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Resource ID of Application Insights for monitoring integration."
+                      }
+                    },
+                    "alwaysOn": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Whether to enable Always On."
+                      }
+                    },
+                    "healthCheckPath": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Health check path for the app."
+                      }
+                    },
+                    "webSocketsEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to enable WebSockets."
+                      }
+                    },
+                    "appCommandLine": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Command line for the application."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "app,linux",
+                      "allowedValues": [
+                        "functionapp",
+                        "functionapp,linux",
+                        "functionapp,workflowapp",
+                        "functionapp,workflowapp,linux",
+                        "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
+                        "app,linux",
+                        "app",
+                        "linux,api",
+                        "api",
+                        "app,linux,container",
+                        "app,container,windows"
+                      ],
+                      "metadata": {
+                        "description": "Required. Type of site to deploy."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Diagnostic settings for monitoring."
+                      }
+                    },
+                    "virtualNetworkSubnetId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Subnet resource ID for VNet integration."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    },
+                    "acrUseManagedIdentityCreds": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether the app pulls its container image from ACR using its managed identity."
+                      }
+                    },
+                    "acrUserManagedIdentityID": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Client ID of the user-assigned identity used for ACR image pulls (empty = system-assigned)."
+                      }
+                    },
+                    "vnetRouteAllEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to route all outbound traffic through the virtual network."
+                      }
+                    },
+                    "imagePullTraffic": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to route image pull traffic through the virtual network."
+                      }
+                    },
+                    "contentShareTraffic": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to route content share traffic through the virtual network."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
+                      }
+                    }
+                  },
+                  "resources": {
+                    "site": {
+                      "existing": true,
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2025-03-01",
+                      "name": "[parameters('name')]"
+                    },
+                    "logsConfig": {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2025-03-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+                      "properties": {
+                        "applicationLogs": {
+                          "fileSystem": {
+                            "level": "Verbose"
+                          }
+                        },
+                        "detailedErrorMessages": {
+                          "enabled": true
+                        },
+                        "failedRequestsTracing": {
+                          "enabled": true
+                        },
+                        "httpLogs": {
+                          "fileSystem": {
+                            "enabled": true,
+                            "retentionInDays": 1,
+                            "retentionInMb": 35
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "appService"
+                      ]
+                    },
+                    "appService": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('avm.res.web.site.{0}', parameters('name')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "kind": {
+                            "value": "[parameters('kind')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "serverFarmResourceId": {
+                            "value": "[parameters('serverFarmResourceId')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
+                          },
+                          "siteConfig": {
+                            "value": {
+                              "alwaysOn": "[parameters('alwaysOn')]",
+                              "ftpsState": "Disabled",
+                              "linuxFxVersion": "[parameters('linuxFxVersion')]",
+                              "minTlsVersion": "1.2",
+                              "healthCheckPath": "[if(not(empty(parameters('healthCheckPath'))), parameters('healthCheckPath'), null())]",
+                              "webSocketsEnabled": "[parameters('webSocketsEnabled')]",
+                              "appCommandLine": "[parameters('appCommandLine')]",
+                              "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]",
+                              "acrUseManagedIdentityCreds": "[parameters('acrUseManagedIdentityCreds')]",
+                              "acrUserManagedIdentityID": "[if(not(empty(parameters('acrUserManagedIdentityID'))), parameters('acrUserManagedIdentityID'), null())]"
+                            }
+                          },
+                          "e2eEncryptionEnabled": {
+                            "value": true
+                          },
+                          "configs": {
+                            "value": [
+                              {
+                                "name": "appsettings",
+                                "properties": "[parameters('appSettings')]",
+                                "applicationInsightResourceId": "[if(not(empty(parameters('applicationInsightResourceId'))), parameters('applicationInsightResourceId'), null())]"
+                              }
+                            ]
+                          },
+                          "outboundVnetRouting": {
+                            "value": {
+                              "contentShareTraffic": "[parameters('contentShareTraffic')]",
+                              "imagePullTraffic": "[parameters('imagePullTraffic')]"
+                            }
+                          },
+                          "publicNetworkAccess": {
+                            "value": "[parameters('publicNetworkAccess')]"
+                          },
+                          "privateEndpoints": {
+                            "value": "[parameters('privateEndpoints')]"
+                          },
+                          "virtualNetworkSubnetResourceId": "[if(not(empty(parameters('virtualNetworkSubnetId'))), createObject('value', parameters('virtualNetworkSubnetId')), createObject('value', null()))]",
+                          "basicPublishingCredentialsPolicies": {
+                            "value": [
+                              {
+                                "name": "ftp",
+                                "allow": false
+                              },
+                              {
+                                "name": "scm",
+                                "allow": false
+                              }
+                            ]
+                          },
+                          "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]"
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.43.8.12551",
+                              "templateHash": "15230222474470713470"
+                            },
+                            "name": "Web/Function Apps",
+                            "description": "This module deploys a Web or Function App."
+                          },
+                          "definitions": {
+                            "privateEndpointOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The group Id for the private endpoint Group."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "FQDN that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses of the private endpoint."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "configType": {
+                              "type": "object",
+                              "discriminator": {
+                                "propertyName": "name",
+                                "mapping": {
+                                  "appsettings": {
+                                    "$ref": "#/definitions/appSettingsConfigType"
+                                  },
+                                  "authsettings": {
+                                    "$ref": "#/definitions/authSettingsConfigType"
+                                  },
+                                  "authsettingsV2": {
+                                    "$ref": "#/definitions/authSettingsV2ConfigType"
+                                  },
+                                  "azurestorageaccounts": {
+                                    "$ref": "#/definitions/azureStorageAccountConfigType"
+                                  },
+                                  "backup": {
+                                    "$ref": "#/definitions/backupConfigType"
+                                  },
+                                  "connectionstrings": {
+                                    "$ref": "#/definitions/connectionStringsConfigType"
+                                  },
+                                  "logs": {
+                                    "$ref": "#/definitions/logsConfigType"
+                                  },
+                                  "metadata": {
+                                    "$ref": "#/definitions/metadataConfigType"
+                                  },
+                                  "pushsettings": {
+                                    "$ref": "#/definitions/pushSettingsConfigType"
+                                  },
+                                  "slotConfigNames": {
+                                    "$ref": "#/definitions/slotConfigNamesConfigType"
+                                  },
+                                  "web": {
+                                    "$ref": "#/definitions/webConfigType"
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a site configuration."
+                              }
+                            },
+                            "slotConfigNamesConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "slotConfigNames"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "appSettingNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of application settings names."
+                                      }
+                                    },
+                                    "azureStorageConfigNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of external Azure storage account identifiers."
+                                      }
+                                    },
+                                    "connectionStringNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of connection string names."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a slotConfigNames configuration."
+                              }
+                            },
+                            "slotType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the slot."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location for all Resources."
+                                  }
+                                },
+                                "serverFarmResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the app service plan to use for the slot."
+                                  }
+                                },
+                                "managedEnvironmentResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                                  }
+                                },
+                                "httpsOnly": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
+                                  }
+                                },
+                                "clientAffinityEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If client affinity is enabled."
+                                  }
+                                },
+                                "clientAffinityProxyEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance."
+                                  }
+                                },
+                                "clientAffinityPartitioningEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. To enable client affinity partitioning using CHIPS cookies."
+                                  }
+                                },
+                                "appServiceEnvironmentResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the app service environment to use for this resource."
+                                  }
+                                },
+                                "managedIdentities": {
+                                  "$ref": "#/definitions/managedIdentityAllType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The managed identity definition for this resource."
+                                  }
+                                },
+                                "keyVaultAccessIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                                  }
+                                },
+                                "storageAccountRequired": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Checks if Customer provided storage account is required."
+                                  }
+                                },
+                                "virtualNetworkSubnetResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                                  }
+                                },
+                                "siteConfig": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/siteConfig"
+                                    },
+                                    "description": "Optional. The site config object."
+                                  },
+                                  "nullable": true
+                                },
+                                "functionAppConfig": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/functionAppConfig"
+                                    },
+                                    "description": "Optional. The Function App config object."
+                                  },
+                                  "nullable": true
+                                },
+                                "configs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/configType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The web site config."
+                                  }
+                                },
+                                "extensions": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "metadata": {
+                                      "__bicep_resource_derived_type!": {
+                                        "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The extensions configuration."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The lock settings of the service."
+                                  }
+                                },
+                                "privateEndpoints": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateEndpointSingleServiceType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Configuration details for private endpoints."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the service."
+                                  }
+                                },
+                                "clientCertEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                                  }
+                                },
+                                "clientCertExclusionPaths": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                                  }
+                                },
+                                "clientCertMode": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/clientCertMode"
+                                    },
+                                    "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
+                                  },
+                                  "nullable": true
+                                },
+                                "cloningInfo": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/cloningInfo"
+                                    },
+                                    "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                                  },
+                                  "nullable": true
+                                },
+                                "containerSize": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Size of the function container."
+                                  }
+                                },
+                                "customDomainVerificationId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                                  }
+                                },
+                                "dailyMemoryTimeQuota": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                                  }
+                                },
+                                "hostNameSslStates": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/hostNameSslStates"
+                                    },
+                                    "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                                  },
+                                  "nullable": true
+                                },
+                                "hyperV": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hyper-V sandbox."
+                                  }
+                                },
+                                "publicNetworkAccess": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                                    },
+                                    "description": "Optional. Allow or block all public traffic."
+                                  },
+                                  "nullable": true
+                                },
+                                "redundancyMode": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/redundancyMode"
+                                    },
+                                    "description": "Optional. Site redundancy mode."
+                                  },
+                                  "nullable": true
+                                },
+                                "basicPublishingCredentialsPolicies": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The site publishing credential policy names which are associated with the site slot."
+                                  }
+                                },
+                                "outboundVnetRouting": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                                    },
+                                    "description": "Optional. The outbound VNET routing configuration for the slot."
+                                  },
+                                  "nullable": true
+                                },
+                                "hybridConnectionRelays": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/hybridConnectionRelayType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Names of hybrid connection relays to connect app with."
+                                  }
+                                },
+                                "hostNameBindings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/hostNameBindingType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Host Name Bindings for the slot."
+                                  }
+                                },
+                                "dnsConfiguration": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/dnsConfiguration"
+                                    },
+                                    "description": "Optional. Property to configure various DNS related settings for a site."
+                                  },
+                                  "nullable": true
+                                },
+                                "autoGeneratedDomainNameLabelScope": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                                    },
+                                    "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                                  },
+                                  "nullable": true
+                                },
+                                "sshEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Whether to enable SSH access."
+                                  }
+                                },
+                                "daprConfig": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/daprConfig"
+                                    },
+                                    "description": "Optional. Dapr configuration of the app."
+                                  },
+                                  "nullable": true
+                                },
+                                "ipMode": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/ipMode"
+                                    },
+                                    "description": "Optional. Specifies the IP mode of the app."
+                                  },
+                                  "nullable": true
+                                },
+                                "resourceConfig": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/resourceConfig"
+                                    },
+                                    "description": "Optional. Function app resource requirements."
+                                  },
+                                  "nullable": true
+                                },
+                                "workloadProfileName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Workload profile name for function app to execute on."
+                                  }
+                                },
+                                "hostNamesDisabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                                  }
+                                },
+                                "reserved": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                                  }
+                                },
+                                "scmSiteAlsoStopped": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                                  }
+                                },
+                                "e2eEncryptionEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. End to End Encryption Setting."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a slot."
+                              }
+                            },
+                            "extensionType": {
+                              "type": "object",
+                              "properties": {
+                                "properties": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                                    },
+                                    "description": "Optional. Sets the properties."
+                                  },
+                                  "nullable": true
+                                }
+                              }
+                            },
+                            "basicPublishingCredentialsPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "ftp",
+                                    "scm"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The name of the resource."
+                                  }
+                                },
+                                "allow": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location for all Resources."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a basic publishing credential policy."
+                              }
+                            },
+                            "hybridConnectionRelayType": {
+                              "type": "object",
+                              "properties": {
+                                "hybridConnectionResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                  }
+                                },
+                                "sendKeyName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the authorization rule send key to use."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a hybrid connection relay."
+                              }
+                            },
+                            "_1.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_2.certificateType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Certificate name."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource location."
+                                  }
+                                },
+                                "hostNames": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate host names."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault resource ID."
+                                  }
+                                },
+                                "keyVaultSecretName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault secret name."
+                                  }
+                                },
+                                "serverFarmResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Server farm resource ID."
+                                  }
+                                },
+                                "canonicalName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                  }
+                                },
+                                "password": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate password."
+                                  }
+                                },
+                                "pfxBlob": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate data in PFX format."
+                                  }
+                                },
+                                "domainValidationMethod": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Method of domain validation for free certificate."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a certificate.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "modules/certificate.bicep"
+                                }
+                              }
+                            },
+                            "_3.scmIpSecurityRestrictionType": {
+                              "type": "object",
+                              "properties": {
+                                "action": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Allow",
+                                    "Deny"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Allow or Deny access for this IP range."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule description."
+                                  }
+                                },
+                                "headers": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "metadata": {
+                                      "description": "Required. A header."
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule headers.\nX-Forwarded-Host (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), all hosts(or lack of) are allowed.\n- A value is compared using ordinal-ignore-case (excluding port number).\n- Subdomain wildcards are permitted but don't match the root domain. For example, *.contoso.com matches the subdomain foo.contoso.com\nbut not the root domain contoso.com or multi-level foo.bar.contoso.com\n- Unicode host names are allowed but are converted to Punycode for matching.\n\nX-Forwarded-For (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), any forwarded-for chains (or lack of) are allowed.\n- If any address (excluding port number) in the chain (comma separated) matches the CIDR defined by the property.\n\nX-Azure-FDID and X-FD-HealthProbe.\nThe matching logic is exact match."
+                                  }
+                                },
+                                "ipAddress": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP address the security restriction is valid for. It can be in form of pure ipv4 address (required SubnetMask property) or CIDR notation such as ipv4/mask (leading bit match). For CIDR, SubnetMask property must not be specified."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule name."
+                                  }
+                                },
+                                "priority": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Priority of IP restriction rule."
+                                  }
+                                },
+                                "subnetMask": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Subnet mask for the range of IP addresses the restriction is valid for."
+                                  }
+                                },
+                                "subnetTrafficTag": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. (internal) Subnet traffic tag."
+                                  }
+                                },
+                                "tag": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Default",
+                                    "ServiceTag",
+                                    "XffProxy"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Defines what this IP filter will be used for. This is to support IP filtering on proxies."
+                                  }
+                                },
+                                "vnetSubnetResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Virtual network resource id."
+                                  }
+                                },
+                                "vnetTrafficTag": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. (internal) Vnet traffic tag."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a IP security restriction.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "_3.slowRequestBasedTriggerType": {
+                              "type": "object",
+                              "properties": {
+                                "count": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Count."
+                                  }
+                                },
+                                "path": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Path."
+                                  }
+                                },
+                                "timeInterval": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time interval."
+                                  }
+                                },
+                                "timeTaken": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time taken."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of aslow request based trigger.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "appSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "appsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "storageAccountUseIdentityAuthentication": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                  }
+                                },
+                                "applicationInsightResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                  }
+                                },
+                                "retainCurrentAppSettings": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The retain the current app settings. Defaults to true."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. An app settings key-value pair."
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of an app settings configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "authSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "authsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "aadClaimsAuthorization": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a JSON string containing the Azure AD Acl settings."
+                                      }
+                                    },
+                                    "additionalLoginParams": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                      }
+                                    },
+                                    "allowedAudiences": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting."
+                                      }
+                                    },
+                                    "allowedExternalRedirectUrls": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                      }
+                                    },
+                                    "authFilePath": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The path of the config file containing auth settings. If the path is relative, base will the site's root directory."
+                                      }
+                                    },
+                                    "clientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                      }
+                                    },
+                                    "clientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                      }
+                                    },
+                                    "clientSecretCertificateThumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                      }
+                                    },
+                                    "clientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                      }
+                                    },
+                                    "configVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization."
+                                      }
+                                    },
+                                    "defaultProvider": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AzureActiveDirectory",
+                                        "Facebook",
+                                        "Github",
+                                        "Google",
+                                        "MicrosoftAccount",
+                                        "Twitter"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                      }
+                                    },
+                                    "facebookAppId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "facebookAppSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "facebookAppSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the app secret used for Facebook Login."
+                                      }
+                                    },
+                                    "facebookOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "gitHubClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Id of the GitHub app used for login. This setting is required for enabling Github login."
+                                      }
+                                    },
+                                    "gitHubClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login."
+                                      }
+                                    },
+                                    "gitHubClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret of the Github app used for GitHub Login."
+                                      }
+                                    },
+                                    "gitHubOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication."
+                                      }
+                                    },
+                                    "googleClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "googleClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "googleClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret associated with the Google web application."
+                                      }
+                                    },
+                                    "googleOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, \"openid\", \"profile\", and \"email\" are used as default scopes. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "isAuthFromFile": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "false",
+                                        "true"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. \"true\" if the auth config settings should be read from a file, \"false\" otherwise."
+                                      }
+                                    },
+                                    "issuer": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                      }
+                                    },
+                                    "microsoftAccountClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                      }
+                                    },
+                                    "microsoftAccountClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                      }
+                                    },
+                                    "microsoftAccountClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication."
+                                      }
+                                    },
+                                    "microsoftAccountOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, \"wl.basic\" is used as the default scope. Microsoft Account Scopes and permissions [documentation](https://msdn.microsoft.com/en-us/library/dn631845.aspx)."
+                                      }
+                                    },
+                                    "runtimeVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                      }
+                                    },
+                                    "tokenRefreshExtensionHours": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                      }
+                                    },
+                                    "tokenStoreEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows. The default is `false`."
+                                      }
+                                    },
+                                    "twitterConsumerKey": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                      }
+                                    },
+                                    "twitterConsumerSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                      }
+                                    },
+                                    "twitterConsumerSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                      }
+                                    },
+                                    "unauthenticatedClientAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AllowAnonymous",
+                                        "RedirectToLoginPage"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                      }
+                                    },
+                                    "validateIssuer": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of an auth settings configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "authSettingsV2ConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "authsettingsV2"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "globalValidation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "excludedPaths": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The paths for which unauthenticated flow would not be redirected to the login page."
+                                          }
+                                        },
+                                        "redirectToProvider": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                          }
+                                        },
+                                        "requireAuthentication": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the authentication flow is required by every request."
+                                          }
+                                        },
+                                        "unauthenticatedClientAction": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AllowAnonymous",
+                                            "RedirectToLoginPage",
+                                            "Return401",
+                                            "Return403"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings that determines the validation flow of users using App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "httpSettings": {
+                                      "type": "object",
+                                      "properties": {
+                                        "forwardProxy": {
+                                          "type": "object",
+                                          "properties": {
+                                            "convention": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Custom",
+                                                "NoProxy",
+                                                "Standard"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The convention used to determine the url of the request made."
+                                              }
+                                            },
+                                            "customHostHeaderName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The name of the header containing the host of the request."
+                                              }
+                                            },
+                                            "customProtoHeaderName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The name of the header containing the scheme of the request."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of a forward proxy used to make the requests."
+                                          }
+                                        },
+                                        "requireHttps": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `false` if the authentication/authorization responses not having the HTTPS scheme are permissible."
+                                          }
+                                        },
+                                        "routes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "apiPrefix": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The prefix that should precede all the authentication/authorization paths."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the paths HTTP requests."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "identityProviders": {
+                                      "type": "object",
+                                      "properties": {
+                                        "apple": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Apple provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Apple registration."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Apple provider."
+                                          }
+                                        },
+                                        "azureActiveDirectory": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "isAutoProvisioned": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "disableWWWAuthenticate": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the www-authenticate provider should be omitted from the request."
+                                                  }
+                                                },
+                                                "loginParameters": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                                  }
+                                                },
+                                                "clientSecretCertificateIssuer": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                  }
+                                                },
+                                                "clientSecretCertificateSubjectAlternativeName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                  }
+                                                },
+                                                "clientSecretCertificateThumbprint": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                                  }
+                                                },
+                                                "openIdIssuer": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory app registration."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The list of audiences that can make successful authentication/authorization requests."
+                                                  }
+                                                },
+                                                "defaultAuthorizationPolicy": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "allowedApplications": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory allowed applications."
+                                                      }
+                                                    },
+                                                    "allowedPrincipals": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "groups": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of the allowed groups."
+                                                          }
+                                                        },
+                                                        "identities": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of the allowed identities."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory allowed principals."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the default authorization policy."
+                                                  }
+                                                },
+                                                "jwtClaimChecks": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "allowedClientApplications": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The list of the allowed client applications."
+                                                      }
+                                                    },
+                                                    "allowedGroups": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The list of the allowed groups."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the checks that should be made while validating the JWT Claims."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Azure Active directory provider."
+                                          }
+                                        },
+                                        "azureStaticWebApps": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Azure Static Web Apps provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Static Web Apps registration."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Azure Static Web Apps provider."
+                                          }
+                                        },
+                                        "customOpenIdConnectProviders": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Set to `false` if the custom Open ID provider provider should not be enabled."
+                                                }
+                                              },
+                                              "login": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "nameClaimType": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of the claim that contains the users name."
+                                                    }
+                                                  },
+                                                  "scopes": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "string"
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The configuration settings of the login flow of the custom Open ID Connect provider."
+                                                }
+                                              },
+                                              "registration": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "clientCredential": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "clientSecretSettingName": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. The app setting that contains the client secret for the custom Open ID Connect provider."
+                                                        }
+                                                      },
+                                                      "method": {
+                                                        "type": "string",
+                                                        "allowedValues": [
+                                                          "ClientSecretPost"
+                                                        ],
+                                                        "metadata": {
+                                                          "description": "Required. The method that should be used to authenticate the user."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The authentication credentials of the custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "clientId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The client id of the custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "openIdConnectConfiguration": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "authorizationEndpoint": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint to be used to make an authorization request."
+                                                        }
+                                                      },
+                                                      "certificationUri": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that provides the keys necessary to validate the token."
+                                                        }
+                                                      },
+                                                      "issuer": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that issues the token."
+                                                        }
+                                                      },
+                                                      "tokenEndpoint": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint to be used to request a token."
+                                                        }
+                                                      },
+                                                      "wellKnownOpenIdConfiguration": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that contains all the configuration endpoints for the provider."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The configuration settings of the endpoints used for the custom Open ID Connect provider."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The configuration settings of the app registration for the custom Open ID Connect provider."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The alias of each custom Open ID Connect provider."
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider."
+                                          }
+                                        },
+                                        "facebook": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Facebook provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "graphApiVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The version of the Facebook api to be used while logging in."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "appId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The App ID of the app used for login."
+                                                  }
+                                                },
+                                                "appSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the app secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Facebook provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Facebook provider."
+                                          }
+                                        },
+                                        "gitHub": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the GitHub provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the GitHub provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the GitHub provider."
+                                          }
+                                        },
+                                        "google": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Google provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Google provider."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Google provider."
+                                          }
+                                        },
+                                        "legacyMicrosoftAccount": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the legacy Microsoft Account provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the legacy Microsoft Account provider."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the legacy Microsoft Account provider token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the legacy Microsoft Account provider."
+                                          }
+                                        },
+                                        "twitter": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Twitter provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "consumerKey": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                                  }
+                                                },
+                                                "consumerSecretSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Twitter provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Twitter provider."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of each of the identity providers used to configure App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedExternalRedirectUrls": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                          }
+                                        },
+                                        "cookieExpiration": {
+                                          "type": "object",
+                                          "properties": {
+                                            "convention": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "FixedTime",
+                                                "IdentityProviderDerived"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The convention used when determining the session cookie's expiration."
+                                              }
+                                            },
+                                            "timeToExpiration": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The time after the request is made when the session cookie should expire."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the session cookie's expiration."
+                                          }
+                                        },
+                                        "nonce": {
+                                          "type": "object",
+                                          "properties": {
+                                            "nonceExpirationInterval": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The time after the request is made when the nonce should expire."
+                                              }
+                                            },
+                                            "validateNonce": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the nonce should not be validated while completing the login flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the nonce used in the login flow."
+                                          }
+                                        },
+                                        "preserveUrlFragmentsForLogins": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the fragments from the request are preserved after the login request is made."
+                                          }
+                                        },
+                                        "routes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "logoutEndpoint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The endpoint at which a logout request should be made."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The routes that specify the endpoints used for login and logout requests."
+                                          }
+                                        },
+                                        "tokenStore": {
+                                          "type": "object",
+                                          "properties": {
+                                            "azureBlobStorage": {
+                                              "type": "object",
+                                              "properties": {
+                                                "sasUrlSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the app setting containing the SAS URL of the blob storage containing the tokens."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the storage of the tokens if blob storage is used."
+                                              }
+                                            },
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows."
+                                              }
+                                            },
+                                            "fileSystem": {
+                                              "type": "object",
+                                              "properties": {
+                                                "directory": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The directory in which the tokens will be stored."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the storage of the tokens if a file system is used."
+                                              }
+                                            },
+                                            "tokenRefreshExtensionHours": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the token store."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow of users using App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "platform": {
+                                      "type": "object",
+                                      "properties": {
+                                        "configFilePath": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The path of the config file containing auth settings if they come from a file. If the path is relative, base will the site's root directory."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                          }
+                                        },
+                                        "runtimeVersion": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the platform of App Service Authentication/Authorization."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of an authSettingsV2 configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "azureStorageAccountConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "azurestorageaccounts"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "accessKey": {
+                                        "type": "securestring",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Access key for the storage account."
+                                        }
+                                      },
+                                      "accountName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the storage account."
+                                        }
+                                      },
+                                      "mountPath": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                        }
+                                      },
+                                      "protocol": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "Http",
+                                          "Nfs",
+                                          "Smb"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Mounting protocol to use for the storage account."
+                                        }
+                                      },
+                                      "shareName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                        }
+                                      },
+                                      "type": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "AzureBlob",
+                                          "AzureFiles"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Type of storage."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Azure Storage Info configuration."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of an Azure Storage Account configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "backupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "backup"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "backupName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name of the backup."
+                                      }
+                                    },
+                                    "backupSchedule": {
+                                      "type": "object",
+                                      "properties": {
+                                        "frequencyInterval": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. How often the backup should be executed (e.g. for weekly backup, this should be set to 7 and FrequencyUnit should be set to Day)."
+                                          }
+                                        },
+                                        "frequencyUnit": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Day",
+                                            "Hour"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The unit of time for how often the backup should be executed (e.g. for weekly backup, this should be set to Day and FrequencyInterval should be set to 7)."
+                                          }
+                                        },
+                                        "keepAtLeastOneBackup": {
+                                          "type": "bool",
+                                          "metadata": {
+                                            "description": "Required. Set to `True` if the retention policy should always keep at least one backup in the storage account, regardless how old it is."
+                                          }
+                                        },
+                                        "retentionPeriodInDays": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. After how many days backups should be deleted."
+                                          }
+                                        },
+                                        "startTime": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. When the schedule should start working."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Schedule for the backup if it is executed periodically."
+                                      }
+                                    },
+                                    "databases": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "connectionString": {
+                                            "type": "securestring",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Contains a connection string to a database which is being backed up or restored. If the restore should happen to a new database, the database name inside is the new one."
+                                            }
+                                          },
+                                          "connectionStringName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Contains a connection string name that is linked to the SiteConfig.ConnectionStrings. This is used during restore with overwrite connection strings options."
+                                            }
+                                          },
+                                          "databaseType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "LocalMySql",
+                                              "MySql",
+                                              "PostgreSql",
+                                              "SqlAzure"
+                                            ],
+                                            "metadata": {
+                                              "description": "Required. Database type (e.g. SqlAzure / MySql)."
+                                            }
+                                          },
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of the setting."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Databases included in the backup."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `True` if the backup schedule is enabled (must be included in that case), `false` if the backup schedule should be disabled."
+                                      }
+                                    },
+                                    "storageAccountUrl": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SAS URL to the container."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a backup configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "connectionStringsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "connectionstrings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "type": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "ApiHub",
+                                          "Custom",
+                                          "DocDb",
+                                          "EventHub",
+                                          "MySql",
+                                          "NotificationHub",
+                                          "PostgreSQL",
+                                          "RedisCache",
+                                          "SQLAzure",
+                                          "SQLServer",
+                                          "ServiceBus"
+                                        ],
+                                        "metadata": {
+                                          "description": "Required. Type of database."
+                                        }
+                                      },
+                                      "value": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Value of pair."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the connection string setting."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a connection string configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "hostNameBindingsOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the host name binding."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the host name binding."
+                                  }
+                                },
+                                "resourceGroupName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the resource group the resource was deployed into."
+                                  }
+                                },
+                                "certificateThumbprint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The thumbprint of the certificate."
+                                  }
+                                },
+                                "certificateResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The resource ID of the certificate."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "hostNameBindingType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hostname in the hostname binding. Defaults to the host name of the app/slot if not specified."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "azureResourceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure resource name."
+                                  }
+                                },
+                                "azureResourceType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "TrafficManager",
+                                    "Website"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                  }
+                                },
+                                "customHostNameDnsRecordType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "A",
+                                    "CName"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                  }
+                                },
+                                "domainResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Fully qualified ARM domain resource URI."
+                                  }
+                                },
+                                "hostNameType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Managed",
+                                    "Verified"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                  }
+                                },
+                                "siteName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. App Service app name."
+                                  }
+                                },
+                                "sslState": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "IpBasedEnabled",
+                                    "SniEnabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                  }
+                                },
+                                "thumbprint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. SSL certificate thumbprint."
+                                  }
+                                },
+                                "certificate": {
+                                  "$ref": "#/definitions/_2.certificateType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate creation properties. If specified, a certificate will be created and used for this hostname binding."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a host name binding.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "logsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "logs"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "applicationLogs": {
+                                      "type": "object",
+                                      "properties": {
+                                        "azureBlobStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to blob storage configuration."
+                                          }
+                                        },
+                                        "azureTableStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. SAS URL to an Azure table with add/query/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to azure table storage configuration."
+                                          }
+                                        },
+                                        "fileSystem": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to file system configuration."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application Logs for Azure configuration."
+                                      }
+                                    },
+                                    "detailedErrorMessages": {
+                                      "type": "object",
+                                      "properties": {
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Detailed error messages configuration."
+                                      }
+                                    },
+                                    "failedRequestsTracing": {
+                                      "type": "object",
+                                      "properties": {
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Failed requests tracing configuration."
+                                      }
+                                    },
+                                    "httpLogs": {
+                                      "type": "object",
+                                      "properties": {
+                                        "azureBlobStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Http logs to azure blob storage configuration."
+                                          }
+                                        },
+                                        "fileSystem": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove files older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "retentionInMb": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 25,
+                                              "maxValue": 100,
+                                              "metadata": {
+                                                "description": "Optional. Maximum size in megabytes that http log files can use. When reached old log files will be removed to make space for new ones."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Http logs to file system configuration."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. HTTP logs configuration."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a logs configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "metadataConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "metadata"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata key value pair."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a metadata configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "privateEndpointSingleServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private Endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the Private Endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "pushSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "pushsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "dynamicTagsJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                      }
+                                    },
+                                    "isPushEnabled": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                      }
+                                    },
+                                    "tagsRequiringAuth": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                      }
+                                    },
+                                    "tagWhitelistJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a pushSettings configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "webConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "web"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "acrUseManagedIdentityCreds": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Flag to use Managed Identity Creds for ACR pull."
+                                      }
+                                    },
+                                    "acrUserManagedIdentityID": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. If using user managed identity, the user managed identity ClientId."
+                                      }
+                                    },
+                                    "alwaysOn": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if 'Always On' is enabled."
+                                      }
+                                    },
+                                    "apiDefinition": {
+                                      "type": "object",
+                                      "properties": {
+                                        "url": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The URL of the API definition."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Information about the formal API definition for the app."
+                                      }
+                                    },
+                                    "apiManagementConfig": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. APIM-Api Identifier."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure API management settings linked to the app."
+                                      }
+                                    },
+                                    "appCommandLine": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. App command line to launch."
+                                      }
+                                    },
+                                    "appSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Name of the pair."
+                                            }
+                                          },
+                                          "value": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Value of the pair."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application settings."
+                                      }
+                                    },
+                                    "autoHealEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if Auto Heal is enabled."
+                                      }
+                                    },
+                                    "autoHealRules": {
+                                      "type": "object",
+                                      "properties": {
+                                        "actions": {
+                                          "type": "object",
+                                          "properties": {
+                                            "actionType": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "CustomAction",
+                                                "LogEvent",
+                                                "Recycle"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Predefined action to be taken."
+                                              }
+                                            },
+                                            "customAction": {
+                                              "type": "object",
+                                              "properties": {
+                                                "exe": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Executable to be run."
+                                                  }
+                                                },
+                                                "parameters": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Parameters for the executable."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Custom action to be taken."
+                                              }
+                                            },
+                                            "minProcessExecutionTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Minimum time the process must execute before taking the action."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Actions to be executed when a rule is triggered."
+                                          }
+                                        },
+                                        "triggers": {
+                                          "type": "object",
+                                          "properties": {
+                                            "privateBytesInKB": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on private bytes."
+                                              }
+                                            },
+                                            "requests": {
+                                              "type": "object",
+                                              "properties": {
+                                                "count": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Request Count."
+                                                  }
+                                                },
+                                                "timeInterval": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Time interval."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on total requests."
+                                              }
+                                            },
+                                            "slowRequests": {
+                                              "$ref": "#/definitions/_3.slowRequestBasedTriggerType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on request execution time."
+                                              }
+                                            },
+                                            "slowRequestsWithPath": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/_3.slowRequestBasedTriggerType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on multiple Slow Requests Rule with path."
+                                              }
+                                            },
+                                            "statusCodes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "count": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Count."
+                                                    }
+                                                  },
+                                                  "path": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Path."
+                                                    }
+                                                  },
+                                                  "status": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. HTTP status code."
+                                                    }
+                                                  },
+                                                  "subStatus": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Sub Status."
+                                                    }
+                                                  },
+                                                  "timeInterval": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Time interval."
+                                                    }
+                                                  },
+                                                  "win32Status": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Win32 error code."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on status codes."
+                                              }
+                                            },
+                                            "statusCodesRange": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "count": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Count."
+                                                    }
+                                                  },
+                                                  "path": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Path."
+                                                    }
+                                                  },
+                                                  "statusCodes": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. HTTP status code."
+                                                    }
+                                                  },
+                                                  "timeInterval": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Time interval."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on status codes ranges."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Conditions that describe when to execute the auto-heal actions."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Auto Heal rules."
+                                      }
+                                    },
+                                    "autoSwapSlotName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Auto-swap slot name."
+                                      }
+                                    },
+                                    "azureStorageAccounts": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "type": "object",
+                                        "properties": {
+                                          "accessKey": {
+                                            "type": "securestring",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Access key for the storage account."
+                                            }
+                                          },
+                                          "accountName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the storage account."
+                                            }
+                                          },
+                                          "mountPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                            }
+                                          },
+                                          "protocol": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Http",
+                                              "Nfs",
+                                              "Smb"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Mounting protocol to use for the storage account."
+                                            }
+                                          },
+                                          "shareName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                            }
+                                          },
+                                          "type": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "AzureBlob",
+                                              "AzureFiles"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Type of storage."
+                                            }
+                                          }
+                                        },
+                                        "metadata": {
+                                          "description": "Required. A storage account configuration."
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of Azure Storage Accounts."
+                                      }
+                                    },
+                                    "connectionStrings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "connectionString": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Connection string value."
+                                            }
+                                          },
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of connection string."
+                                            }
+                                          },
+                                          "type": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "ApiHub",
+                                              "Custom",
+                                              "DocDb",
+                                              "EventHub",
+                                              "MySql",
+                                              "NotificationHub",
+                                              "PostgreSQL",
+                                              "RedisCache",
+                                              "SQLAzure",
+                                              "SQLServer",
+                                              "ServiceBus"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Type of database."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Connection strings."
+                                      }
+                                    },
+                                    "cors": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedOrigins": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Gets or sets the list of origins that should be allowed to make cross-origin calls (for example: http://example.com:12345). Use \"*\" to allow all."
+                                          }
+                                        },
+                                        "supportCredentials": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Gets or sets whether CORS requests with credentials are allowed. See [ref](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Requests_with_credentials) for more details."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Cross-Origin Resource Sharing (CORS) settings."
+                                      }
+                                    },
+                                    "defaultDocuments": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default documents."
+                                      }
+                                    },
+                                    "detailedErrorLoggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if detailed error logging is enabled."
+                                      }
+                                    },
+                                    "documentRoot": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Document root."
+                                      }
+                                    },
+                                    "elasticWebAppScaleLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to apps in plans where ElasticScaleEnabled is `true`."
+                                      }
+                                    },
+                                    "experiments": {
+                                      "type": "object",
+                                      "properties": {
+                                        "rampUpRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "actionHostName": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Hostname of a slot to which the traffic will be redirected if decided to. E.g. myapp-stage.azurewebsites.net."
+                                                }
+                                              },
+                                              "changeDecisionCallbackUrl": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified."
+                                                }
+                                              },
+                                              "changeIntervalInMinutes": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies interval in minutes to reevaluate ReroutePercentage."
+                                                }
+                                              },
+                                              "changeStep": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. In auto ramp up scenario this is the step to add/remove from `ReroutePercentage` until it reaches `MinReroutePercentage` or `MaxReroutePercentage`. Site metrics are checked every N minutes specified in `ChangeIntervalInMinutes`. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified in `ChangeDecisionCallbackUrl`."
+                                                }
+                                              },
+                                              "maxReroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies upper boundary below which ReroutePercentage will stay."
+                                                }
+                                              },
+                                              "minReroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies lower boundary above which ReroutePercentage will stay."
+                                                }
+                                              },
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of the routing rule. The recommended name would be to point to the slot which will receive the traffic in the experiment."
+                                                }
+                                              },
+                                              "reroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Percentage of the traffic which will be redirected to `ActionHostName`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. List of ramp-up rules."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. This is work around for polymorphic types."
+                                      }
+                                    },
+                                    "ftpsState": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AllAllowed",
+                                        "Disabled",
+                                        "FtpsOnly"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. State of FTP / FTPS service."
+                                      }
+                                    },
+                                    "functionAppScaleLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to the Consumption and Elastic Premium Plans."
+                                      }
+                                    },
+                                    "functionsRuntimeScaleMonitoringEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a value indicating whether functions runtime scale monitoring is enabled. When enabled, the ScaleController will not monitor event sources directly, but will instead call to the runtime to get scale status."
+                                      }
+                                    },
+                                    "handlerMappings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "arguments": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Command-line arguments to be passed to the script processor."
+                                            }
+                                          },
+                                          "extension": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Requests with this extension will be handled using the specified FastCGI application."
+                                            }
+                                          },
+                                          "scriptProcessor": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The absolute path to the FastCGI application."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Handler mappings."
+                                      }
+                                    },
+                                    "healthCheckPath": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Health check path."
+                                      }
+                                    },
+                                    "http20Enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allow clients to connect over http2.0."
+                                      }
+                                    },
+                                    "httpLoggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if HTTP logging is enabled."
+                                      }
+                                    },
+                                    "ipSecurityRestrictions": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/_3.scmIpSecurityRestrictionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for main."
+                                      }
+                                    },
+                                    "ipSecurityRestrictionsDefaultAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default action for main access restriction if no rules are matched."
+                                      }
+                                    },
+                                    "javaContainer": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java container."
+                                      }
+                                    },
+                                    "javaContainerVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java container version."
+                                      }
+                                    },
+                                    "javaVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java version."
+                                      }
+                                    },
+                                    "keyVaultReferenceIdentity": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Identity to use for Key Vault Reference authentication."
+                                      }
+                                    },
+                                    "limits": {
+                                      "type": "object",
+                                      "properties": {
+                                        "maxDiskSizeInMb": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed disk size usage in MB."
+                                          }
+                                        },
+                                        "maxMemoryInMb": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed memory usage in MB."
+                                          }
+                                        },
+                                        "maxPercentageCpu": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed CPU usage percentage."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Site limits."
+                                      }
+                                    },
+                                    "linuxFxVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Linux App Framework and version."
+                                      }
+                                    },
+                                    "loadBalancing": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "LeastRequests",
+                                        "LeastRequestsWithTieBreaker",
+                                        "LeastResponseTime",
+                                        "PerSiteRoundRobin",
+                                        "RequestHash",
+                                        "WeightedRoundRobin",
+                                        "WeightedTotalTraffic"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Site load balancing."
+                                      }
+                                    },
+                                    "localMySqlEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to enable local MySQL."
+                                      }
+                                    },
+                                    "logsDirectorySizeLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. HTTP logs directory size limit."
+                                      }
+                                    },
+                                    "managedPipelineMode": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Classic",
+                                        "Integrated"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Managed pipeline mode."
+                                      }
+                                    },
+                                    "managedServiceIdentityId": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Managed Service Identity Id."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Pair name."
+                                            }
+                                          },
+                                          "value": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Pair Value."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application metadata. This property cannot be retrieved, since it may contain secrets."
+                                      }
+                                    },
+                                    "minimumElasticInstanceCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 20,
+                                      "metadata": {
+                                        "description": "Optional. Number of minimum instance count for a site. This setting only applies to the Elastic Plans."
+                                      }
+                                    },
+                                    "minTlsCipherSuite": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "TLS_AES_128_GCM_SHA256",
+                                        "TLS_AES_256_GCM_SHA384",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                                        "TLS_RSA_WITH_AES_128_CBC_SHA",
+                                        "TLS_RSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_RSA_WITH_AES_256_CBC_SHA",
+                                        "TLS_RSA_WITH_AES_256_CBC_SHA256",
+                                        "TLS_RSA_WITH_AES_256_GCM_SHA384"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The minimum strength TLS cipher suite allowed for an application."
+                                      }
+                                    },
+                                    "minTlsVersion": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "1.0",
+                                        "1.1",
+                                        "1.2",
+                                        "1.3"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. MinTlsVersion: configures the minimum version of TLS required for SSL requests."
+                                      }
+                                    },
+                                    "netFrameworkVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. .NET Framework version."
+                                      }
+                                    },
+                                    "nodeVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of Node.js."
+                                      }
+                                    },
+                                    "numberOfWorkers": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Number of workers."
+                                      }
+                                    },
+                                    "phpVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of PHP."
+                                      }
+                                    },
+                                    "powerShellVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of PowerShell."
+                                      }
+                                    },
+                                    "preWarmedInstanceCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 10,
+                                      "metadata": {
+                                        "description": "Optional. Number of preWarmed instances. This setting only applies to the Consumption and Elastic Plans."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Property to allow or block all public traffic."
+                                      }
+                                    },
+                                    "publishingUsername": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Publishing user name."
+                                      }
+                                    },
+                                    "push": {
+                                      "type": "object",
+                                      "properties": {
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "dynamicTagsJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                              }
+                                            },
+                                            "isPushEnabled": {
+                                              "type": "bool",
+                                              "metadata": {
+                                                "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                              }
+                                            },
+                                            "tagsRequiringAuth": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                              }
+                                            },
+                                            "tagWhitelistJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. PushSettings resource specific properties."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Push endpoint settings."
+                                      }
+                                    },
+                                    "pythonVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of Python."
+                                      }
+                                    },
+                                    "remoteDebuggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if remote debugging is enabled."
+                                      }
+                                    },
+                                    "remoteDebuggingVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Remote debugging version."
+                                      }
+                                    },
+                                    "requestTracingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if request tracing is enabled."
+                                      }
+                                    },
+                                    "requestTracingExpirationTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request tracing expiration time."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictions": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/_3.scmIpSecurityRestrictionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for scm."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionsDefaultAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default action for scm access restriction if no rules are matched."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionsUseMain": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for scm to use main."
+                                      }
+                                    },
+                                    "scmMinTlsVersion": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "1.0",
+                                        "1.1",
+                                        "1.2",
+                                        "1.3"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. ScmMinTlsVersion: configures the minimum version of TLS required for SSL requests for SCM site."
+                                      }
+                                    },
+                                    "scmType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "BitbucketGit",
+                                        "BitbucketHg",
+                                        "CodePlexGit",
+                                        "CodePlexHg",
+                                        "Dropbox",
+                                        "ExternalGit",
+                                        "ExternalHg",
+                                        "GitHub",
+                                        "LocalGit",
+                                        "None",
+                                        "OneDrive",
+                                        "Tfs",
+                                        "VSO",
+                                        "VSTSRM"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SCM type."
+                                      }
+                                    },
+                                    "tracingOptions": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tracing options."
+                                      }
+                                    },
+                                    "use32BitWorkerProcess": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to use 32-bit worker process."
+                                      }
+                                    },
+                                    "virtualApplications": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "physicalPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Physical path."
+                                            }
+                                          },
+                                          "preloadEnabled": {
+                                            "type": "bool",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Set to `true` if preloading is enabled."
+                                            }
+                                          },
+                                          "virtualDirectories": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "object",
+                                              "properties": {
+                                                "physicalPath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Physical path."
+                                                  }
+                                                },
+                                                "virtualPath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Path to virtual application."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Virtual directories for virtual application."
+                                            }
+                                          },
+                                          "virtualPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Virtual path."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual applications."
+                                      }
+                                    },
+                                    "vnetName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual Network name."
+                                      }
+                                    },
+                                    "vnetPrivatePortsCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of private ports assigned to this app. These will be assigned dynamically on runtime."
+                                      }
+                                    },
+                                    "vnetRouteAllEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+                                      }
+                                    },
+                                    "websiteTimeZone": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Sets the time zone a site uses for generating timestamps. Compatible with Linux and Windows App Service. Setting the WEBSITE_TIME_ZONE app setting takes precedence over this config. For Linux, expects tz database values https://www.iana.org/time-zones (for a quick reference see [ref](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)). For Windows, expects one of the time zones listed under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones."
+                                      }
+                                    },
+                                    "webSocketsEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if WebSocket is enabled."
+                                      }
+                                    },
+                                    "windowsFxVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Xenon App Framework and version."
+                                      }
+                                    },
+                                    "xManagedServiceIdentityId": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Explicit Managed Service Identity Id."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a web configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the site."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "allowedValues": [
+                                "functionapp",
+                                "functionapp,linux",
+                                "functionapp,workflowapp",
+                                "functionapp,workflowapp,linux",
+                                "functionapp,linux,container",
+                                "functionapp,linux,container,azurecontainerapps",
+                                "app,linux",
+                                "app",
+                                "linux,api",
+                                "api",
+                                "app,linux,container",
+                                "app,container,windows"
+                              ],
+                              "metadata": {
+                                "description": "Required. Type of site to deploy."
+                              }
+                            },
+                            "serverFarmResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the app service plan to use for the site. Set as empty string when using a managed environment id for container apps."
+                              }
+                            },
+                            "managedEnvironmentResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                              }
+                            },
+                            "httpsOnly": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Configures a site to accept only HTTPS requests. Issues redirect for HTTP requests."
+                              }
+                            },
+                            "clientAffinityEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. If client affinity is enabled."
+                              }
+                            },
+                            "clientAffinityProxyEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance. Default is true."
+                              }
+                            },
+                            "clientAffinityPartitioningEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. To enable client affinity partitioning using CHIPS cookies, this will add the partitioned property to the affinity cookies; false to stop sending partitioned affinity cookies. Default is false."
+                              }
+                            },
+                            "appServiceEnvironmentResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the app service environment to use for this resource."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "keyVaultAccessIdentityResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                              }
+                            },
+                            "storageAccountRequired": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Checks if Customer provided storage account is required."
+                              }
+                            },
+                            "virtualNetworkSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                              }
+                            },
+                            "scmSiteAlsoStopped": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                              }
+                            },
+                            "siteConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/siteConfig"
+                                },
+                                "description": "Optional. The site config object. The defaults are set to the following values: alwaysOn: true, minTlsVersion: '1.2', ftpsState: 'FtpsOnly'."
+                              },
+                              "defaultValue": {
+                                "alwaysOn": true,
+                                "minTlsVersion": "1.2",
+                                "ftpsState": "FtpsOnly"
+                              }
+                            },
+                            "outboundVnetRouting": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                                },
+                                "description": "Optional. The outbound VNET routing configuration for the site."
+                              },
+                              "nullable": true
+                            },
+                            "configs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/configType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The web site config."
+                              }
+                            },
+                            "functionAppConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/functionAppConfig"
+                                },
+                                "description": "Optional. The Function App configuration object."
+                              },
+                              "nullable": true
+                            },
+                            "extensions": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/extensionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The extensions configuration."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointSingleServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                              }
+                            },
+                            "slots": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/slotType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration for deployment slots for an app."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "clientCertEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                              }
+                            },
+                            "clientCertExclusionPaths": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                              }
+                            },
+                            "clientCertMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/clientCertMode"
+                                },
+                                "description": "Optional. This composes with ClientCertEnabled setting.\n- ClientCertEnabled=false means ClientCert is ignored.\n- ClientCertEnabled=true and ClientCertMode=Required means ClientCert is required.\n- ClientCertEnabled=true and ClientCertMode=Optional means ClientCert is optional or accepted.\n"
+                              },
+                              "defaultValue": "Optional"
+                            },
+                            "cloningInfo": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/cloningInfo"
+                                },
+                                "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                              },
+                              "nullable": true
+                            },
+                            "containerSize": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Size of the function container."
+                              }
+                            },
+                            "dailyMemoryTimeQuota": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                              }
+                            },
+                            "enabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                              }
+                            },
+                            "hostNameSslStates": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/hostNameSslStates"
+                                },
+                                "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                              },
+                              "nullable": true
+                            },
+                            "hyperV": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Hyper-V sandbox."
+                              }
+                            },
+                            "redundancyMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/redundancyMode"
+                                },
+                                "description": "Optional. Site redundancy mode."
+                              },
+                              "defaultValue": "None"
+                            },
+                            "basicPublishingCredentialsPolicies": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The site publishing credential policy names which are associated with the sites."
+                              }
+                            },
+                            "hybridConnectionRelays": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hybridConnectionRelayType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Names of hybrid connection relays to connect app with."
+                              }
+                            },
+                            "hostNameBindings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hostNameBindingType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Host Name Bindings for the site."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                                },
+                                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set."
+                              },
+                              "nullable": true
+                            },
+                            "e2eEncryptionEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. End to End Encryption Setting."
+                              }
+                            },
+                            "dnsConfiguration": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/dnsConfiguration"
+                                },
+                                "description": "Optional. Property to configure various DNS related settings for a site."
+                              },
+                              "nullable": true
+                            },
+                            "autoGeneratedDomainNameLabelScope": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                                },
+                                "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                              },
+                              "nullable": true
+                            },
+                            "sshEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Whether to enable SSH access."
+                              }
+                            },
+                            "daprConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/daprConfig"
+                                },
+                                "description": "Optional. Dapr configuration of the app."
+                              },
+                              "nullable": true
+                            },
+                            "ipMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/ipMode"
+                                },
+                                "description": "Optional. Specifies the IP mode of the app."
+                              },
+                              "nullable": true
+                            },
+                            "resourceConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/resourceConfig"
+                                },
+                                "description": "Optional. Function app resource requirements."
+                              },
+                              "nullable": true
+                            },
+                            "workloadProfileName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Workload profile name for function app to execute on."
+                              }
+                            },
+                            "hostNamesDisabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                              }
+                            },
+                            "reserved": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                              }
+                            },
+                            "extendedLocation": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/extendedLocation"
+                                },
+                                "description": "Optional. Extended location of the resource."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "managedEnvironmentSupportedKinds": [
+                              "functionapp,linux,container,azurecontainerapps"
+                            ],
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                              "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                              "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-site.{0}.{1}', replace('0.23.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "app": {
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2025-03-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "kind": "[parameters('kind')]",
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "extendedLocation": "[parameters('extendedLocation')]",
+                              "properties": {
+                                "managedEnvironmentId": "[parameters('managedEnvironmentResourceId')]",
+                                "serverFarmId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), not(empty(parameters('managedEnvironmentResourceId')))), null(), parameters('serverFarmResourceId'))]",
+                                "clientAffinityEnabled": "[if(not(empty(parameters('serverFarmResourceId'))), parameters('clientAffinityEnabled'), null())]",
+                                "clientAffinityProxyEnabled": "[parameters('clientAffinityProxyEnabled')]",
+                                "clientAffinityPartitioningEnabled": "[parameters('clientAffinityPartitioningEnabled')]",
+                                "httpsOnly": "[parameters('httpsOnly')]",
+                                "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                                "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                                "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                                "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]",
+                                "siteConfig": "[parameters('siteConfig')]",
+                                "functionAppConfig": "[parameters('functionAppConfig')]",
+                                "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                                "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                                "clientCertMode": "[if(not(empty(parameters('serverFarmResourceId'))), parameters('clientCertMode'), null())]",
+                                "cloningInfo": "[parameters('cloningInfo')]",
+                                "containerSize": "[parameters('containerSize')]",
+                                "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                                "enabled": "[parameters('enabled')]",
+                                "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                                "hyperV": "[parameters('hyperV')]",
+                                "redundancyMode": "[parameters('redundancyMode')]",
+                                "publicNetworkAccess": "[if(not(empty(parameters('serverFarmResourceId'))), if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled')), null())]",
+                                "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
+                                "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]",
+                                "dnsConfiguration": "[parameters('dnsConfiguration')]",
+                                "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                                "outboundVnetRouting": "[parameters('outboundVnetRouting')]",
+                                "sshEnabled": "[parameters('sshEnabled')]",
+                                "daprConfig": "[parameters('daprConfig')]",
+                                "ipMode": "[parameters('ipMode')]",
+                                "resourceConfig": "[parameters('resourceConfig')]",
+                                "workloadProfileName": "[parameters('workloadProfileName')]",
+                                "hostNamesDisabled": "[parameters('hostNamesDisabled')]",
+                                "reserved": "[parameters('reserved')]"
+                              }
+                            },
+                            "app_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_diagnosticSettings": {
+                              "copy": {
+                                "name": "app_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_roleAssignments": {
+                              "copy": {
+                                "name": "app_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_config": {
+                              "copy": {
+                                "name": "app_config",
+                                "count": "[length(coalesce(parameters('configs'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Site-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                                  },
+                                  "applicationInsightResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                                  },
+                                  "storageAccountResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountResourceId')]"
+                                  },
+                                  "storageAccountUseIdentityAuthentication": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication')]"
+                                  },
+                                  "properties": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                                  },
+                                  "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites', parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]",
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "8196639045793921819"
+                                    },
+                                    "name": "Site App Settings",
+                                    "description": "This module deploys a Site App Setting."
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "appsettings",
+                                        "authsettings",
+                                        "authsettingsV2",
+                                        "azurestorageaccounts",
+                                        "backup",
+                                        "connectionstrings",
+                                        "logs",
+                                        "metadata",
+                                        "pushsettings",
+                                        "slotConfigNames",
+                                        "web"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The name of the config."
+                                      }
+                                    },
+                                    "properties": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. The properties of the config. Note: This parameter is highly dependent on the config type, defined by its name."
+                                      }
+                                    },
+                                    "storageAccountUseIdentityAuthentication": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                      }
+                                    },
+                                    "storageAccountResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                      }
+                                    },
+                                    "applicationInsightResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "currentAppSettings": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The key-values pairs of the current app settings."
+                                        }
+                                      },
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. The current app settings."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-siteconfig.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "applicationInsights": {
+                                      "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.Insights/components",
+                                      "apiVersion": "2020-02-02",
+                                      "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
+                                      "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
+                                    },
+                                    "storageAccount": {
+                                      "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-06-01",
+                                      "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                                      "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "config": {
+                                      "type": "Microsoft.Web/sites/config",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                                      "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys('storageAccount', '2025-06-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/')), 'AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob, 'AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue, 'AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table), createObject())), if(not(empty(parameters('applicationInsightResourceId'))), shallowMerge(createArray(createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), if(not(contains(parameters('properties'), 'ApplicationInsightsAgent_EXTENSION_VERSION')), createObject('ApplicationInsightsAgent_EXTENSION_VERSION', if(contains(createArray('functionapp,linux', 'functionapp,workflowapp,linux', 'functionapp,linux,container', 'functionapp,linux,container,azurecontainerapps', 'app,linux', 'linux,api', 'app,linux,container'), reference('app', '2025-03-01', 'full').kind), '~3', '~2')), createObject()))), createObject()))]",
+                                      "dependsOn": [
+                                        "app",
+                                        "applicationInsights",
+                                        "storageAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the site config."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the site config."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the site config was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_extensions": {
+                              "copy": {
+                                "name": "app_extensions",
+                                "count": "[length(coalesce(parameters('extensions'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Site-Extension-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "properties": {
+                                    "value": "[coalesce(parameters('extensions'), createArray())[copyIndex()].properties]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "13172204291630325256"
+                                    },
+                                    "name": "Site Deployment Extension ",
+                                    "description": "This module deploys a Site extension for MSDeploy."
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the parent site resource."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "MSDeploy",
+                                      "allowedValues": [
+                                        "MSDeploy"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The name of the extension."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "defaultValue": "MSDeploy",
+                                      "allowedValues": [
+                                        "MSDeploy"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The kind of extension."
+                                      }
+                                    },
+                                    "properties": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                                        },
+                                        "description": "Optional. Sets the properties."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-extension.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "msdeploy": {
+                                      "type": "Microsoft.Web/sites/extensions",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                                      "kind": "[parameters('kind')]",
+                                      "properties": "[parameters('properties')]"
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the extension was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_slots": {
+                              "copy": {
+                                "name": "app_slots",
+                                "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                                "mode": "serial",
+                                "batchSize": 1
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('slots'), createArray())[copyIndex()].name]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "kind": {
+                                    "value": "[parameters('kind')]"
+                                  },
+                                  "serverFarmResourceId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), not(empty(parameters('managedEnvironmentResourceId')))), createObject('value', null()), createObject('value', parameters('serverFarmResourceId')))]",
+                                  "managedEnvironmentResourceId": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedEnvironmentResourceId'), parameters('managedEnvironmentResourceId'))]"
+                                  },
+                                  "httpsOnly": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'httpsOnly'), parameters('httpsOnly'))]"
+                                  },
+                                  "appServiceEnvironmentResourceId": {
+                                    "value": "[parameters('appServiceEnvironmentResourceId')]"
+                                  },
+                                  "clientAffinityEnabled": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityEnabled'), parameters('clientAffinityEnabled'))]"
+                                  },
+                                  "clientAffinityProxyEnabled": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityProxyEnabled'), parameters('clientAffinityProxyEnabled'))]"
+                                  },
+                                  "clientAffinityPartitioningEnabled": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityPartitioningEnabled'), parameters('clientAffinityPartitioningEnabled'))]"
+                                  },
+                                  "managedIdentities": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedIdentities'), parameters('managedIdentities'))]"
+                                  },
+                                  "keyVaultAccessIdentityResourceId": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'keyVaultAccessIdentityResourceId'), parameters('keyVaultAccessIdentityResourceId'))]"
+                                  },
+                                  "storageAccountRequired": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountRequired'), parameters('storageAccountRequired'))]"
+                                  },
+                                  "virtualNetworkSubnetResourceId": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'virtualNetworkSubnetResourceId'), parameters('virtualNetworkSubnetResourceId'))]"
+                                  },
+                                  "siteConfig": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'siteConfig'), parameters('siteConfig'))]"
+                                  },
+                                  "functionAppConfig": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'functionAppConfig'), parameters('functionAppConfig'))]"
+                                  },
+                                  "configs": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'configs'), parameters('configs'))]"
+                                  },
+                                  "extensions": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'extensions'), parameters('extensions'))]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'diagnosticSettings')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "basicPublishingCredentialsPolicies": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'basicPublishingCredentialsPolicies'), parameters('basicPublishingCredentialsPolicies'))]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateEndpoints": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'), createArray())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "clientCertEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertEnabled')]"
+                                  },
+                                  "clientCertExclusionPaths": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertExclusionPaths')]"
+                                  },
+                                  "clientCertMode": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertMode')]"
+                                  },
+                                  "cloningInfo": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'cloningInfo')]"
+                                  },
+                                  "containerSize": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'containerSize')]"
+                                  },
+                                  "customDomainVerificationId": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'customDomainVerificationId')]"
+                                  },
+                                  "dailyMemoryTimeQuota": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dailyMemoryTimeQuota')]"
+                                  },
+                                  "enabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'enabled')]"
+                                  },
+                                  "hostNameSslStates": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameSslStates')]"
+                                  },
+                                  "hyperV": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hyperV')]"
+                                  },
+                                  "publicNetworkAccess": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'publicNetworkAccess'), if(or(not(empty(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'))), not(empty(parameters('privateEndpoints')))), 'Disabled', 'Enabled'))]"
+                                  },
+                                  "redundancyMode": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'redundancyMode')]"
+                                  },
+                                  "hybridConnectionRelays": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hybridConnectionRelays')]"
+                                  },
+                                  "hostNameBindings": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameBindings')]"
+                                  },
+                                  "dnsConfiguration": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dnsConfiguration')]"
+                                  },
+                                  "autoGeneratedDomainNameLabelScope": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'autoGeneratedDomainNameLabelScope')]"
+                                  },
+                                  "outboundVnetRouting": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'outboundVnetRouting'), parameters('outboundVnetRouting'))]"
+                                  },
+                                  "sshEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'sshEnabled')]"
+                                  },
+                                  "daprConfig": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'daprConfig')]"
+                                  },
+                                  "ipMode": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'ipMode')]"
+                                  },
+                                  "resourceConfig": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'resourceConfig')]"
+                                  },
+                                  "workloadProfileName": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'workloadProfileName')]"
+                                  },
+                                  "hostNamesDisabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNamesDisabled')]"
+                                  },
+                                  "reserved": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'reserved')]"
+                                  },
+                                  "scmSiteAlsoStopped": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'scmSiteAlsoStopped'), parameters('scmSiteAlsoStopped'))]"
+                                  },
+                                  "e2eEncryptionEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'e2eEncryptionEnabled')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "14501171431519947073"
+                                    },
+                                    "name": "Web/Function App Deployment Slots",
+                                    "description": "This module deploys a Web or Function App Deployment Slot."
+                                  },
+                                  "definitions": {
+                                    "hostNameBindingsOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the host name binding."
+                                          }
+                                        },
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resource ID of the host name binding."
+                                          }
+                                        },
+                                        "resourceGroupName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the resource group the resource was deployed into."
+                                          }
+                                        },
+                                        "certificateThumbprint": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The thumbprint of the certificate."
+                                          }
+                                        },
+                                        "certificateResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The resource ID of the certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "privateEndpointOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the private endpoint."
+                                          }
+                                        },
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resource ID of the private endpoint."
+                                          }
+                                        },
+                                        "groupId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The group Id for the private endpoint Group."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "fqdn": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "FQDN that resolves to private endpoint IP address."
+                                                }
+                                              },
+                                              "ipAddresses": {
+                                                "type": "array",
+                                                "items": {
+                                                  "type": "string"
+                                                },
+                                                "metadata": {
+                                                  "description": "A list of private IP addresses of the private endpoint."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "The custom DNS configurations of the private endpoint."
+                                          }
+                                        },
+                                        "networkInterfaceResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "configType": {
+                                      "type": "object",
+                                      "discriminator": {
+                                        "propertyName": "name",
+                                        "mapping": {
+                                          "appsettings": {
+                                            "$ref": "#/definitions/appSettingsConfigType"
+                                          },
+                                          "authsettings": {
+                                            "$ref": "#/definitions/authSettingsConfigType"
+                                          },
+                                          "authsettingsV2": {
+                                            "$ref": "#/definitions/authSettingsV2ConfigType"
+                                          },
+                                          "azurestorageaccounts": {
+                                            "$ref": "#/definitions/azureStorageAccountConfigType"
+                                          },
+                                          "backup": {
+                                            "$ref": "#/definitions/backupConfigType"
+                                          },
+                                          "connectionstrings": {
+                                            "$ref": "#/definitions/connectionStringsConfigType"
+                                          },
+                                          "logs": {
+                                            "$ref": "#/definitions/logsConfigType"
+                                          },
+                                          "metadata": {
+                                            "$ref": "#/definitions/metadataConfigType"
+                                          },
+                                          "pushsettings": {
+                                            "$ref": "#/definitions/pushSettingsConfigType"
+                                          },
+                                          "web": {
+                                            "$ref": "#/definitions/webConfigType"
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a site configuration."
+                                      }
+                                    },
+                                    "appSettingsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "appsettings"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "storageAccountUseIdentityAuthentication": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                          }
+                                        },
+                                        "applicationInsightResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                          }
+                                        },
+                                        "retainCurrentAppSettings": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The retain the current app settings. Defaults to true."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. An app settings key-value pair."
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an app settings configuration."
+                                      }
+                                    },
+                                    "authSettingsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "authsettings"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "aadClaimsAuthorization": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets a JSON string containing the Azure AD Acl settings."
+                                              }
+                                            },
+                                            "additionalLoginParams": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                              }
+                                            },
+                                            "allowedAudiences": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting."
+                                              }
+                                            },
+                                            "allowedExternalRedirectUrls": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                              }
+                                            },
+                                            "authFilePath": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The path of the config file containing auth settings. If the path is relative, base will the site's root directory."
+                                              }
+                                            },
+                                            "clientId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                              }
+                                            },
+                                            "clientSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                              }
+                                            },
+                                            "clientSecretCertificateThumbprint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                              }
+                                            },
+                                            "clientSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                              }
+                                            },
+                                            "configVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization."
+                                              }
+                                            },
+                                            "defaultProvider": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "AzureActiveDirectory",
+                                                "Facebook",
+                                                "Github",
+                                                "Google",
+                                                "MicrosoftAccount",
+                                                "Twitter"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                              }
+                                            },
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                              }
+                                            },
+                                            "facebookAppId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                              }
+                                            },
+                                            "facebookAppSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                              }
+                                            },
+                                            "facebookAppSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the app secret used for Facebook Login."
+                                              }
+                                            },
+                                            "facebookOAuthScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                              }
+                                            },
+                                            "gitHubClientId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The Client Id of the GitHub app used for login. This setting is required for enabling Github login."
+                                              }
+                                            },
+                                            "gitHubClientSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login."
+                                              }
+                                            },
+                                            "gitHubClientSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the client secret of the Github app used for GitHub Login."
+                                              }
+                                            },
+                                            "gitHubOAuthScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication."
+                                              }
+                                            },
+                                            "googleClientId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                              }
+                                            },
+                                            "googleClientSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                              }
+                                            },
+                                            "googleClientSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the client secret associated with the Google web application."
+                                              }
+                                            },
+                                            "googleOAuthScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, \"openid\", \"profile\", and \"email\" are used as default scopes. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                              }
+                                            },
+                                            "isAuthFromFile": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "false",
+                                                "true"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. \"true\" if the auth config settings should be read from a file, \"false\" otherwise."
+                                              }
+                                            },
+                                            "issuer": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                              }
+                                            },
+                                            "microsoftAccountClientId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                              }
+                                            },
+                                            "microsoftAccountClientSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                              }
+                                            },
+                                            "microsoftAccountClientSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication."
+                                              }
+                                            },
+                                            "microsoftAccountOAuthScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, \"wl.basic\" is used as the default scope. Microsoft Account Scopes and permissions [documentation](https://msdn.microsoft.com/en-us/library/dn631845.aspx)."
+                                              }
+                                            },
+                                            "runtimeVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                              }
+                                            },
+                                            "tokenRefreshExtensionHours": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                              }
+                                            },
+                                            "tokenStoreEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows. The default is `false`."
+                                              }
+                                            },
+                                            "twitterConsumerKey": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                              }
+                                            },
+                                            "twitterConsumerSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                              }
+                                            },
+                                            "twitterConsumerSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                              }
+                                            },
+                                            "unauthenticatedClientAction": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "AllowAnonymous",
+                                                "RedirectToLoginPage"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                              }
+                                            },
+                                            "validateIssuer": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an auth settings configuration."
+                                      }
+                                    },
+                                    "authSettingsV2ConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "authsettingsV2"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "globalValidation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "excludedPaths": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The paths for which unauthenticated flow would not be redirected to the login page."
+                                                  }
+                                                },
+                                                "redirectToProvider": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                                  }
+                                                },
+                                                "requireAuthentication": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the authentication flow is required by every request."
+                                                  }
+                                                },
+                                                "unauthenticatedClientAction": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "AllowAnonymous",
+                                                    "RedirectToLoginPage",
+                                                    "Return401",
+                                                    "Return403"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings that determines the validation flow of users using App Service Authentication/Authorization."
+                                              }
+                                            },
+                                            "httpSettings": {
+                                              "type": "object",
+                                              "properties": {
+                                                "forwardProxy": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "convention": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "Custom",
+                                                        "NoProxy",
+                                                        "Standard"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The convention used to determine the url of the request made."
+                                                      }
+                                                    },
+                                                    "customHostHeaderName": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the header containing the host of the request."
+                                                      }
+                                                    },
+                                                    "customProtoHeaderName": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the header containing the scheme of the request."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of a forward proxy used to make the requests."
+                                                  }
+                                                },
+                                                "requireHttps": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `false` if the authentication/authorization responses not having the HTTPS scheme are permissible."
+                                                  }
+                                                },
+                                                "routes": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "apiPrefix": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The prefix that should precede all the authentication/authorization paths."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the paths HTTP requests."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against App Service Authentication/Authorization."
+                                              }
+                                            },
+                                            "identityProviders": {
+                                              "type": "object",
+                                              "properties": {
+                                                "apple": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Apple provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the client secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Apple registration."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Apple provider."
+                                                  }
+                                                },
+                                                "azureActiveDirectory": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "isAutoProvisioned": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "disableWWWAuthenticate": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Set to `true` if the www-authenticate provider should be omitted from the request."
+                                                          }
+                                                        },
+                                                        "loginParameters": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                                          }
+                                                        },
+                                                        "clientSecretCertificateIssuer": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                          }
+                                                        },
+                                                        "clientSecretCertificateSubjectAlternativeName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                          }
+                                                        },
+                                                        "clientSecretCertificateThumbprint": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                                          }
+                                                        },
+                                                        "openIdIssuer": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory app registration."
+                                                      }
+                                                    },
+                                                    "validation": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "allowedAudiences": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of audiences that can make successful authentication/authorization requests."
+                                                          }
+                                                        },
+                                                        "defaultAuthorizationPolicy": {
+                                                          "type": "object",
+                                                          "properties": {
+                                                            "allowedApplications": {
+                                                              "type": "array",
+                                                              "items": {
+                                                                "type": "string"
+                                                              },
+                                                              "nullable": true,
+                                                              "metadata": {
+                                                                "description": "Optional. The configuration settings of the Azure Active Directory allowed applications."
+                                                              }
+                                                            },
+                                                            "allowedPrincipals": {
+                                                              "type": "object",
+                                                              "properties": {
+                                                                "groups": {
+                                                                  "type": "array",
+                                                                  "items": {
+                                                                    "type": "string"
+                                                                  },
+                                                                  "nullable": true,
+                                                                  "metadata": {
+                                                                    "description": "Optional. The list of the allowed groups."
+                                                                  }
+                                                                },
+                                                                "identities": {
+                                                                  "type": "array",
+                                                                  "items": {
+                                                                    "type": "string"
+                                                                  },
+                                                                  "nullable": true,
+                                                                  "metadata": {
+                                                                    "description": "Optional. The list of the allowed identities."
+                                                                  }
+                                                                }
+                                                              },
+                                                              "nullable": true,
+                                                              "metadata": {
+                                                                "description": "Optional. The configuration settings of the Azure Active Directory allowed principals."
+                                                              }
+                                                            }
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The configuration settings of the default authorization policy."
+                                                          }
+                                                        },
+                                                        "jwtClaimChecks": {
+                                                          "type": "object",
+                                                          "properties": {
+                                                            "allowedClientApplications": {
+                                                              "type": "array",
+                                                              "items": {
+                                                                "type": "string"
+                                                              },
+                                                              "nullable": true,
+                                                              "metadata": {
+                                                                "description": "Optional. The list of the allowed client applications."
+                                                              }
+                                                            },
+                                                            "allowedGroups": {
+                                                              "type": "array",
+                                                              "items": {
+                                                                "type": "string"
+                                                              },
+                                                              "nullable": true,
+                                                              "metadata": {
+                                                                "description": "Optional. The list of the allowed groups."
+                                                              }
+                                                            }
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The configuration settings of the checks that should be made while validating the JWT Claims."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Azure Active directory provider."
+                                                  }
+                                                },
+                                                "azureStaticWebApps": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Azure Static Web Apps provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Static Web Apps registration."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Azure Static Web Apps provider."
+                                                  }
+                                                },
+                                                "customOpenIdConnectProviders": {
+                                                  "type": "object",
+                                                  "properties": {},
+                                                  "additionalProperties": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Set to `false` if the custom Open ID provider provider should not be enabled."
+                                                        }
+                                                      },
+                                                      "login": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "nameClaimType": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The name of the claim that contains the users name."
+                                                            }
+                                                          },
+                                                          "scopes": {
+                                                            "type": "array",
+                                                            "items": {
+                                                              "type": "string"
+                                                            },
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                            }
+                                                          }
+                                                        },
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The configuration settings of the login flow of the custom Open ID Connect provider."
+                                                        }
+                                                      },
+                                                      "registration": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "clientCredential": {
+                                                            "type": "object",
+                                                            "properties": {
+                                                              "clientSecretSettingName": {
+                                                                "type": "string",
+                                                                "metadata": {
+                                                                  "description": "Required. The app setting that contains the client secret for the custom Open ID Connect provider."
+                                                                }
+                                                              },
+                                                              "method": {
+                                                                "type": "string",
+                                                                "allowedValues": [
+                                                                  "ClientSecretPost"
+                                                                ],
+                                                                "metadata": {
+                                                                  "description": "Required. The method that should be used to authenticate the user."
+                                                                }
+                                                              }
+                                                            },
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The authentication credentials of the custom Open ID Connect provider."
+                                                            }
+                                                          },
+                                                          "clientId": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The client id of the custom Open ID Connect provider."
+                                                            }
+                                                          },
+                                                          "openIdConnectConfiguration": {
+                                                            "type": "object",
+                                                            "properties": {
+                                                              "authorizationEndpoint": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint to be used to make an authorization request."
+                                                                }
+                                                              },
+                                                              "certificationUri": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint that provides the keys necessary to validate the token."
+                                                                }
+                                                              },
+                                                              "issuer": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint that issues the token."
+                                                                }
+                                                              },
+                                                              "tokenEndpoint": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint to be used to request a token."
+                                                                }
+                                                              },
+                                                              "wellKnownOpenIdConfiguration": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint that contains all the configuration endpoints for the provider."
+                                                                }
+                                                              }
+                                                            },
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The configuration settings of the endpoints used for the custom Open ID Connect provider."
+                                                            }
+                                                          }
+                                                        },
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The configuration settings of the app registration for the custom Open ID Connect provider."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The alias of each custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider."
+                                                  }
+                                                },
+                                                "facebook": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Facebook provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "graphApiVersion": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The version of the Facebook api to be used while logging in."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "appId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The App ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "appSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the app secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the Facebook provider."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Facebook provider."
+                                                  }
+                                                },
+                                                "gitHub": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the GitHub provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the client secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the GitHub provider."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the GitHub provider."
+                                                  }
+                                                },
+                                                "google": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Google provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the client secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the Google provider."
+                                                      }
+                                                    },
+                                                    "validation": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "allowedAudiences": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Google provider."
+                                                  }
+                                                },
+                                                "legacyMicrosoftAccount": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the legacy Microsoft Account provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the client secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the legacy Microsoft Account provider."
+                                                      }
+                                                    },
+                                                    "validation": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "allowedAudiences": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the legacy Microsoft Account provider token validation flow."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the legacy Microsoft Account provider."
+                                                  }
+                                                },
+                                                "twitter": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Twitter provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "consumerKey": {
+                                                          "type": "securestring",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                                          }
+                                                        },
+                                                        "consumerSecretSettingName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the Twitter provider."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Twitter provider."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of each of the identity providers used to configure App Service Authentication/Authorization."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedExternalRedirectUrls": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                                  }
+                                                },
+                                                "cookieExpiration": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "convention": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "FixedTime",
+                                                        "IdentityProviderDerived"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The convention used when determining the session cookie's expiration."
+                                                      }
+                                                    },
+                                                    "timeToExpiration": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The time after the request is made when the session cookie should expire."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the session cookie's expiration."
+                                                  }
+                                                },
+                                                "nonce": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "nonceExpirationInterval": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The time after the request is made when the nonce should expire."
+                                                      }
+                                                    },
+                                                    "validateNonce": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the nonce should not be validated while completing the login flow."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the nonce used in the login flow."
+                                                  }
+                                                },
+                                                "preserveUrlFragmentsForLogins": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the fragments from the request are preserved after the login request is made."
+                                                  }
+                                                },
+                                                "routes": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "logoutEndpoint": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The endpoint at which a logout request should be made."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The routes that specify the endpoints used for login and logout requests."
+                                                  }
+                                                },
+                                                "tokenStore": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "azureBlobStorage": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "sasUrlSettingName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name of the app setting containing the SAS URL of the blob storage containing the tokens."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the storage of the tokens if blob storage is used."
+                                                      }
+                                                    },
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows."
+                                                      }
+                                                    },
+                                                    "fileSystem": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "directory": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The directory in which the tokens will be stored."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the storage of the tokens if a file system is used."
+                                                      }
+                                                    },
+                                                    "tokenRefreshExtensionHours": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the token store."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow of users using App Service Authentication/Authorization."
+                                              }
+                                            },
+                                            "platform": {
+                                              "type": "object",
+                                              "properties": {
+                                                "configFilePath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The path of the config file containing auth settings if they come from a file. If the path is relative, base will the site's root directory."
+                                                  }
+                                                },
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                                  }
+                                                },
+                                                "runtimeVersion": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the platform of App Service Authentication/Authorization."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an authSettingsV2 configuration."
+                                      }
+                                    },
+                                    "azureStorageAccountConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "azurestorageaccounts"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "accessKey": {
+                                                "type": "securestring",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Access key for the storage account."
+                                                }
+                                              },
+                                              "accountName": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of the storage account."
+                                                }
+                                              },
+                                              "mountPath": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                                }
+                                              },
+                                              "protocol": {
+                                                "type": "string",
+                                                "allowedValues": [
+                                                  "Http",
+                                                  "Nfs",
+                                                  "Smb"
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Mounting protocol to use for the storage account."
+                                                }
+                                              },
+                                              "shareName": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                                }
+                                              },
+                                              "type": {
+                                                "type": "string",
+                                                "allowedValues": [
+                                                  "AzureBlob",
+                                                  "AzureFiles"
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Type of storage."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Azure Storage Info configuration."
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an Azure Storage Account configuration."
+                                      }
+                                    },
+                                    "backupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "backup"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "backupName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Name of the backup."
+                                              }
+                                            },
+                                            "backupSchedule": {
+                                              "type": "object",
+                                              "properties": {
+                                                "frequencyInterval": {
+                                                  "type": "int",
+                                                  "metadata": {
+                                                    "description": "Required. How often the backup should be executed (e.g. for weekly backup, this should be set to 7 and FrequencyUnit should be set to Day)."
+                                                  }
+                                                },
+                                                "frequencyUnit": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Day",
+                                                    "Hour"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. The unit of time for how often the backup should be executed (e.g. for weekly backup, this should be set to Day and FrequencyInterval should be set to 7)."
+                                                  }
+                                                },
+                                                "keepAtLeastOneBackup": {
+                                                  "type": "bool",
+                                                  "metadata": {
+                                                    "description": "Required. Set to `True` if the retention policy should always keep at least one backup in the storage account, regardless how old it is."
+                                                  }
+                                                },
+                                                "retentionPeriodInDays": {
+                                                  "type": "int",
+                                                  "metadata": {
+                                                    "description": "Required. After how many days backups should be deleted."
+                                                  }
+                                                },
+                                                "startTime": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. When the schedule should start working."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Schedule for the backup if it is executed periodically."
+                                              }
+                                            },
+                                            "databases": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "connectionString": {
+                                                    "type": "securestring",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Contains a connection string to a database which is being backed up or restored. If the restore should happen to a new database, the database name inside is the new one."
+                                                    }
+                                                  },
+                                                  "connectionStringName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Contains a connection string name that is linked to the SiteConfig.ConnectionStrings. This is used during restore with overwrite connection strings options."
+                                                    }
+                                                  },
+                                                  "databaseType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "LocalMySql",
+                                                      "MySql",
+                                                      "PostgreSql",
+                                                      "SqlAzure"
+                                                    ],
+                                                    "metadata": {
+                                                      "description": "Required. Database type (e.g. SqlAzure / MySql)."
+                                                    }
+                                                  },
+                                                  "name": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of the setting."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Databases included in the backup."
+                                              }
+                                            },
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if the backup schedule is enabled (must be included in that case), `false` if the backup schedule should be disabled."
+                                              }
+                                            },
+                                            "storageAccountUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS URL to the container."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a backup configuration."
+                                      }
+                                    },
+                                    "connectionStringsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "connectionstrings"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "type": {
+                                                "type": "string",
+                                                "allowedValues": [
+                                                  "ApiHub",
+                                                  "Custom",
+                                                  "DocDb",
+                                                  "EventHub",
+                                                  "MySql",
+                                                  "NotificationHub",
+                                                  "PostgreSQL",
+                                                  "RedisCache",
+                                                  "SQLAzure",
+                                                  "SQLServer",
+                                                  "ServiceBus"
+                                                ],
+                                                "metadata": {
+                                                  "description": "Required. Type of database."
+                                                }
+                                              },
+                                              "value": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Value of pair."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of the connection string setting."
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a connection string configuration."
+                                      }
+                                    },
+                                    "logsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "logs"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "applicationLogs": {
+                                              "type": "object",
+                                              "properties": {
+                                                "azureBlobStorage": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "level": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "Error",
+                                                        "Information",
+                                                        "Off",
+                                                        "Verbose",
+                                                        "Warning"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Log level."
+                                                      }
+                                                    },
+                                                    "retentionInDays": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                                      }
+                                                    },
+                                                    "sasUrl": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Application logs to blob storage configuration."
+                                                  }
+                                                },
+                                                "azureTableStorage": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "level": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "Error",
+                                                        "Information",
+                                                        "Off",
+                                                        "Verbose",
+                                                        "Warning"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Log level."
+                                                      }
+                                                    },
+                                                    "sasUrl": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. SAS URL to an Azure table with add/query/delete permissions."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Application logs to azure table storage configuration."
+                                                  }
+                                                },
+                                                "fileSystem": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "level": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "Error",
+                                                        "Information",
+                                                        "Off",
+                                                        "Verbose",
+                                                        "Warning"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Log level."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Application logs to file system configuration."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application Logs for Azure configuration."
+                                              }
+                                            },
+                                            "detailedErrorMessages": {
+                                              "type": "object",
+                                              "properties": {
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Detailed error messages configuration."
+                                              }
+                                            },
+                                            "failedRequestsTracing": {
+                                              "type": "object",
+                                              "properties": {
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Failed requests tracing configuration."
+                                              }
+                                            },
+                                            "httpLogs": {
+                                              "type": "object",
+                                              "properties": {
+                                                "azureBlobStorage": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                                      }
+                                                    },
+                                                    "retentionInDays": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                                      }
+                                                    },
+                                                    "sasUrl": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Http logs to azure blob storage configuration."
+                                                  }
+                                                },
+                                                "fileSystem": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                                      }
+                                                    },
+                                                    "retentionInDays": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Retention in days. Remove files older than X days. 0 or lower means no retention."
+                                                      }
+                                                    },
+                                                    "retentionInMb": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "minValue": 25,
+                                                      "maxValue": 100,
+                                                      "metadata": {
+                                                        "description": "Optional. Maximum size in megabytes that http log files can use. When reached old log files will be removed to make space for new ones."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Http logs to file system configuration."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. HTTP logs configuration."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a logs configuration."
+                                      }
+                                    },
+                                    "metadataConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "metadata"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The metadata key value pair."
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a metadata configuration."
+                                      }
+                                    },
+                                    "pushSettingsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "pushsettings"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "dynamicTagsJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                              }
+                                            },
+                                            "isPushEnabled": {
+                                              "type": "bool",
+                                              "metadata": {
+                                                "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                              }
+                                            },
+                                            "tagsRequiringAuth": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                              }
+                                            },
+                                            "tagWhitelistJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a pushSettings configuration."
+                                      }
+                                    },
+                                    "webConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "web"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "acrUseManagedIdentityCreds": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Flag to use Managed Identity Creds for ACR pull."
+                                              }
+                                            },
+                                            "acrUserManagedIdentityID": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. If using user managed identity, the user managed identity ClientId."
+                                              }
+                                            },
+                                            "alwaysOn": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if 'Always On' is enabled."
+                                              }
+                                            },
+                                            "apiDefinition": {
+                                              "type": "object",
+                                              "properties": {
+                                                "url": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The URL of the API definition."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Information about the formal API definition for the app."
+                                              }
+                                            },
+                                            "apiManagementConfig": {
+                                              "type": "object",
+                                              "properties": {
+                                                "id": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. APIM-Api Identifier."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Azure API management settings linked to the app."
+                                              }
+                                            },
+                                            "appCommandLine": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. App command line to launch."
+                                              }
+                                            },
+                                            "appSettings": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "name": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. Name of the pair."
+                                                    }
+                                                  },
+                                                  "value": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. Value of the pair."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application settings."
+                                              }
+                                            },
+                                            "autoHealEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if Auto Heal is enabled."
+                                              }
+                                            },
+                                            "autoHealRules": {
+                                              "type": "object",
+                                              "properties": {
+                                                "actions": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "actionType": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "CustomAction",
+                                                        "LogEvent",
+                                                        "Recycle"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Predefined action to be taken."
+                                                      }
+                                                    },
+                                                    "customAction": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "exe": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Executable to be run."
+                                                          }
+                                                        },
+                                                        "parameters": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Parameters for the executable."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Custom action to be taken."
+                                                      }
+                                                    },
+                                                    "minProcessExecutionTime": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Minimum time the process must execute before taking the action."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Actions to be executed when a rule is triggered."
+                                                  }
+                                                },
+                                                "triggers": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "privateBytesInKB": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on private bytes."
+                                                      }
+                                                    },
+                                                    "requests": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "count": {
+                                                          "type": "int",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Request Count."
+                                                          }
+                                                        },
+                                                        "timeInterval": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Time interval."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on total requests."
+                                                      }
+                                                    },
+                                                    "slowRequests": {
+                                                      "$ref": "#/definitions/slowRequestBasedTriggerType",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on request execution time."
+                                                      }
+                                                    },
+                                                    "slowRequestsWithPath": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/slowRequestBasedTriggerType"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on multiple Slow Requests Rule with path."
+                                                      }
+                                                    },
+                                                    "statusCodes": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "count": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Request Count."
+                                                            }
+                                                          },
+                                                          "path": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Request Path."
+                                                            }
+                                                          },
+                                                          "status": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. HTTP status code."
+                                                            }
+                                                          },
+                                                          "subStatus": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Request Sub Status."
+                                                            }
+                                                          },
+                                                          "timeInterval": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Time interval."
+                                                            }
+                                                          },
+                                                          "win32Status": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Win32 error code."
+                                                            }
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on status codes."
+                                                      }
+                                                    },
+                                                    "statusCodesRange": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "count": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Request Count."
+                                                            }
+                                                          },
+                                                          "path": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Path."
+                                                            }
+                                                          },
+                                                          "statusCodes": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. HTTP status code."
+                                                            }
+                                                          },
+                                                          "timeInterval": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Time interval."
+                                                            }
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on status codes ranges."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Conditions that describe when to execute the auto-heal actions."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Auto Heal rules."
+                                              }
+                                            },
+                                            "autoSwapSlotName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Auto-swap slot name."
+                                              }
+                                            },
+                                            "azureStorageAccounts": {
+                                              "type": "object",
+                                              "properties": {},
+                                              "additionalProperties": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "accessKey": {
+                                                    "type": "securestring",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Access key for the storage account."
+                                                    }
+                                                  },
+                                                  "accountName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of the storage account."
+                                                    }
+                                                  },
+                                                  "mountPath": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                                    }
+                                                  },
+                                                  "protocol": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "Http",
+                                                      "Nfs",
+                                                      "Smb"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Mounting protocol to use for the storage account."
+                                                    }
+                                                  },
+                                                  "shareName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                                    }
+                                                  },
+                                                  "type": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "AzureBlob",
+                                                      "AzureFiles"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Type of storage."
+                                                    }
+                                                  }
+                                                },
+                                                "metadata": {
+                                                  "description": "Required. A storage account configuration."
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. List of Azure Storage Accounts."
+                                              }
+                                            },
+                                            "connectionStrings": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "connectionString": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Connection string value."
+                                                    }
+                                                  },
+                                                  "name": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of connection string."
+                                                    }
+                                                  },
+                                                  "type": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "ApiHub",
+                                                      "Custom",
+                                                      "DocDb",
+                                                      "EventHub",
+                                                      "MySql",
+                                                      "NotificationHub",
+                                                      "PostgreSQL",
+                                                      "RedisCache",
+                                                      "SQLAzure",
+                                                      "SQLServer",
+                                                      "ServiceBus"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Type of database."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Connection strings."
+                                              }
+                                            },
+                                            "cors": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedOrigins": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Gets or sets the list of origins that should be allowed to make cross-origin calls (for example: http://example.com:12345). Use \"*\" to allow all."
+                                                  }
+                                                },
+                                                "supportCredentials": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Gets or sets whether CORS requests with credentials are allowed. See [ref](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Requests_with_credentials) for more details."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Cross-Origin Resource Sharing (CORS) settings."
+                                              }
+                                            },
+                                            "defaultDocuments": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Default documents."
+                                              }
+                                            },
+                                            "detailedErrorLoggingEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if detailed error logging is enabled."
+                                              }
+                                            },
+                                            "documentRoot": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Document root."
+                                              }
+                                            },
+                                            "elasticWebAppScaleLimit": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "metadata": {
+                                                "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to apps in plans where ElasticScaleEnabled is `true`."
+                                              }
+                                            },
+                                            "experiments": {
+                                              "type": "object",
+                                              "properties": {
+                                                "rampUpRules": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "actionHostName": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Hostname of a slot to which the traffic will be redirected if decided to. E.g. myapp-stage.azurewebsites.net."
+                                                        }
+                                                      },
+                                                      "changeDecisionCallbackUrl": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified."
+                                                        }
+                                                      },
+                                                      "changeIntervalInMinutes": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Specifies interval in minutes to reevaluate ReroutePercentage."
+                                                        }
+                                                      },
+                                                      "changeStep": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. In auto ramp up scenario this is the step to add/remove from `ReroutePercentage` until it reaches `MinReroutePercentage` or `MaxReroutePercentage`. Site metrics are checked every N minutes specified in `ChangeIntervalInMinutes`. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified in `ChangeDecisionCallbackUrl`."
+                                                        }
+                                                      },
+                                                      "maxReroutePercentage": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Specifies upper boundary below which ReroutePercentage will stay."
+                                                        }
+                                                      },
+                                                      "minReroutePercentage": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Specifies lower boundary above which ReroutePercentage will stay."
+                                                        }
+                                                      },
+                                                      "name": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of the routing rule. The recommended name would be to point to the slot which will receive the traffic in the experiment."
+                                                        }
+                                                      },
+                                                      "reroutePercentage": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Percentage of the traffic which will be redirected to `ActionHostName`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. List of ramp-up rules."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. This is work around for polymorphic types."
+                                              }
+                                            },
+                                            "ftpsState": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "AllAllowed",
+                                                "Disabled",
+                                                "FtpsOnly"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. State of FTP / FTPS service."
+                                              }
+                                            },
+                                            "functionAppScaleLimit": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "metadata": {
+                                                "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to the Consumption and Elastic Premium Plans."
+                                              }
+                                            },
+                                            "functionsRuntimeScaleMonitoringEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a value indicating whether functions runtime scale monitoring is enabled. When enabled, the ScaleController will not monitor event sources directly, but will instead call to the runtime to get scale status."
+                                              }
+                                            },
+                                            "handlerMappings": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "arguments": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Command-line arguments to be passed to the script processor."
+                                                    }
+                                                  },
+                                                  "extension": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Requests with this extension will be handled using the specified FastCGI application."
+                                                    }
+                                                  },
+                                                  "scriptProcessor": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The absolute path to the FastCGI application."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Handler mappings."
+                                              }
+                                            },
+                                            "healthCheckPath": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Health check path."
+                                              }
+                                            },
+                                            "http20Enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Allow clients to connect over http2.0."
+                                              }
+                                            },
+                                            "httpLoggingEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if HTTP logging is enabled."
+                                              }
+                                            },
+                                            "ipSecurityRestrictions": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/scmIpSecurityRestrictionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. IP security restrictions for main."
+                                              }
+                                            },
+                                            "ipSecurityRestrictionsDefaultAction": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Allow",
+                                                "Deny"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Default action for main access restriction if no rules are matched."
+                                              }
+                                            },
+                                            "javaContainer": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Java container."
+                                              }
+                                            },
+                                            "javaContainerVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Java container version."
+                                              }
+                                            },
+                                            "javaVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Java version."
+                                              }
+                                            },
+                                            "keyVaultReferenceIdentity": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Identity to use for Key Vault Reference authentication."
+                                              }
+                                            },
+                                            "limits": {
+                                              "type": "object",
+                                              "properties": {
+                                                "maxDiskSizeInMb": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Maximum allowed disk size usage in MB."
+                                                  }
+                                                },
+                                                "maxMemoryInMb": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Maximum allowed memory usage in MB."
+                                                  }
+                                                },
+                                                "maxPercentageCpu": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Maximum allowed CPU usage percentage."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Site limits."
+                                              }
+                                            },
+                                            "linuxFxVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Linux App Framework and version."
+                                              }
+                                            },
+                                            "loadBalancing": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "LeastRequests",
+                                                "LeastRequestsWithTieBreaker",
+                                                "LeastResponseTime",
+                                                "PerSiteRoundRobin",
+                                                "RequestHash",
+                                                "WeightedRoundRobin",
+                                                "WeightedTotalTraffic"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Site load balancing."
+                                              }
+                                            },
+                                            "localMySqlEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to enable local MySQL."
+                                              }
+                                            },
+                                            "logsDirectorySizeLimit": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. HTTP logs directory size limit."
+                                              }
+                                            },
+                                            "managedPipelineMode": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Classic",
+                                                "Integrated"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Managed pipeline mode."
+                                              }
+                                            },
+                                            "managedServiceIdentityId": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Managed Service Identity Id."
+                                              }
+                                            },
+                                            "metadata": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "name": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. Pair name."
+                                                    }
+                                                  },
+                                                  "value": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. Pair Value."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application metadata. This property cannot be retrieved, since it may contain secrets."
+                                              }
+                                            },
+                                            "minimumElasticInstanceCount": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "maxValue": 20,
+                                              "metadata": {
+                                                "description": "Optional. Number of minimum instance count for a site. This setting only applies to the Elastic Plans."
+                                              }
+                                            },
+                                            "minTlsCipherSuite": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "TLS_AES_128_GCM_SHA256",
+                                                "TLS_AES_256_GCM_SHA384",
+                                                "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+                                                "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                                                "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                                                "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                                                "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+                                                "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                                                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                                                "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                                                "TLS_RSA_WITH_AES_128_CBC_SHA",
+                                                "TLS_RSA_WITH_AES_128_CBC_SHA256",
+                                                "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                                                "TLS_RSA_WITH_AES_256_CBC_SHA",
+                                                "TLS_RSA_WITH_AES_256_CBC_SHA256",
+                                                "TLS_RSA_WITH_AES_256_GCM_SHA384"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The minimum strength TLS cipher suite allowed for an application."
+                                              }
+                                            },
+                                            "minTlsVersion": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "1.0",
+                                                "1.1",
+                                                "1.2",
+                                                "1.3"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. MinTlsVersion: configures the minimum version of TLS required for SSL requests."
+                                              }
+                                            },
+                                            "netFrameworkVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. .NET Framework version."
+                                              }
+                                            },
+                                            "nodeVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Version of Node.js."
+                                              }
+                                            },
+                                            "numberOfWorkers": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Number of workers."
+                                              }
+                                            },
+                                            "phpVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Version of PHP."
+                                              }
+                                            },
+                                            "powerShellVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Version of PowerShell."
+                                              }
+                                            },
+                                            "preWarmedInstanceCount": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "maxValue": 10,
+                                              "metadata": {
+                                                "description": "Optional. Number of preWarmed instances. This setting only applies to the Consumption and Elastic Plans."
+                                              }
+                                            },
+                                            "publicNetworkAccess": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Property to allow or block all public traffic."
+                                              }
+                                            },
+                                            "publishingUsername": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Publishing user name."
+                                              }
+                                            },
+                                            "push": {
+                                              "type": "object",
+                                              "properties": {
+                                                "kind": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Kind of resource."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "dynamicTagsJson": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                                      }
+                                                    },
+                                                    "isPushEnabled": {
+                                                      "type": "bool",
+                                                      "metadata": {
+                                                        "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                                      }
+                                                    },
+                                                    "tagsRequiringAuth": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                                      }
+                                                    },
+                                                    "tagWhitelistJson": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. PushSettings resource specific properties."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Push endpoint settings."
+                                              }
+                                            },
+                                            "pythonVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Version of Python."
+                                              }
+                                            },
+                                            "remoteDebuggingEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if remote debugging is enabled."
+                                              }
+                                            },
+                                            "remoteDebuggingVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Remote debugging version."
+                                              }
+                                            },
+                                            "requestTracingEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if request tracing is enabled."
+                                              }
+                                            },
+                                            "requestTracingExpirationTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Request tracing expiration time."
+                                              }
+                                            },
+                                            "scmIpSecurityRestrictions": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/scmIpSecurityRestrictionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. IP security restrictions for scm."
+                                              }
+                                            },
+                                            "scmIpSecurityRestrictionsDefaultAction": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Allow",
+                                                "Deny"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Default action for scm access restriction if no rules are matched."
+                                              }
+                                            },
+                                            "scmIpSecurityRestrictionsUseMain": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. IP security restrictions for scm to use main."
+                                              }
+                                            },
+                                            "scmMinTlsVersion": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "1.0",
+                                                "1.1",
+                                                "1.2",
+                                                "1.3"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. ScmMinTlsVersion: configures the minimum version of TLS required for SSL requests for SCM site."
+                                              }
+                                            },
+                                            "scmType": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "BitbucketGit",
+                                                "BitbucketHg",
+                                                "CodePlexGit",
+                                                "CodePlexHg",
+                                                "Dropbox",
+                                                "ExternalGit",
+                                                "ExternalHg",
+                                                "GitHub",
+                                                "LocalGit",
+                                                "None",
+                                                "OneDrive",
+                                                "Tfs",
+                                                "VSO",
+                                                "VSTSRM"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SCM type."
+                                              }
+                                            },
+                                            "tracingOptions": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tracing options."
+                                              }
+                                            },
+                                            "use32BitWorkerProcess": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to use 32-bit worker process."
+                                              }
+                                            },
+                                            "virtualApplications": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "physicalPath": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Physical path."
+                                                    }
+                                                  },
+                                                  "preloadEnabled": {
+                                                    "type": "bool",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Set to `true` if preloading is enabled."
+                                                    }
+                                                  },
+                                                  "virtualDirectories": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "physicalPath": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Physical path."
+                                                          }
+                                                        },
+                                                        "virtualPath": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Path to virtual application."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Virtual directories for virtual application."
+                                                    }
+                                                  },
+                                                  "virtualPath": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Virtual path."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Virtual applications."
+                                              }
+                                            },
+                                            "vnetName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Virtual Network name."
+                                              }
+                                            },
+                                            "vnetPrivatePortsCount": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The number of private ports assigned to this app. These will be assigned dynamically on runtime."
+                                              }
+                                            },
+                                            "vnetRouteAllEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+                                              }
+                                            },
+                                            "websiteTimeZone": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Sets the time zone a site uses for generating timestamps. Compatible with Linux and Windows App Service. Setting the WEBSITE_TIME_ZONE app setting takes precedence over this config. For Linux, expects tz database values https://www.iana.org/time-zones (for a quick reference see [ref](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)). For Windows, expects one of the time zones listed under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones."
+                                              }
+                                            },
+                                            "webSocketsEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if WebSocket is enabled."
+                                              }
+                                            },
+                                            "windowsFxVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Xenon App Framework and version."
+                                              }
+                                            },
+                                            "xManagedServiceIdentityId": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Explicit Managed Service Identity Id."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a web configuration."
+                                      }
+                                    },
+                                    "slowRequestBasedTriggerType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "count": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request Count."
+                                          }
+                                        },
+                                        "path": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request Path."
+                                          }
+                                        },
+                                        "timeInterval": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Time interval."
+                                          }
+                                        },
+                                        "timeTaken": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Time taken."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of aslow request based trigger."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "action": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Allow",
+                                            "Deny"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Allow or Deny access for this IP range."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. IP restriction rule description."
+                                          }
+                                        },
+                                        "headers": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "string"
+                                            },
+                                            "metadata": {
+                                              "description": "Required. A header."
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. IP restriction rule headers.\nX-Forwarded-Host (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), all hosts(or lack of) are allowed.\n- A value is compared using ordinal-ignore-case (excluding port number).\n- Subdomain wildcards are permitted but don't match the root domain. For example, *.contoso.com matches the subdomain foo.contoso.com\nbut not the root domain contoso.com or multi-level foo.bar.contoso.com\n- Unicode host names are allowed but are converted to Punycode for matching.\n\nX-Forwarded-For (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), any forwarded-for chains (or lack of) are allowed.\n- If any address (excluding port number) in the chain (comma separated) matches the CIDR defined by the property.\n\nX-Azure-FDID and X-FD-HealthProbe.\nThe matching logic is exact match."
+                                          }
+                                        },
+                                        "ipAddress": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. IP address the security restriction is valid for. It can be in form of pure ipv4 address (required SubnetMask property) or CIDR notation such as ipv4/mask (leading bit match). For CIDR, SubnetMask property must not be specified."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. IP restriction rule name."
+                                          }
+                                        },
+                                        "priority": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Priority of IP restriction rule."
+                                          }
+                                        },
+                                        "subnetMask": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Subnet mask for the range of IP addresses the restriction is valid for."
+                                          }
+                                        },
+                                        "subnetTrafficTag": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. (internal) Subnet traffic tag."
+                                          }
+                                        },
+                                        "tag": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Default",
+                                            "ServiceTag",
+                                            "XffProxy"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Defines what this IP filter will be used for. This is to support IP filtering on proxies."
+                                          }
+                                        },
+                                        "vnetSubnetResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Virtual network resource id."
+                                          }
+                                        },
+                                        "vnetTrafficTag": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. (internal) Vnet traffic tag."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a IP security restriction."
+                                      }
+                                    },
+                                    "basicPublishingCredentialsPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "ftp",
+                                            "scm"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The name of the resource."
+                                          }
+                                        },
+                                        "allow": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Location for all Resources."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a basic publishing credential policy."
+                                      }
+                                    },
+                                    "hybridConnectionRelayType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "hybridConnectionResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                          }
+                                        },
+                                        "sendKeyName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the authorization rule send key to use."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a hybrid connection relay."
+                                      }
+                                    },
+                                    "hostNameBindingType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Hostname in the hostname binding. Defaults to the host name of the app/slot if not specified."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "azureResourceName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Azure resource name."
+                                          }
+                                        },
+                                        "azureResourceType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "TrafficManager",
+                                            "Website"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                          }
+                                        },
+                                        "customHostNameDnsRecordType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "A",
+                                            "CName"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                          }
+                                        },
+                                        "domainResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Fully qualified ARM domain resource URI."
+                                          }
+                                        },
+                                        "hostNameType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Managed",
+                                            "Verified"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                          }
+                                        },
+                                        "siteName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. App Service app name."
+                                          }
+                                        },
+                                        "sslState": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Disabled",
+                                            "IpBasedEnabled",
+                                            "SniEnabled"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                          }
+                                        },
+                                        "thumbprint": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. SSL certificate thumbprint."
+                                          }
+                                        },
+                                        "certificate": {
+                                          "$ref": "#/definitions/certificateType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate creation properties. If specified, a certificate will be created and used for this hostname binding."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a host name binding."
+                                      }
+                                    },
+                                    "_1.privateEndpointCustomDnsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                          }
+                                        },
+                                        "ipAddresses": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of private IP addresses of the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointIpConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the resource that is unique within a resource group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "memberName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "privateIPAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of private endpoint IP configurations."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                                }
+                                              },
+                                              "privateDnsZoneResourceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of the private DNS zone."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "certificateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Certificate name."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource location."
+                                          }
+                                        },
+                                        "hostNames": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate host names."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault resource ID."
+                                          }
+                                        },
+                                        "keyVaultSecretName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault secret name."
+                                          }
+                                        },
+                                        "serverFarmResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Server farm resource ID."
+                                          }
+                                        },
+                                        "canonicalName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                          }
+                                        },
+                                        "password": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate password."
+                                          }
+                                        },
+                                        "pfxBlob": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate data in PFX format."
+                                          }
+                                        },
+                                        "domainValidationMethod": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Method of domain validation for free certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a certificate.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "../modules/certificate.bicep"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "managedIdentityAllType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "systemAssigned": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enables system assigned managed identity on the resource."
+                                          }
+                                        },
+                                        "userAssignedResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpointSingleServiceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private Endpoint."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The location to deploy the Private Endpoint to."
+                                          }
+                                        },
+                                        "privateLinkServiceConnectionName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private link connection to create."
+                                          }
+                                        },
+                                        "service": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                          }
+                                        },
+                                        "resourceGroupResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                          }
+                                        },
+                                        "privateDnsZoneGroup": {
+                                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                          }
+                                        },
+                                        "isManualConnection": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If Manual Private Link Connection is required."
+                                          }
+                                        },
+                                        "manualConnectionRequestMessage": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "maxLength": 140,
+                                          "metadata": {
+                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Custom DNS configurations."
+                                          }
+                                        },
+                                        "ipConfigurations": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                          }
+                                        },
+                                        "applicationSecurityGroupResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                          }
+                                        },
+                                        "customNetworkInterfaceName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                          }
+                                        },
+                                        "lock": {
+                                          "$ref": "#/definitions/lockType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                          }
+                                        },
+                                        "enableTelemetry": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable/Disable usage telemetry for module."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the slot."
+                                      }
+                                    },
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "functionapp",
+                                        "functionapp,linux",
+                                        "functionapp,workflowapp",
+                                        "functionapp,workflowapp,linux",
+                                        "functionapp,linux,container",
+                                        "functionapp,linux,container,azurecontainerapps",
+                                        "app,linux",
+                                        "app",
+                                        "linux,api",
+                                        "api",
+                                        "app,linux,container",
+                                        "app,container,windows"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Type of site to deploy."
+                                      }
+                                    },
+                                    "serverFarmResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the app service plan to use for the slot."
+                                      }
+                                    },
+                                    "managedEnvironmentResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                                      }
+                                    },
+                                    "httpsOnly": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
+                                      }
+                                    },
+                                    "clientAffinityEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. If client affinity is enabled."
+                                      }
+                                    },
+                                    "clientAffinityProxyEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance. Default is true."
+                                      }
+                                    },
+                                    "clientAffinityPartitioningEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. To enable client affinity partitioning using CHIPS cookies, this will add the partitioned property to the affinity cookies; false to stop sending partitioned affinity cookies. Default is false."
+                                      }
+                                    },
+                                    "appServiceEnvironmentResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the app service environment to use for this resource."
+                                      }
+                                    },
+                                    "managedIdentities": {
+                                      "$ref": "#/definitions/managedIdentityAllType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity definition for this resource."
+                                      }
+                                    },
+                                    "keyVaultAccessIdentityResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                                      }
+                                    },
+                                    "storageAccountRequired": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Checks if Customer provided storage account is required."
+                                      }
+                                    },
+                                    "virtualNetworkSubnetResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                                      }
+                                    },
+                                    "siteConfig": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/siteConfig"
+                                        },
+                                        "description": "Optional. The site config object."
+                                      },
+                                      "defaultValue": {
+                                        "alwaysOn": true
+                                      }
+                                    },
+                                    "functionAppConfig": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/functionAppConfig"
+                                        },
+                                        "description": "Optional. The Function App config object."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "configs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/configType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The web site config."
+                                      }
+                                    },
+                                    "extensions": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The extensions configuration."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration details for private endpoints."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    },
+                                    "clientCertEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                                      }
+                                    },
+                                    "clientCertExclusionPaths": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                                      }
+                                    },
+                                    "clientCertMode": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/clientCertMode"
+                                        },
+                                        "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
+                                      },
+                                      "defaultValue": "Optional"
+                                    },
+                                    "cloningInfo": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/cloningInfo"
+                                        },
+                                        "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "containerSize": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Size of the function container."
+                                      }
+                                    },
+                                    "customDomainVerificationId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                                      }
+                                    },
+                                    "dailyMemoryTimeQuota": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                                      }
+                                    },
+                                    "hostNameSslStates": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/hostNameSslStates"
+                                        },
+                                        "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "hyperV": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Hyper-V sandbox."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                                        },
+                                        "description": "Optional. Allow or block all public traffic."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "redundancyMode": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/redundancyMode"
+                                        },
+                                        "description": "Optional. Site redundancy mode."
+                                      },
+                                      "defaultValue": "None"
+                                    },
+                                    "basicPublishingCredentialsPolicies": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The site publishing credential policy names which are associated with the site slot."
+                                      }
+                                    },
+                                    "outboundVnetRouting": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                                        },
+                                        "description": "Optional. The outbound VNET routing configuration for the site."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "hybridConnectionRelays": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/hybridConnectionRelayType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Names of hybrid connection relays to connect app with."
+                                      }
+                                    },
+                                    "hostNameBindings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/hostNameBindingType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Host Name Bindings for the slot."
+                                      }
+                                    },
+                                    "dnsConfiguration": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/dnsConfiguration"
+                                        },
+                                        "description": "Optional. Property to configure various DNS related settings for a site."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "autoGeneratedDomainNameLabelScope": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                                        },
+                                        "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "sshEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether to enable SSH access."
+                                      }
+                                    },
+                                    "daprConfig": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/daprConfig"
+                                        },
+                                        "description": "Optional. Dapr configuration of the app."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipMode": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/ipMode"
+                                        },
+                                        "description": "Optional. Specifies the IP mode of the app."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "resourceConfig": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/resourceConfig"
+                                        },
+                                        "description": "Optional. Function app resource requirements."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "workloadProfileName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Workload profile name for function app to execute on."
+                                      }
+                                    },
+                                    "hostNamesDisabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                                      }
+                                    },
+                                    "reserved": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                                      }
+                                    },
+                                    "scmSiteAlsoStopped": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                                      }
+                                    },
+                                    "e2eEncryptionEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. End to End Encryption Setting."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "enableReferencedModulesTelemetry": false,
+                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                                    "builtInRoleNames": {
+                                      "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                                      "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                                      "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                                    },
+                                    "managedEnvironmentSupportedKinds": [
+                                      "functionapp,linux,container,azurecontainerapps"
+                                    ]
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-siteslot.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "slot": {
+                                      "type": "Microsoft.Web/sites/slots",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "kind": "[parameters('kind')]",
+                                      "tags": "[parameters('tags')]",
+                                      "identity": "[variables('identity')]",
+                                      "properties": {
+                                        "managedEnvironmentId": "[if(not(empty(parameters('managedEnvironmentResourceId'))), parameters('managedEnvironmentResourceId'), null())]",
+                                        "serverFarmId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), or(not(empty(reference('app').managedEnvironmentId)), not(empty(parameters('managedEnvironmentResourceId'))))), null(), parameters('serverFarmResourceId'))]",
+                                        "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
+                                        "clientAffinityProxyEnabled": "[parameters('clientAffinityProxyEnabled')]",
+                                        "clientAffinityPartitioningEnabled": "[parameters('clientAffinityPartitioningEnabled')]",
+                                        "httpsOnly": "[parameters('httpsOnly')]",
+                                        "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                                        "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                                        "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                                        "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]",
+                                        "siteConfig": "[parameters('siteConfig')]",
+                                        "functionAppConfig": "[parameters('functionAppConfig')]",
+                                        "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                                        "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                                        "clientCertMode": "[parameters('clientCertMode')]",
+                                        "cloningInfo": "[parameters('cloningInfo')]",
+                                        "containerSize": "[parameters('containerSize')]",
+                                        "customDomainVerificationId": "[parameters('customDomainVerificationId')]",
+                                        "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                                        "enabled": "[parameters('enabled')]",
+                                        "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                                        "hyperV": "[parameters('hyperV')]",
+                                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                                        "redundancyMode": "[parameters('redundancyMode')]",
+                                        "dnsConfiguration": "[parameters('dnsConfiguration')]",
+                                        "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                                        "outboundVnetRouting": "[parameters('outboundVnetRouting')]",
+                                        "sshEnabled": "[parameters('sshEnabled')]",
+                                        "daprConfig": "[parameters('daprConfig')]",
+                                        "ipMode": "[parameters('ipMode')]",
+                                        "resourceConfig": "[parameters('resourceConfig')]",
+                                        "workloadProfileName": "[parameters('workloadProfileName')]",
+                                        "hostNamesDisabled": "[parameters('hostNamesDisabled')]",
+                                        "reserved": "[parameters('reserved')]",
+                                        "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
+                                        "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]"
+                                      },
+                                      "dependsOn": [
+                                        "app"
+                                      ]
+                                    },
+                                    "slot_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "slot_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_roleAssignments": {
+                                      "copy": {
+                                        "name": "slot_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_basicPublishingCredentialsPolicies": {
+                                      "copy": {
+                                        "name": "slot_basicPublishingCredentialsPolicies",
+                                        "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                                          },
+                                          "allow": {
+                                            "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "11365254968018384105"
+                                            },
+                                            "name": "Web Site Slot Basic Publishing Credentials Policies",
+                                            "description": "This module deploys a Web Site Slot Basic Publishing Credentials Policy."
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "scm",
+                                                "ftp"
+                                              ],
+                                              "metadata": {
+                                                "description": "Required. The name of the resource."
+                                              }
+                                            },
+                                            "allow": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                              }
+                                            },
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all Resources."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.web-site-slotbasicpubcredpolicy.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            {
+                                              "type": "Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                              "location": "[parameters('location')]",
+                                              "properties": {
+                                                "allow": "[parameters('allow')]"
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the basic publishing credential policy."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the basic publishing credential policy."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference(resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name')), '2025-03-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_hybridConnectionRelays": {
+                                      "copy": {
+                                        "name": "slot_hybridConnectionRelays",
+                                        "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "hybridConnectionResourceId": {
+                                            "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].hybridConnectionResourceId]"
+                                          },
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "sendKeyName": {
+                                            "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "8029912709642202991"
+                                            },
+                                            "name": "Web/Function Apps Slot Hybrid Connection Relay",
+                                            "description": "This module deploys a Site Slot Hybrid Connection Namespace Relay."
+                                          },
+                                          "parameters": {
+                                            "hybridConnectionResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "sendKeyName": {
+                                              "type": "string",
+                                              "defaultValue": "defaultSender",
+                                              "metadata": {
+                                                "description": "Optional. Name of the authorization rule send key to use."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.web-site-slothybconnnamespacerelay.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            {
+                                              "type": "Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                              "properties": {
+                                                "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                                                "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                                                "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                                                "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                                "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[0]]",
+                                                "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[1])]",
+                                                "sendKeyName": "[parameters('sendKeyName')]",
+                                                "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2024-01-01').primaryKey]"
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the hybrid connection relay.."
+                                              },
+                                              "value": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the hybrid connection relay."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[3])]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the resource was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_hostNameBindings": {
+                                      "copy": {
+                                        "name": "slot_hostNameBindings",
+                                        "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-HostNameBinding-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'name'), reference('slot').defaultHostName)]"
+                                          },
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "kind": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'kind')]"
+                                          },
+                                          "azureResourceName": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceName')]"
+                                          },
+                                          "azureResourceType": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceType')]"
+                                          },
+                                          "customHostNameDnsRecordType": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'customHostNameDnsRecordType')]"
+                                          },
+                                          "domainResourceId": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'domainResourceId')]"
+                                          },
+                                          "hostNameType": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'hostNameType')]"
+                                          },
+                                          "siteName": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'siteName')]"
+                                          },
+                                          "sslState": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'sslState')]"
+                                          },
+                                          "thumbprint": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'thumbprint')]"
+                                          },
+                                          "certificate": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'certificate')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "16648305975161016120"
+                                            },
+                                            "name": "Web/Function Apps Slot Host Name Bindings",
+                                            "description": "This module deploys a Site Slot Host Name Binding."
+                                          },
+                                          "definitions": {
+                                            "certificateType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. Certificate name."
+                                                  }
+                                                },
+                                                "location": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource location."
+                                                  }
+                                                },
+                                                "hostNames": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate host names."
+                                                  }
+                                                },
+                                                "tags": {
+                                                  "type": "object",
+                                                  "metadata": {
+                                                    "__bicep_resource_derived_type!": {
+                                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                    },
+                                                    "description": "Optional. Tags of the resource."
+                                                  },
+                                                  "nullable": true
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Kind of resource."
+                                                  }
+                                                },
+                                                "keyVaultResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault resource ID."
+                                                  }
+                                                },
+                                                "keyVaultSecretName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault secret name."
+                                                  }
+                                                },
+                                                "serverFarmResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Server farm resource ID."
+                                                  }
+                                                },
+                                                "canonicalName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                  }
+                                                },
+                                                "password": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate password."
+                                                  }
+                                                },
+                                                "pfxBlob": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate data in PFX format."
+                                                  }
+                                                },
+                                                "domainValidationMethod": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Method of domain validation for free certificate."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "The type of a certificate.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "../../modules/certificate.bicep"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Hostname in the hostname binding."
+                                              }
+                                            },
+                                            "kind": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Kind of resource."
+                                              }
+                                            },
+                                            "azureResourceName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Azure resource name."
+                                              }
+                                            },
+                                            "azureResourceType": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "Website",
+                                                "TrafficManager"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                              }
+                                            },
+                                            "customHostNameDnsRecordType": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "CName",
+                                                "A"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                              }
+                                            },
+                                            "domainResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Fully qualified ARM domain resource URI."
+                                              }
+                                            },
+                                            "hostNameType": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "Verified",
+                                                "Managed"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                              }
+                                            },
+                                            "siteName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. App Service app name."
+                                              }
+                                            },
+                                            "sslState": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "Disabled",
+                                                "SniEnabled",
+                                                "IpBasedEnabled"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                              }
+                                            },
+                                            "thumbprint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SSL certificate thumbprint."
+                                              }
+                                            },
+                                            "certificate": {
+                                              "$ref": "#/definitions/certificateType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate object with properties for certificate creation. The expected structure matches the certificateType defined in host-name-binding-type.bicep."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Resource location."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "app::slot": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites/slots",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                            },
+                                            "app": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('appName')]"
+                                            },
+                                            "hostNameBinding": {
+                                              "type": "Microsoft.Web/sites/slots/hostNameBindings",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                              "kind": "[parameters('kind')]",
+                                              "properties": {
+                                                "azureResourceName": "[parameters('azureResourceName')]",
+                                                "azureResourceType": "[parameters('azureResourceType')]",
+                                                "customHostNameDnsRecordType": "[parameters('customHostNameDnsRecordType')]",
+                                                "domainId": "[parameters('domainResourceId')]",
+                                                "hostNameType": "[parameters('hostNameType')]",
+                                                "siteName": "[parameters('siteName')]",
+                                                "sslState": "[coalesce(parameters('sslState'), if(or(not(empty(parameters('thumbprint'))), not(empty(parameters('certificate')))), 'SniEnabled', null()))]",
+                                                "thumbprint": "[coalesce(parameters('thumbprint'), tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value'))]"
+                                              },
+                                              "dependsOn": [
+                                                "sslCertificate"
+                                              ]
+                                            },
+                                            "sslCertificate": {
+                                              "condition": "[not(empty(parameters('certificate')))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('{0}-Cert', uniqueString(deployment().name, parameters('location')))]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', replace(parameters('name'), '.', '-')))]"
+                                                  },
+                                                  "location": {
+                                                    "value": "[parameters('location')]"
+                                                  },
+                                                  "kind": {
+                                                    "value": "[parameters('kind')]"
+                                                  },
+                                                  "hostNames": {
+                                                    "value": "[coalesce(tryGet(parameters('certificate'), 'hostNames'), createArray(parameters('name')))]"
+                                                  },
+                                                  "password": {
+                                                    "value": "[tryGet(parameters('certificate'), 'password')]"
+                                                  },
+                                                  "pfxBlob": {
+                                                    "value": "[tryGet(parameters('certificate'), 'pfxBlob')]"
+                                                  },
+                                                  "serverFarmResourceId": {
+                                                    "value": "[tryGet(parameters('certificate'), 'serverFarmResourceId')]"
+                                                  },
+                                                  "keyVaultResourceId": {
+                                                    "value": "[tryGet(parameters('certificate'), 'keyVaultResourceId')]"
+                                                  },
+                                                  "keyVaultSecretName": {
+                                                    "value": "[tryGet(parameters('certificate'), 'keyVaultSecretName')]"
+                                                  },
+                                                  "canonicalName": {
+                                                    "value": "[tryGet(parameters('certificate'), 'canonicalName')]"
+                                                  },
+                                                  "domainValidationMethod": {
+                                                    "value": "[tryGet(parameters('certificate'), 'domainValidationMethod')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.43.8.12551",
+                                                      "templateHash": "5581960621773069173"
+                                                    },
+                                                    "name": "Web/Function Apps Certificates",
+                                                    "description": "This module deploys a Web/Function App Certificate."
+                                                  },
+                                                  "definitions": {
+                                                    "certificateType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. Certificate name."
+                                                          }
+                                                        },
+                                                        "location": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Resource location."
+                                                          }
+                                                        },
+                                                        "hostNames": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Certificate host names."
+                                                          }
+                                                        },
+                                                        "tags": {
+                                                          "type": "object",
+                                                          "metadata": {
+                                                            "__bicep_resource_derived_type!": {
+                                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                            },
+                                                            "description": "Optional. Tags of the resource."
+                                                          },
+                                                          "nullable": true
+                                                        },
+                                                        "kind": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Kind of resource."
+                                                          }
+                                                        },
+                                                        "keyVaultResourceId": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Key Vault resource ID."
+                                                          }
+                                                        },
+                                                        "keyVaultSecretName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Key Vault secret name."
+                                                          }
+                                                        },
+                                                        "serverFarmResourceId": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Server farm resource ID."
+                                                          }
+                                                        },
+                                                        "canonicalName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                          }
+                                                        },
+                                                        "password": {
+                                                          "type": "securestring",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Certificate password."
+                                                          }
+                                                        },
+                                                        "pfxBlob": {
+                                                          "type": "securestring",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Certificate data in PFX format."
+                                                          }
+                                                        },
+                                                        "domainValidationMethod": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Method of domain validation for free certificate."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true,
+                                                        "description": "The type of a certificate."
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. Certificate name."
+                                                      }
+                                                    },
+                                                    "location": {
+                                                      "type": "string",
+                                                      "defaultValue": "[resourceGroup().location]",
+                                                      "metadata": {
+                                                        "description": "Optional. Resource location."
+                                                      }
+                                                    },
+                                                    "hostNames": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Certificate host names."
+                                                      }
+                                                    },
+                                                    "tags": {
+                                                      "type": "object",
+                                                      "metadata": {
+                                                        "__bicep_resource_derived_type!": {
+                                                          "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                        },
+                                                        "description": "Optional. Tags of the resource."
+                                                      },
+                                                      "nullable": true
+                                                    },
+                                                    "kind": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Kind of resource."
+                                                      }
+                                                    },
+                                                    "keyVaultResourceId": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Key Vault resource ID."
+                                                      }
+                                                    },
+                                                    "keyVaultSecretName": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Key Vault secret name."
+                                                      }
+                                                    },
+                                                    "serverFarmResourceId": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Server farm resource ID."
+                                                      }
+                                                    },
+                                                    "canonicalName": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                      }
+                                                    },
+                                                    "password": {
+                                                      "type": "securestring",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Certificate password."
+                                                      }
+                                                    },
+                                                    "pfxBlob": {
+                                                      "type": "securestring",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Certificate data in PFX format."
+                                                      }
+                                                    },
+                                                    "domainValidationMethod": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Method of domain validation for free certificate."
+                                                      }
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "certificate": {
+                                                      "type": "Microsoft.Web/certificates",
+                                                      "apiVersion": "2024-11-01",
+                                                      "name": "[parameters('name')]",
+                                                      "location": "[parameters('location')]",
+                                                      "kind": "[parameters('kind')]",
+                                                      "tags": "[parameters('tags')]",
+                                                      "properties": {
+                                                        "hostNames": "[parameters('hostNames')]",
+                                                        "password": "[parameters('password')]",
+                                                        "pfxBlob": "[parameters('pfxBlob')]",
+                                                        "serverFarmId": "[parameters('serverFarmResourceId')]",
+                                                        "keyVaultId": "[parameters('keyVaultResourceId')]",
+                                                        "keyVaultSecretName": "[parameters('keyVaultSecretName')]",
+                                                        "canonicalName": "[parameters('canonicalName')]",
+                                                        "domainValidationMethod": "[parameters('domainValidationMethod')]"
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the certificate."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Web/certificates', parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group the certificate was deployed into."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the certificate."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "thumbprint": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The thumbprint of the certificate."
+                                                      },
+                                                      "value": "[reference('certificate').thumbprint]"
+                                                    },
+                                                    "location": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The location the resource was deployed into."
+                                                      },
+                                                      "value": "[reference('certificate', '2024-11-01', 'full').location]"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the host name binding."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the host name binding."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/hostNameBindings', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the resource was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "certificateThumbprint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The thumbprint of the certificate."
+                                              },
+                                              "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value')]"
+                                            },
+                                            "certificateResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The resource ID of the certificate."
+                                              },
+                                              "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'resourceId'), 'value')]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_config": {
+                                      "copy": {
+                                        "name": "slot_config",
+                                        "count": "[length(coalesce(parameters('configs'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "applicationInsightResourceId": {
+                                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                                          },
+                                          "properties": {
+                                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                                          },
+                                          "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]",
+                                          "storageAccountResourceId": {
+                                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountResourceId')]"
+                                          },
+                                          "storageAccountUseIdentityAuthentication": {
+                                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "12001043390442225147"
+                                            },
+                                            "name": "Site App Settings",
+                                            "description": "This module deploys a Site App Setting."
+                                          },
+                                          "parameters": {
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "appsettings",
+                                                "authsettings",
+                                                "authsettingsV2",
+                                                "azurestorageaccounts",
+                                                "backup",
+                                                "connectionstrings",
+                                                "logs",
+                                                "metadata",
+                                                "pushsettings",
+                                                "web"
+                                              ],
+                                              "metadata": {
+                                                "description": "Required. The name of the config."
+                                              }
+                                            },
+                                            "properties": {
+                                              "type": "object",
+                                              "defaultValue": {},
+                                              "metadata": {
+                                                "description": "Optional. The properties of the config. Note: This parameter is highly dependent on the config type, defined by its name."
+                                              }
+                                            },
+                                            "currentAppSettings": {
+                                              "type": "object",
+                                              "properties": {},
+                                              "additionalProperties": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The key-values pairs of the current app settings."
+                                                }
+                                              },
+                                              "defaultValue": {},
+                                              "metadata": {
+                                                "description": "Optional. The current app settings."
+                                              }
+                                            },
+                                            "storageAccountUseIdentityAuthentication": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                              }
+                                            },
+                                            "storageAccountResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                              }
+                                            },
+                                            "applicationInsightResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "app::slot": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites/slots",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                            },
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.web-site-slotconfig.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "applicationInsights": {
+                                              "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
+                                              "existing": true,
+                                              "type": "Microsoft.Insights/components",
+                                              "apiVersion": "2020-02-02",
+                                              "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
+                                              "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
+                                              "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
+                                            },
+                                            "storageAccount": {
+                                              "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2025-01-01",
+                                              "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                                              "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                            },
+                                            "app": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[parameters('appName')]"
+                                            },
+                                            "config": {
+                                              "type": "Microsoft.Web/sites/slots/config",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                              "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys('storageAccount', '2025-01-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/')), 'AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob, 'AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue, 'AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table), createObject())), if(not(empty(parameters('applicationInsightResourceId'))), shallowMerge(createArray(createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), if(not(contains(parameters('properties'), 'ApplicationInsightsAgent_EXTENSION_VERSION')), createObject('ApplicationInsightsAgent_EXTENSION_VERSION', if(contains(createArray('functionapp,linux', 'functionapp,workflowapp,linux', 'functionapp,linux,container', 'functionapp,linux,container,azurecontainerapps', 'app,linux', 'linux,api', 'app,linux,container'), reference('app::slot', '2025-03-01', 'full').kind), '~3', '~2')), createObject()))), createObject()))]",
+                                              "dependsOn": [
+                                                "app::slot",
+                                                "applicationInsights",
+                                                "storageAccount"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the site config."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the site config."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/config', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the site config was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "app_extensions": {
+                                      "copy": {
+                                        "name": "app_extensions",
+                                        "count": "[length(coalesce(parameters('extensions'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-Extension={1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[tryGet(coalesce(parameters('extensions'), createArray())[copyIndex()], 'name')]"
+                                          },
+                                          "kind": {
+                                            "value": "[tryGet(coalesce(parameters('extensions'), createArray())[copyIndex()], 'kind')]"
+                                          },
+                                          "properties": {
+                                            "value": "[coalesce(parameters('extensions'), createArray())[copyIndex()].properties]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "8496500083519229596"
+                                            },
+                                            "name": "Site Deployment Extension ",
+                                            "description": "This module deploys a Site extension for MSDeploy."
+                                          },
+                                          "parameters": {
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "MSDeploy",
+                                              "allowedValues": [
+                                                "MSDeploy"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. The name of the extension."
+                                              }
+                                            },
+                                            "kind": {
+                                              "type": "string",
+                                              "defaultValue": "MSDeploy",
+                                              "allowedValues": [
+                                                "MSDeploy"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. The kind of extension."
+                                              }
+                                            },
+                                            "properties": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Web/sites/extensions@2024-04-01#properties/properties"
+                                                },
+                                                "description": "Optional. Sets the properties."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "app::slot": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites/slots",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                            },
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.web-site-slotextension.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "app": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[parameters('appName')]"
+                                            },
+                                            "msdeploy": {
+                                              "type": "Microsoft.Web/sites/slots/extensions",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                              "kind": "[parameters('kind')]",
+                                              "properties": "[parameters('properties')]"
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the extension."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the extension."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/extensions', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the extensino was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_privateEndpoints": {
+                                      "copy": {
+                                        "name": "slot_privateEndpoints",
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-slot-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex()))]"
+                                          },
+                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))))))), createObject('value', null()))]",
+                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                          "subnetResourceId": {
+                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          },
+                                          "location": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                          },
+                                          "lock": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                          },
+                                          "privateDnsZoneGroup": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "customDnsConfigs": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                          },
+                                          "applicationSecurityGroupResourceIds": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                          },
+                                          "customNetworkInterfaceName": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "18436885663402767850"
+                                            },
+                                            "name": "Private Endpoints",
+                                            "description": "This module deploys a Private Endpoint."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                                  }
+                                                },
+                                                "privateDnsZoneGroupConfigs": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private dns zone group."
+                                              }
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                },
+                                                "notes": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the notes of the lock."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a lock.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                                }
+                                              }
+                                            },
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "The type of a private DNS zone group configuration.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the private endpoint resource to create."
+                                              }
+                                            },
+                                            "subnetResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                              }
+                                            },
+                                            "applicationSecurityGroupResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                              }
+                                            },
+                                            "customNetworkInterfaceName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                                },
+                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "ipVersionType": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                                },
+                                                "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                                              },
+                                              "defaultValue": "IPv4"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all Resources."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                                },
+                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                                },
+                                                "description": "Optional. Custom DNS configurations."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "manualPrivateLinkServiceConnections": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                                },
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "privateLinkServiceConnections": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                                },
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint": {
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "applicationSecurityGroups",
+                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                                    "input": {
+                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                                    }
+                                                  }
+                                                ],
+                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                                "subnet": {
+                                                  "id": "[parameters('subnetResourceId')]"
+                                                },
+                                                "ipVersionType": "[parameters('ipVersionType')]"
+                                              }
+                                            },
+                                            "privateEndpoint_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_roleAssignments": {
+                                              "copy": {
+                                                "name": "privateEndpoint_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_privateDnsZoneGroup": {
+                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                                  },
+                                                  "privateEndpointName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "privateDnsZoneConfigs": {
+                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.41.2.15936",
+                                                      "templateHash": "9935179114830442414"
+                                                    },
+                                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                                  },
+                                                  "definitions": {
+                                                    "privateDnsZoneGroupConfigType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name of the private DNS zone group config."
+                                                          }
+                                                        },
+                                                        "privateDnsZoneResourceId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The resource id of the private DNS zone."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true,
+                                                        "description": "The type of a private DNS zone group configuration."
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "privateEndpointName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "privateDnsZoneConfigs": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                      },
+                                                      "minLength": 1,
+                                                      "maxLength": 5,
+                                                      "metadata": {
+                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "defaultValue": "default",
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the private DNS zone group."
+                                                      }
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "privateEndpoint": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Network/privateEndpoints",
+                                                      "apiVersion": "2025-05-01",
+                                                      "name": "[parameters('privateEndpointName')]"
+                                                    },
+                                                    "privateDnsZoneGroup": {
+                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                                      "apiVersion": "2025-05-01",
+                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "copy": [
+                                                          {
+                                                            "name": "privateDnsZoneConfigs",
+                                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                            "input": {
+                                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                              "properties": {
+                                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                              }
+                                                            }
+                                                          }
+                                                        ]
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                                  "output": true
+                                                },
+                                                "description": "The custom DNS configurations of the private endpoint."
+                                              },
+                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                            },
+                                            "networkInterfaceResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "metadata": {
+                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                              },
+                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                            },
+                                            "groupId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The group Id for the private endpoint Group."
+                                              },
+                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the slot."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the slot."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the slot was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "systemAssignedMIPrincipalId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The principal ID of the system assigned identity."
+                                      },
+                                      "value": "[tryGet(tryGet(reference('slot', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('slot', '2025-03-01', 'full').location]"
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The private endpoints of the slot."
+                                      },
+                                      "copy": {
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                        "input": {
+                                          "name": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                          "resourceId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                          "groupId": "[tryGet(tryGet(reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                          "customDnsConfigs": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                          "networkInterfaceResourceIds": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                        }
+                                      }
+                                    },
+                                    "hostNameBindings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/hostNameBindingsOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The host name bindings of the slot."
+                                      },
+                                      "copy": {
+                                        "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]",
+                                        "input": {
+                                          "name": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.name.value]",
+                                          "resourceId": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.resourceId.value]",
+                                          "resourceGroupName": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.resourceGroupName.value]",
+                                          "certificateThumbprint": "[tryGet(tryGet(reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateThumbprint'), 'value')]",
+                                          "certificateResourceId": "[tryGet(tryGet(reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateResourceId'), 'value')]"
+                                        }
+                                      }
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_basicPublishingCredentialsPolicies": {
+                              "copy": {
+                                "name": "app_basicPublishingCredentialsPolicies",
+                                "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Site-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "webAppName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                                  },
+                                  "allow": {
+                                    "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "14948693817081044849"
+                                    },
+                                    "name": "Web Site Basic Publishing Credentials Policies",
+                                    "description": "This module deploys a Web Site Basic Publishing Credentials Policy."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "scm",
+                                        "ftp"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The name of the resource."
+                                      }
+                                    },
+                                    "allow": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                      }
+                                    },
+                                    "webAppName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-basicpublishingcredpolicy.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('webAppName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "properties": {
+                                        "allow": "[parameters('allow')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the basic publishing credential policy."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the basic publishing credential policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference(resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name')), '2025-03-01', 'full').location]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_hybridConnectionRelays": {
+                              "copy": {
+                                "name": "app_hybridConnectionRelays",
+                                "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "hybridConnectionResourceId": {
+                                    "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].hybridConnectionResourceId]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "sendKeyName": {
+                                    "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "16409478718621567661"
+                                    },
+                                    "name": "Web/Function Apps Hybrid Connection Relay",
+                                    "description": "This module deploys a Site Hybrid Connection Namespace Relay."
+                                  },
+                                  "parameters": {
+                                    "hybridConnectionResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                      }
+                                    },
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "sendKeyName": {
+                                      "type": "string",
+                                      "defaultValue": "defaultSender",
+                                      "metadata": {
+                                        "description": "Optional. Name of the authorization rule send key to use."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-hybconnnamespacerelay.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Web/sites/hybridConnectionNamespaces/relays",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                      "properties": {
+                                        "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                                        "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                                        "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                                        "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                        "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[0]]",
+                                        "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[1])]",
+                                        "sendKeyName": "[parameters('sendKeyName')]",
+                                        "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2024-01-01').primaryKey]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the hybrid connection relay.."
+                                      },
+                                      "value": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the hybrid connection relay."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2])]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the resource was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_hostNameBindings": {
+                              "copy": {
+                                "name": "app_hostNameBindings",
+                                "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-HostNameBinding-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'name'), reference('app').defaultHostName)]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "kind": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'kind')]"
+                                  },
+                                  "azureResourceName": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceName')]"
+                                  },
+                                  "azureResourceType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceType')]"
+                                  },
+                                  "customHostNameDnsRecordType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'customHostNameDnsRecordType')]"
+                                  },
+                                  "domainResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'domainResourceId')]"
+                                  },
+                                  "hostNameType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'hostNameType')]"
+                                  },
+                                  "siteName": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'siteName')]"
+                                  },
+                                  "sslState": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'sslState')]"
+                                  },
+                                  "thumbprint": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'thumbprint')]"
+                                  },
+                                  "certificate": "[if(contains(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'certificate'), createObject('value', union(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()].certificate, createObject('serverFarmResourceId', coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()].certificate, 'serverFarmResourceId'), parameters('serverFarmResourceId'))))), createObject('value', null()))]",
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "3602988070549748557"
+                                    },
+                                    "name": "Web/Function Apps Slot Host Name Bindings",
+                                    "description": "This module deploys a Site Slot Host Name Binding."
+                                  },
+                                  "definitions": {
+                                    "certificateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Certificate name."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource location."
+                                          }
+                                        },
+                                        "hostNames": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate host names."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault resource ID."
+                                          }
+                                        },
+                                        "keyVaultSecretName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault secret name."
+                                          }
+                                        },
+                                        "serverFarmResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Server farm resource ID."
+                                          }
+                                        },
+                                        "canonicalName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                          }
+                                        },
+                                        "password": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate password."
+                                          }
+                                        },
+                                        "pfxBlob": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate data in PFX format."
+                                          }
+                                        },
+                                        "domainValidationMethod": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Method of domain validation for free certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a certificate.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "../modules/certificate.bicep"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Hostname in the hostname binding."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Kind of resource."
+                                      }
+                                    },
+                                    "azureResourceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure resource name."
+                                      }
+                                    },
+                                    "azureResourceType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Website",
+                                        "TrafficManager"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                      }
+                                    },
+                                    "customHostNameDnsRecordType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "CName",
+                                        "A"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                      }
+                                    },
+                                    "domainResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Fully qualified ARM domain resource URI."
+                                      }
+                                    },
+                                    "hostNameType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Verified",
+                                        "Managed"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                      }
+                                    },
+                                    "siteName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. App Service app name."
+                                      }
+                                    },
+                                    "sslState": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "SniEnabled",
+                                        "IpBasedEnabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                      }
+                                    },
+                                    "thumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SSL certificate thumbprint."
+                                      }
+                                    },
+                                    "certificate": {
+                                      "$ref": "#/definitions/certificateType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate object with properties for certificate creation. The expected structure matches the certificateType defined in host-name-binding-type.bicep."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Resource location."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "hostNameBinding": {
+                                      "type": "Microsoft.Web/sites/hostNameBindings",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                                      "kind": "[parameters('kind')]",
+                                      "properties": {
+                                        "azureResourceName": "[parameters('azureResourceName')]",
+                                        "azureResourceType": "[parameters('azureResourceType')]",
+                                        "customHostNameDnsRecordType": "[parameters('customHostNameDnsRecordType')]",
+                                        "domainId": "[parameters('domainResourceId')]",
+                                        "hostNameType": "[parameters('hostNameType')]",
+                                        "siteName": "[parameters('siteName')]",
+                                        "sslState": "[coalesce(parameters('sslState'), if(or(not(empty(parameters('thumbprint'))), not(empty(parameters('certificate')))), 'SniEnabled', null()))]",
+                                        "thumbprint": "[coalesce(parameters('thumbprint'), tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value'))]"
+                                      },
+                                      "dependsOn": [
+                                        "sslCertificate"
+                                      ]
+                                    },
+                                    "sslCertificate": {
+                                      "condition": "[not(empty(parameters('certificate')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Cert', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', replace(parameters('name'), '.', '-')))]"
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "kind": {
+                                            "value": "[parameters('kind')]"
+                                          },
+                                          "hostNames": {
+                                            "value": "[coalesce(tryGet(parameters('certificate'), 'hostNames'), createArray(parameters('name')))]"
+                                          },
+                                          "password": {
+                                            "value": "[tryGet(parameters('certificate'), 'password')]"
+                                          },
+                                          "pfxBlob": {
+                                            "value": "[tryGet(parameters('certificate'), 'pfxBlob')]"
+                                          },
+                                          "serverFarmResourceId": {
+                                            "value": "[tryGet(parameters('certificate'), 'serverFarmResourceId')]"
+                                          },
+                                          "keyVaultResourceId": {
+                                            "value": "[tryGet(parameters('certificate'), 'keyVaultResourceId')]"
+                                          },
+                                          "keyVaultSecretName": {
+                                            "value": "[tryGet(parameters('certificate'), 'keyVaultSecretName')]"
+                                          },
+                                          "canonicalName": {
+                                            "value": "[tryGet(parameters('certificate'), 'canonicalName')]"
+                                          },
+                                          "domainValidationMethod": {
+                                            "value": "[tryGet(parameters('certificate'), 'domainValidationMethod')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "5581960621773069173"
+                                            },
+                                            "name": "Web/Function Apps Certificates",
+                                            "description": "This module deploys a Web/Function App Certificate."
+                                          },
+                                          "definitions": {
+                                            "certificateType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. Certificate name."
+                                                  }
+                                                },
+                                                "location": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource location."
+                                                  }
+                                                },
+                                                "hostNames": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate host names."
+                                                  }
+                                                },
+                                                "tags": {
+                                                  "type": "object",
+                                                  "metadata": {
+                                                    "__bicep_resource_derived_type!": {
+                                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                    },
+                                                    "description": "Optional. Tags of the resource."
+                                                  },
+                                                  "nullable": true
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Kind of resource."
+                                                  }
+                                                },
+                                                "keyVaultResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault resource ID."
+                                                  }
+                                                },
+                                                "keyVaultSecretName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault secret name."
+                                                  }
+                                                },
+                                                "serverFarmResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Server farm resource ID."
+                                                  }
+                                                },
+                                                "canonicalName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                  }
+                                                },
+                                                "password": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate password."
+                                                  }
+                                                },
+                                                "pfxBlob": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate data in PFX format."
+                                                  }
+                                                },
+                                                "domainValidationMethod": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Method of domain validation for free certificate."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a certificate."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Certificate name."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Resource location."
+                                              }
+                                            },
+                                            "hostNames": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate host names."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                },
+                                                "description": "Optional. Tags of the resource."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "kind": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Kind of resource."
+                                              }
+                                            },
+                                            "keyVaultResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key Vault resource ID."
+                                              }
+                                            },
+                                            "keyVaultSecretName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key Vault secret name."
+                                              }
+                                            },
+                                            "serverFarmResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Server farm resource ID."
+                                              }
+                                            },
+                                            "canonicalName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                              }
+                                            },
+                                            "password": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate password."
+                                              }
+                                            },
+                                            "pfxBlob": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate data in PFX format."
+                                              }
+                                            },
+                                            "domainValidationMethod": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Method of domain validation for free certificate."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "certificate": {
+                                              "type": "Microsoft.Web/certificates",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "kind": "[parameters('kind')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "hostNames": "[parameters('hostNames')]",
+                                                "password": "[parameters('password')]",
+                                                "pfxBlob": "[parameters('pfxBlob')]",
+                                                "serverFarmId": "[parameters('serverFarmResourceId')]",
+                                                "keyVaultId": "[parameters('keyVaultResourceId')]",
+                                                "keyVaultSecretName": "[parameters('keyVaultSecretName')]",
+                                                "canonicalName": "[parameters('canonicalName')]",
+                                                "domainValidationMethod": "[parameters('domainValidationMethod')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the certificate."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/certificates', parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the certificate was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the certificate."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "thumbprint": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The thumbprint of the certificate."
+                                              },
+                                              "value": "[reference('certificate').thumbprint]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('certificate', '2024-11-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the host name binding."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the host name binding."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/hostNameBindings', parameters('appName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the resource was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "certificateThumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The thumbprint of the certificate."
+                                      },
+                                      "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value')]"
+                                    },
+                                    "certificateResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The resource ID of the certificate."
+                                      },
+                                      "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'resourceId'), 'value')]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_privateEndpoints": {
+                              "copy": {
+                                "name": "app_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-app-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex()))]"
+                                  },
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "18436885663402767850"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the private endpoint resource to create."
+                                      }
+                                    },
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                      }
+                                    },
+                                    "customNetworkInterfaceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipVersionType": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                        },
+                                        "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                                      },
+                                      "defaultValue": "IPv4"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "privateEndpoint": {
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                            "input": {
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        },
+                                        "ipVersionType": "[parameters('ipVersionType')]"
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "9935179114830442414"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the site."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the site."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the site was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('app', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('app', '2025-03-01', 'full').location]"
+                            },
+                            "defaultHostname": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Default hostname of the app."
+                              },
+                              "value": "[reference('app').defaultHostName]"
+                            },
+                            "customDomainVerificationId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                              },
+                              "value": "[reference('app').customDomainVerificationId]"
+                            },
+                            "outboundIpAddresses": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The outbound IP addresses of the app."
+                              },
+                              "value": "[reference('app').outboundIpAddresses]"
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the site."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            },
+                            "slots": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "The name of the slot."
+                                    }
+                                  },
+                                  "resourceId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "The resource ID of the slot."
+                                    }
+                                  },
+                                  "systemAssignedMIPrincipalId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "The principal ID of the system assigned identity of the slot."
+                                    }
+                                  },
+                                  "privateEndpoints": {
+                                    "type": "array",
+                                    "items": {
+                                      "$ref": "#/definitions/privateEndpointOutputType"
+                                    },
+                                    "metadata": {
+                                      "description": "The private endpoints of the slot."
+                                    }
+                                  },
+                                  "hostNameBindings": {
+                                    "type": "array",
+                                    "items": {
+                                      "$ref": "#/definitions/hostNameBindingsOutputType"
+                                    },
+                                    "metadata": {
+                                      "description": "The host name bindings of the slot."
+                                    }
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The slots of the site."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                                "input": {
+                                  "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
+                                  "resourceId": "[reference(format('app_slots[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "systemAssignedMIPrincipalId": "[coalesce(tryGet(tryGet(reference(format('app_slots[{0}]', copyIndex())).outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]",
+                                  "privateEndpoints": "[reference(format('app_slots[{0}]', copyIndex())).outputs.privateEndpoints.value]",
+                                  "hostNameBindings": "[reference(format('app_slots[{0}]', copyIndex())).outputs.hostNameBindings.value]"
+                                }
+                              }
+                            },
+                            "hostNameBindings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hostNameBindingsOutputType"
+                              },
+                              "metadata": {
+                                "description": "The host name bindings of the site."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "resourceGroupName": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.resourceGroupName.value]",
+                                  "certificateThumbprint": "[tryGet(tryGet(reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateThumbprint'), 'value')]",
+                                  "certificateResourceId": "[tryGet(tryGet(reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateResourceId'), 'value')]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the App Service."
+                      },
+                      "value": "[reference('appService').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the App Service."
+                      },
+                      "value": "[reference('appService').outputs.name.value]"
+                    },
+                    "defaultHostname": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Default hostname of the App Service."
+                      },
+                      "value": "[reference('appService').outputs.defaultHostname.value]"
+                    },
+                    "appUrl": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "URL of the App Service."
+                      },
+                      "value": "[format('https://{0}', reference('appService').outputs.defaultHostname.value)]"
+                    },
+                    "identityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(reference('appService').outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "ai_foundry_project",
+                "ai_search",
+                "app_insights",
+                "cosmosDBModule",
+                "existing_project_setup",
+                "foundry_search_connection",
+                "hostingplan",
+                "log_analytics",
+                "[format('privateDnsZoneDeployments[{0}]', variables('dnsZoneIndex').webApp)]",
+                "sqlDBModule",
+                "storage_account",
+                "virtualNetwork"
+              ]
+            },
+            "frontend_docker": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[format('app-{0}', variables('solutionSuffix'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[union(parameters('tags'), createObject('azd-service-name', 'webapp'))]"
+                  },
+                  "enableTelemetry": {
+                    "value": "[parameters('enableTelemetry')]"
+                  },
+                  "serverFarmResourceId": {
+                    "value": "[reference('hostingplan').outputs.resourceId.value]"
+                  },
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "linuxFxVersion": {
+                    "value": "[variables('placeholderImageName')]"
+                  },
+                  "vnetRouteAllEnabled": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+                  "imagePullTraffic": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+                  "contentShareTraffic": "[if(parameters('enablePrivateNetworking'), createObject('value', true()), createObject('value', false()))]",
+                  "virtualNetworkSubnetId": "[if(parameters('enablePrivateNetworking'), createObject('value', reference('virtualNetwork').outputs.webserverfarmSubnetResourceId.value), createObject('value', ''))]",
+                  "publicNetworkAccess": {
+                    "value": "Enabled"
+                  },
+                  "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[2], split(parameters('existingLogAnalyticsWorkspaceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('existingLogAnalyticsWorkspaceId'), '/')[8]), if(parameters('enableMonitoring'), reference('log_analytics').outputs.resourceId.value, ''))))), createObject('value', createArray()))]",
+                  "managedIdentities": {
+                    "value": {
+                      "systemAssigned": true
+                    }
+                  },
+                  "acrUseManagedIdentityCreds": {
+                    "value": true
+                  },
+                  "appSettings": {
+                    "value": {
+                      "WEBSITES_PORT": "80",
+                      "APPLICATIONINSIGHTS_CONNECTION_STRING": "[if(parameters('enableMonitoring'), reference('app_insights').outputs.connectionString.value, '')]",
+                      "APP_API_BASE_URL": "[if(parameters('enablePrivateNetworking'), '', format('https://api-{0}.azurewebsites.net', variables('solutionSuffix')))]",
+                      "BACKEND_API_HOST": "[if(parameters('enablePrivateNetworking'), format('api-{0}.azurewebsites.net', variables('solutionSuffix')), '')]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "7275312158093319855"
+                    }
+                  },
+                  "definitions": {
+                    "_1.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
                         "__bicep_imported_from!": {
                           "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
                         }
                       }
                     },
-                    "lockType": {
+                    "_1.roleAssignmentType": {
                       "type": "object",
                       "properties": {
                         "name": {
                           "type": "string",
                           "nullable": true,
                           "metadata": {
-                            "description": "Optional. Specify the name of lock."
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
                           }
                         },
-                        "kind": {
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
                           "type": "string",
                           "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
+                            "2.0"
                           ],
                           "nullable": true,
                           "metadata": {
-                            "description": "Optional. Specify the type of lock."
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
                           }
                         }
                       },
                       "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
+                        "description": "An AVM-aligned type for a role assignment.",
                         "__bicep_imported_from!": {
                           "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
                         }
@@ -2014,7 +75690,7 @@
                           }
                         },
                         "lock": {
-                          "$ref": "#/definitions/lockType",
+                          "$ref": "#/definitions/_1.lockType",
                           "nullable": true,
                           "metadata": {
                             "description": "Optional. Specify the type of lock."
@@ -2023,7 +75699,7 @@
                         "roleAssignments": {
                           "type": "array",
                           "items": {
-                            "$ref": "#/definitions/roleAssignmentType"
+                            "$ref": "#/definitions/_1.roleAssignmentType"
                           },
                           "nullable": true,
                           "metadata": {
@@ -2051,341 +75727,232 @@
                           "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
                         }
                       }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
                     }
                   },
                   "parameters": {
-                    "name": {
+                    "solutionName": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. The name of Cognitive Services account."
+                        "description": "Solution name suffix used to derive the resource name."
                       }
                     },
-                    "sku": {
+                    "name": {
                       "type": "string",
-                      "defaultValue": "S0",
-                      "allowedValues": [
-                        "C2",
-                        "C3",
-                        "C4",
-                        "F0",
-                        "F1",
-                        "S",
-                        "S0",
-                        "S1",
-                        "S10",
-                        "S2",
-                        "S3",
-                        "S4",
-                        "S5",
-                        "S6",
-                        "S7",
-                        "S8",
-                        "S9"
-                      ],
+                      "defaultValue": "[parameters('solutionName')]",
                       "metadata": {
-                        "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+                        "description": "Name of the App Service."
                       }
                     },
                     "location": {
                       "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
                       "metadata": {
-                        "description": "Optional. Location for all Resources."
+                        "description": "Azure region for the resource."
                       }
                     },
                     "tags": {
                       "type": "object",
-                      "nullable": true,
+                      "defaultValue": {},
                       "metadata": {
-                        "description": "Optional. Tags of the resource."
+                        "description": "Tags to apply to the resource."
                       }
                     },
-                    "deployments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/deploymentType"
-                      },
-                      "nullable": true,
+                    "serverFarmResourceId": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. Array of deployments about cognitive service accounts to create."
+                        "description": "Resource ID of the App Service Plan."
                       }
                     },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointSingleServiceType"
-                      },
-                      "nullable": true,
+                    "linuxFxVersion": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                        "description": "Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag)."
                       }
                     },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
+                    "appSettings": {
+                      "type": "object",
+                      "defaultValue": {},
                       "metadata": {
-                        "description": "Optional. The lock settings of the service."
+                        "description": "Application settings key-value pairs."
                       }
                     },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
+                    "applicationInsightResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Resource ID of Application Insights for monitoring integration."
+                      }
+                    },
+                    "alwaysOn": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Whether to enable Always On."
+                      }
+                    },
+                    "healthCheckPath": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Health check path for the app."
+                      }
+                    },
+                    "webSocketsEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to enable WebSockets."
+                      }
+                    },
+                    "appCommandLine": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Command line for the application."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "app,linux",
+                      "allowedValues": [
+                        "functionapp",
+                        "functionapp,linux",
+                        "functionapp,workflowapp",
+                        "functionapp,workflowapp,linux",
+                        "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
+                        "app,linux",
+                        "app",
+                        "linux,api",
+                        "api",
+                        "app,linux,container",
+                        "app,container,windows"
+                      ],
+                      "metadata": {
+                        "description": "Required. Type of site to deploy."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
                       "metadata": {
-                        "description": "Optional. Array of role assignments to create."
+                        "description": "Optional. Enable/Disable usage telemetry for module."
                       }
                     },
                     "diagnosticSettings": {
                       "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingFullType"
-                      },
-                      "nullable": true,
+                      "defaultValue": [],
                       "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
+                        "description": "Diagnostic settings for monitoring."
                       }
                     },
-                    "projectName": {
+                    "virtualNetworkSubnetId": {
                       "type": "string",
+                      "defaultValue": "",
                       "metadata": {
-                        "description": "Optional. Name for the project which needs to be created."
+                        "description": "Subnet resource ID for VNet integration."
                       }
                     },
-                    "projectDescription": {
+                    "publicNetworkAccess": {
                       "type": "string",
+                      "defaultValue": "Enabled",
                       "metadata": {
-                        "description": "Optional. Description  for the project which needs to be created."
+                        "description": "Public network access setting."
                       }
                     },
-                    "existingFoundryProjectResourceId": {
+                    "acrUseManagedIdentityCreds": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether the app pulls its container image from ACR using its managed identity."
+                      }
+                    },
+                    "acrUserManagedIdentityID": {
                       "type": "string",
                       "defaultValue": "",
                       "metadata": {
-                        "description": "Optional. Provide the existing project resource id in case if it needs to be reused"
+                        "description": "Optional. Client ID of the user-assigned identity used for ACR image pulls (empty = system-assigned)."
                       }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                    },
+                    "vnetRouteAllEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to route all outbound traffic through the virtual network."
                       }
-                    ],
-                    "builtInRoleNames": {
-                      "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]",
-                      "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]",
-                      "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]",
-                      "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]",
-                      "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]",
-                      "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]",
-                      "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]",
-                      "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]",
-                      "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]",
-                      "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]",
-                      "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]",
-                      "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]",
-                      "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]",
-                      "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]",
-                      "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]",
-                      "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]",
-                      "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]",
-                      "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]",
-                      "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
-                      "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]",
-                      "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]",
-                      "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]",
-                      "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]",
-                      "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
-                      "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    },
-                    "enableReferencedModulesTelemetry": false
-                  },
-                  "resources": {
-                    "cognitiveService": {
-                      "existing": true,
-                      "type": "Microsoft.CognitiveServices/accounts",
-                      "apiVersion": "2025-06-01",
-                      "name": "[parameters('name')]"
                     },
-                    "cognitiveService_deployments": {
-                      "copy": {
-                        "name": "cognitiveService_deployments",
-                        "count": "[length(coalesce(parameters('deployments'), createArray()))]",
-                        "mode": "serial",
-                        "batchSize": 1
-                      },
-                      "type": "Microsoft.CognitiveServices/accounts/deployments",
-                      "apiVersion": "2024-10-01",
-                      "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]",
-                      "properties": {
-                        "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]",
-                        "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]",
-                        "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]"
-                      },
-                      "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', 10))]"
+                    "imagePullTraffic": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to route image pull traffic through the virtual network."
+                      }
                     },
-                    "cognitiveService_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                    "contentShareTraffic": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to route content share traffic through the virtual network."
                       }
                     },
-                    "cognitiveService_diagnosticSettings": {
-                      "copy": {
-                        "name": "cognitiveService_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
                       },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
                       }
                     },
-                    "cognitiveService_roleAssignments": {
-                      "copy": {
-                        "name": "cognitiveService_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                    "managedIdentities": {
+                      "type": "object",
+                      "defaultValue": {
+                        "systemAssigned": true
                       },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      "metadata": {
+                        "description": "Optional. Managed identities for the resource."
                       }
+                    }
+                  },
+                  "resources": {
+                    "site": {
+                      "existing": true,
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2025-03-01",
+                      "name": "[parameters('name')]"
                     },
-                    "cognitiveService_privateEndpoints": {
-                      "copy": {
-                        "name": "cognitiveService_privateEndpoints",
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                    "logsConfig": {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2025-03-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+                      "properties": {
+                        "applicationLogs": {
+                          "fileSystem": {
+                            "level": "Verbose"
+                          }
+                        },
+                        "detailedErrorMessages": {
+                          "enabled": true
+                        },
+                        "failedRequestsTracing": {
+                          "enabled": true
+                        },
+                        "httpLogs": {
+                          "fileSystem": {
+                            "enabled": true,
+                            "retentionInDays": 1,
+                            "retentionInMb": 35
+                          }
+                        }
                       },
+                      "dependsOn": [
+                        "appService"
+                      ]
+                    },
+                    "appService": {
                       "type": "Microsoft.Resources/deployments",
                       "apiVersion": "2025-04-01",
-                      "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "name": "[take(format('avm.res.web.site.{0}', parameters('name')), 64)]",
                       "properties": {
                         "expressionEvaluationOptions": {
                           "scope": "inner"
@@ -2393,43 +75960,78 @@
                         "mode": "Incremental",
                         "parameters": {
                           "name": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]"
+                            "value": "[parameters('name')]"
                           },
-                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]",
-                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                          "subnetResourceId": {
-                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "kind": {
+                            "value": "[parameters('kind')]"
                           },
                           "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                            "value": "[parameters('enableTelemetry')]"
                           },
-                          "location": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          "serverFarmResourceId": {
+                            "value": "[parameters('serverFarmResourceId')]"
                           },
-                          "lock": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          "managedIdentities": {
+                            "value": "[parameters('managedIdentities')]"
                           },
-                          "privateDnsZoneGroup": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          "siteConfig": {
+                            "value": {
+                              "alwaysOn": "[parameters('alwaysOn')]",
+                              "ftpsState": "Disabled",
+                              "linuxFxVersion": "[parameters('linuxFxVersion')]",
+                              "minTlsVersion": "1.2",
+                              "healthCheckPath": "[if(not(empty(parameters('healthCheckPath'))), parameters('healthCheckPath'), null())]",
+                              "webSocketsEnabled": "[parameters('webSocketsEnabled')]",
+                              "appCommandLine": "[parameters('appCommandLine')]",
+                              "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]",
+                              "acrUseManagedIdentityCreds": "[parameters('acrUseManagedIdentityCreds')]",
+                              "acrUserManagedIdentityID": "[if(not(empty(parameters('acrUserManagedIdentityID'))), parameters('acrUserManagedIdentityID'), null())]"
+                            }
                           },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          "e2eEncryptionEnabled": {
+                            "value": true
                           },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          "configs": {
+                            "value": [
+                              {
+                                "name": "appsettings",
+                                "properties": "[parameters('appSettings')]",
+                                "applicationInsightResourceId": "[if(not(empty(parameters('applicationInsightResourceId'))), parameters('applicationInsightResourceId'), null())]"
+                              }
+                            ]
+                          },
+                          "outboundVnetRouting": {
+                            "value": {
+                              "contentShareTraffic": "[parameters('contentShareTraffic')]",
+                              "imagePullTraffic": "[parameters('imagePullTraffic')]"
+                            }
                           },
-                          "customDnsConfigs": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          "publicNetworkAccess": {
+                            "value": "[parameters('publicNetworkAccess')]"
                           },
-                          "ipConfigurations": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          "privateEndpoints": {
+                            "value": "[parameters('privateEndpoints')]"
                           },
-                          "applicationSecurityGroupResourceIds": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          "virtualNetworkSubnetResourceId": "[if(not(empty(parameters('virtualNetworkSubnetId'))), createObject('value', parameters('virtualNetworkSubnetId')), createObject('value', null()))]",
+                          "basicPublishingCredentialsPolicies": {
+                            "value": [
+                              {
+                                "name": "ftp",
+                                "allow": false
+                              },
+                              {
+                                "name": "scm",
+                                "allow": false
+                              }
+                            ]
                           },
-                          "customNetworkInterfaceName": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                          }
+                          "diagnosticSettings": "[if(not(empty(parameters('diagnosticSettings'))), createObject('value', parameters('diagnosticSettings')), createObject('value', createArray()))]"
                         },
                         "template": {
                           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
@@ -2438,2283 +76040,13968 @@
                           "metadata": {
                             "_generator": {
                               "name": "bicep",
-                              "version": "0.38.5.1644",
-                              "templateHash": "16604612898799598358"
+                              "version": "0.43.8.12551",
+                              "templateHash": "15230222474470713470"
                             },
-                            "name": "Private Endpoints",
-                            "description": "This module deploys a Private Endpoint."
+                            "name": "Web/Function Apps",
+                            "description": "This module deploys a Web or Function App."
                           },
                           "definitions": {
-                            "privateDnsZoneGroupType": {
+                            "privateEndpointOutputType": {
                               "type": "object",
                               "properties": {
                                 "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the private endpoint."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the private endpoint."
+                                  }
+                                },
+                                "groupId": {
                                   "type": "string",
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                    "description": "The group Id for the private endpoint Group."
                                   }
                                 },
-                                "privateDnsZoneGroupConfigs": {
+                                "customDnsConfigs": {
                                   "type": "array",
                                   "items": {
-                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                    "type": "object",
+                                    "properties": {
+                                      "fqdn": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "FQDN that resolves to private endpoint IP address."
+                                        }
+                                      },
+                                      "ipAddresses": {
+                                        "type": "array",
+                                        "items": {
+                                          "type": "string"
+                                        },
+                                        "metadata": {
+                                          "description": "A list of private IP addresses of the private endpoint."
+                                        }
+                                      }
+                                    }
                                   },
                                   "metadata": {
-                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                    "description": "The custom DNS configurations of the private endpoint."
+                                  }
+                                },
+                                "networkInterfaceResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "The IDs of the network interfaces associated with the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "configType": {
+                              "type": "object",
+                              "discriminator": {
+                                "propertyName": "name",
+                                "mapping": {
+                                  "appsettings": {
+                                    "$ref": "#/definitions/appSettingsConfigType"
+                                  },
+                                  "authsettings": {
+                                    "$ref": "#/definitions/authSettingsConfigType"
+                                  },
+                                  "authsettingsV2": {
+                                    "$ref": "#/definitions/authSettingsV2ConfigType"
+                                  },
+                                  "azurestorageaccounts": {
+                                    "$ref": "#/definitions/azureStorageAccountConfigType"
+                                  },
+                                  "backup": {
+                                    "$ref": "#/definitions/backupConfigType"
+                                  },
+                                  "connectionstrings": {
+                                    "$ref": "#/definitions/connectionStringsConfigType"
+                                  },
+                                  "logs": {
+                                    "$ref": "#/definitions/logsConfigType"
+                                  },
+                                  "metadata": {
+                                    "$ref": "#/definitions/metadataConfigType"
+                                  },
+                                  "pushsettings": {
+                                    "$ref": "#/definitions/pushSettingsConfigType"
+                                  },
+                                  "slotConfigNames": {
+                                    "$ref": "#/definitions/slotConfigNamesConfigType"
+                                  },
+                                  "web": {
+                                    "$ref": "#/definitions/webConfigType"
                                   }
                                 }
                               },
                               "metadata": {
                                 "__bicep_export!": true,
-                                "description": "The type of a private dns zone group."
+                                "description": "The type of a site configuration."
                               }
                             },
-                            "lockType": {
+                            "slotConfigNamesConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "slotConfigNames"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "appSettingNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of application settings names."
+                                      }
+                                    },
+                                    "azureStorageConfigNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of external Azure storage account identifiers."
+                                      }
+                                    },
+                                    "connectionStringNames": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of connection string names."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a slotConfigNames configuration."
+                              }
+                            },
+                            "slotType": {
                               "type": "object",
                               "properties": {
                                 "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Name of the slot."
+                                  }
+                                },
+                                "location": {
                                   "type": "string",
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. Specify the name of lock."
+                                    "description": "Optional. Location for all Resources."
                                   }
                                 },
-                                "kind": {
+                                "serverFarmResourceId": {
                                   "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. Specify the type of lock."
+                                    "description": "Optional. The resource ID of the app service plan to use for the slot."
+                                  }
+                                },
+                                "managedEnvironmentResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                                  }
+                                },
+                                "httpsOnly": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
+                                  }
+                                },
+                                "clientAffinityEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If client affinity is enabled."
+                                  }
+                                },
+                                "clientAffinityProxyEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance."
+                                  }
+                                },
+                                "clientAffinityPartitioningEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. To enable client affinity partitioning using CHIPS cookies."
+                                  }
+                                },
+                                "appServiceEnvironmentResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the app service environment to use for this resource."
+                                  }
+                                },
+                                "managedIdentities": {
+                                  "$ref": "#/definitions/managedIdentityAllType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The managed identity definition for this resource."
+                                  }
+                                },
+                                "keyVaultAccessIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                                  }
+                                },
+                                "storageAccountRequired": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Checks if Customer provided storage account is required."
+                                  }
+                                },
+                                "virtualNetworkSubnetResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                                  }
+                                },
+                                "siteConfig": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/siteConfig"
+                                    },
+                                    "description": "Optional. The site config object."
+                                  },
+                                  "nullable": true
+                                },
+                                "functionAppConfig": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/functionAppConfig"
+                                    },
+                                    "description": "Optional. The Function App config object."
+                                  },
+                                  "nullable": true
+                                },
+                                "configs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/configType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The web site config."
+                                  }
+                                },
+                                "extensions": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "metadata": {
+                                      "__bicep_resource_derived_type!": {
+                                        "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The extensions configuration."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The lock settings of the service."
+                                  }
+                                },
+                                "privateEndpoints": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateEndpointSingleServiceType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Configuration details for private endpoints."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "diagnosticSettings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/diagnosticSettingFullType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The diagnostic settings of the service."
+                                  }
+                                },
+                                "clientCertEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                                  }
+                                },
+                                "clientCertExclusionPaths": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                                  }
+                                },
+                                "clientCertMode": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/clientCertMode"
+                                    },
+                                    "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
+                                  },
+                                  "nullable": true
+                                },
+                                "cloningInfo": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/cloningInfo"
+                                    },
+                                    "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                                  },
+                                  "nullable": true
+                                },
+                                "containerSize": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Size of the function container."
+                                  }
+                                },
+                                "customDomainVerificationId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                                  }
+                                },
+                                "dailyMemoryTimeQuota": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                                  }
+                                },
+                                "enabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                                  }
+                                },
+                                "hostNameSslStates": {
+                                  "type": "array",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/hostNameSslStates"
+                                    },
+                                    "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                                  },
+                                  "nullable": true
+                                },
+                                "hyperV": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hyper-V sandbox."
+                                  }
+                                },
+                                "publicNetworkAccess": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                                    },
+                                    "description": "Optional. Allow or block all public traffic."
+                                  },
+                                  "nullable": true
+                                },
+                                "redundancyMode": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/redundancyMode"
+                                    },
+                                    "description": "Optional. Site redundancy mode."
+                                  },
+                                  "nullable": true
+                                },
+                                "basicPublishingCredentialsPolicies": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The site publishing credential policy names which are associated with the site slot."
                                   }
                                 },
-                                "notes": {
-                                  "type": "string",
+                                "outboundVnetRouting": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                                    },
+                                    "description": "Optional. The outbound VNET routing configuration for the slot."
+                                  },
+                                  "nullable": true
+                                },
+                                "hybridConnectionRelays": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/hybridConnectionRelayType"
+                                  },
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. Specify the notes of the lock."
+                                    "description": "Optional. Names of hybrid connection relays to connect app with."
                                   }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a lock.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                }
-                              }
-                            },
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
+                                },
+                                "hostNameBindings": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/hostNameBindingType"
+                                  },
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
+                                    "description": "Optional. Host Name Bindings for the slot."
                                   }
                                 },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
+                                "dnsConfiguration": {
+                                  "type": "object",
                                   "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "The type of a private DNS zone group configuration.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                }
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/dnsConfiguration"
+                                    },
+                                    "description": "Optional. Property to configure various DNS related settings for a site."
+                                  },
+                                  "nullable": true
+                                },
+                                "autoGeneratedDomainNameLabelScope": {
                                   "type": "string",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                                    },
+                                    "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                                  },
+                                  "nullable": true
+                                },
+                                "sshEnabled": {
+                                  "type": "bool",
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                    "description": "Optional. Whether to enable SSH access."
                                   }
                                 },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
+                                "daprConfig": {
+                                  "type": "object",
                                   "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/daprConfig"
+                                    },
+                                    "description": "Optional. Dapr configuration of the app."
+                                  },
+                                  "nullable": true
                                 },
-                                "principalId": {
+                                "ipMode": {
                                   "type": "string",
                                   "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/ipMode"
+                                    },
+                                    "description": "Optional. Specifies the IP mode of the app."
+                                  },
+                                  "nullable": true
                                 },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
+                                "resourceConfig": {
+                                  "type": "object",
                                   "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/resourceConfig"
+                                    },
+                                    "description": "Optional. Function app resource requirements."
+                                  },
+                                  "nullable": true
                                 },
-                                "description": {
+                                "workloadProfileName": {
                                   "type": "string",
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. The description of the role assignment."
+                                    "description": "Optional. Workload profile name for function app to execute on."
                                   }
                                 },
-                                "condition": {
-                                  "type": "string",
+                                "hostNamesDisabled": {
+                                  "type": "bool",
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                    "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
                                   }
                                 },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
+                                "reserved": {
+                                  "type": "bool",
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. Version of the condition."
+                                    "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
                                   }
                                 },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
+                                "scmSiteAlsoStopped": {
+                                  "type": "bool",
                                   "nullable": true,
                                   "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                    "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
                                   }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the private endpoint resource to create."
-                              }
-                            },
-                            "subnetResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                              }
-                            },
-                            "applicationSecurityGroupResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                              }
-                            },
-                            "customNetworkInterfaceName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                              }
-                            },
-                            "ipConfigurations": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
-                                },
-                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                              },
-                              "nullable": true
-                            },
-                            "privateDnsZoneGroup": {
-                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
-                                },
-                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                              },
-                              "nullable": true
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
-                                },
-                                "description": "Optional. Custom DNS configurations."
-                              },
-                              "nullable": true
-                            },
-                            "manualPrivateLinkServiceConnections": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
-                                },
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                              },
-                              "nullable": true
-                            },
-                            "privateLinkServiceConnections": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
                                 },
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                              },
-                              "nullable": true
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
+                                "e2eEncryptionEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. End to End Encryption Setting."
                                   }
                                 }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a slot."
                               }
                             },
-                            "privateEndpoint": {
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2024-10-01",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
+                            "extensionType": {
+                              "type": "object",
                               "properties": {
-                                "copy": [
-                                  {
-                                    "name": "applicationSecurityGroups",
-                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                    "input": {
-                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                    }
-                                  }
-                                ],
-                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                "subnet": {
-                                  "id": "[parameters('subnetResourceId')]"
+                                "properties": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                                    },
+                                    "description": "Optional. Sets the properties."
+                                  },
+                                  "nullable": true
                                 }
                               }
                             },
-                            "privateEndpoint_lock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                            "basicPublishingCredentialsPolicyType": {
+                              "type": "object",
                               "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "ftp",
+                                    "scm"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The name of the resource."
+                                  }
+                                },
+                                "allow": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Location for all Resources."
+                                  }
+                                }
                               },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a basic publishing credential policy."
+                              }
                             },
-                            "privateEndpoint_roleAssignments": {
-                              "copy": {
-                                "name": "privateEndpoint_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                            "hybridConnectionRelayType": {
+                              "type": "object",
                               "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                "hybridConnectionResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                  }
+                                },
+                                "sendKeyName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the authorization rule send key to use."
+                                  }
+                                }
                               },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a hybrid connection relay."
+                              }
                             },
-                            "privateEndpoint_privateDnsZoneGroup": {
-                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                            "_1.privateEndpointCustomDnsConfigType": {
+                              "type": "object",
                               "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
                                 },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                  },
-                                  "privateEndpointName": {
-                                    "value": "[parameters('name')]"
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
                                   },
-                                  "privateDnsZoneConfigs": {
-                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
                                   }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointIpConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
                                   "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.38.5.1644",
-                                      "templateHash": "24141742673128945"
-                                    },
-                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                  },
-                                  "definitions": {
-                                    "privateDnsZoneGroupConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private DNS zone group config."
-                                          }
-                                        },
-                                        "privateDnsZoneResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The resource id of the private DNS zone."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type of a private DNS zone group configuration."
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "privateEndpointName": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
                                       "type": "string",
                                       "metadata": {
-                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
                                       }
                                     },
-                                    "privateDnsZoneConfigs": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                      },
-                                      "minLength": 1,
-                                      "maxLength": 5,
+                                    "memberName": {
+                                      "type": "string",
                                       "metadata": {
-                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
                                       }
                                     },
-                                    "name": {
+                                    "privateIPAddress": {
                                       "type": "string",
-                                      "defaultValue": "default",
                                       "metadata": {
-                                        "description": "Optional. The name of the private DNS zone group."
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
                                       }
                                     }
                                   },
-                                  "resources": {
-                                    "privateEndpoint": {
-                                      "existing": true,
-                                      "type": "Microsoft.Network/privateEndpoints",
-                                      "apiVersion": "2024-10-01",
-                                      "name": "[parameters('privateEndpointName')]"
-                                    },
-                                    "privateDnsZoneGroup": {
-                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                      "apiVersion": "2024-10-01",
-                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                      "properties": {
-                                        "copy": [
-                                          {
-                                            "name": "privateDnsZoneConfigs",
-                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                            "input": {
-                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
-                                              "properties": {
-                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
-                                              }
-                                            }
-                                          }
-                                        ]
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_1.privateEndpointPrivateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "name": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. The name of the private DNS Zone Group config."
+                                        }
+                                      },
+                                      "privateDnsZoneResourceId": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The resource id of the private DNS zone."
+                                        }
                                       }
                                     }
                                   },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                  "metadata": {
+                                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "_2.certificateType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Certificate name."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource location."
+                                  }
+                                },
+                                "hostNames": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate host names."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
                                     },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
+                                    "description": "Optional. Tags of the resource."
+                                  },
+                                  "nullable": true
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "keyVaultResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault resource ID."
+                                  }
+                                },
+                                "keyVaultSecretName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Key Vault secret name."
+                                  }
+                                },
+                                "serverFarmResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Server farm resource ID."
+                                  }
+                                },
+                                "canonicalName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                  }
+                                },
+                                "password": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate password."
+                                  }
+                                },
+                                "pfxBlob": {
+                                  "type": "securestring",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate data in PFX format."
+                                  }
+                                },
+                                "domainValidationMethod": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Method of domain validation for free certificate."
                                   }
                                 }
                               },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
                               "metadata": {
-                                "description": "The resource ID of the private endpoint."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                "description": "The type of a certificate.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "modules/certificate.bicep"
+                                }
+                              }
                             },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint."
+                            "_3.scmIpSecurityRestrictionType": {
+                              "type": "object",
+                              "properties": {
+                                "action": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Allow",
+                                    "Deny"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Allow or Deny access for this IP range."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule description."
+                                  }
+                                },
+                                "headers": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "metadata": {
+                                      "description": "Required. A header."
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule headers.\nX-Forwarded-Host (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), all hosts(or lack of) are allowed.\n- A value is compared using ordinal-ignore-case (excluding port number).\n- Subdomain wildcards are permitted but don't match the root domain. For example, *.contoso.com matches the subdomain foo.contoso.com\nbut not the root domain contoso.com or multi-level foo.bar.contoso.com\n- Unicode host names are allowed but are converted to Punycode for matching.\n\nX-Forwarded-For (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), any forwarded-for chains (or lack of) are allowed.\n- If any address (excluding port number) in the chain (comma separated) matches the CIDR defined by the property.\n\nX-Azure-FDID and X-FD-HealthProbe.\nThe matching logic is exact match."
+                                  }
+                                },
+                                "ipAddress": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP address the security restriction is valid for. It can be in form of pure ipv4 address (required SubnetMask property) or CIDR notation such as ipv4/mask (leading bit match). For CIDR, SubnetMask property must not be specified."
+                                  }
+                                },
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. IP restriction rule name."
+                                  }
+                                },
+                                "priority": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Priority of IP restriction rule."
+                                  }
+                                },
+                                "subnetMask": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Subnet mask for the range of IP addresses the restriction is valid for."
+                                  }
+                                },
+                                "subnetTrafficTag": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. (internal) Subnet traffic tag."
+                                  }
+                                },
+                                "tag": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Default",
+                                    "ServiceTag",
+                                    "XffProxy"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Defines what this IP filter will be used for. This is to support IP filtering on proxies."
+                                  }
+                                },
+                                "vnetSubnetResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Virtual network resource id."
+                                  }
+                                },
+                                "vnetTrafficTag": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. (internal) Vnet traffic tag."
+                                  }
+                                }
                               },
-                              "value": "[parameters('name')]"
-                            },
-                            "location": {
-                              "type": "string",
                               "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                                "description": "The type of a IP security restriction.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
                             },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
-                                  "output": true
+                            "_3.slowRequestBasedTriggerType": {
+                              "type": "object",
+                              "properties": {
+                                "count": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Count."
+                                  }
                                 },
-                                "description": "The custom DNS configurations of the private endpoint."
-                              },
-                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                            },
-                            "networkInterfaceResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
+                                "path": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Request Path."
+                                  }
+                                },
+                                "timeInterval": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time interval."
+                                  }
+                                },
+                                "timeTaken": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Time taken."
+                                  }
+                                }
                               },
                               "metadata": {
-                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                              },
-                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                "description": "The type of aslow request based trigger.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
                             },
-                            "groupId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "The group Id for the private endpoint Group."
-                              },
-                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "cognitiveService_deployments"
-                      ]
-                    },
-                    "aiProject": {
-                      "condition": "[or(not(empty(parameters('projectName'))), not(empty(parameters('existingFoundryProjectResourceId'))))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[take(format('{0}-ai-project-{1}-deployment', parameters('name'), parameters('projectName')), 64)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[parameters('projectName')]"
-                          },
-                          "desc": {
-                            "value": "[parameters('projectDescription')]"
-                          },
-                          "aiServicesName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "location": {
-                            "value": "[parameters('location')]"
-                          },
-                          "tags": {
-                            "value": "[parameters('tags')]"
-                          },
-                          "existingFoundryProjectResourceId": {
-                            "value": "[parameters('existingFoundryProjectResourceId')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.44.1.10279",
-                              "templateHash": "436403693822643644"
-                            }
-                          },
-                          "definitions": {
-                            "aiProjectOutputType": {
+                            "appSettingsConfigType": {
                               "type": "object",
                               "properties": {
                                 "name": {
                                   "type": "string",
+                                  "allowedValues": [
+                                    "appsettings"
+                                  ],
                                   "metadata": {
-                                    "description": "Required. Name of the AI project."
+                                    "description": "Required. The type of config."
                                   }
                                 },
-                                "resourceId": {
+                                "storageAccountUseIdentityAuthentication": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                  }
+                                },
+                                "storageAccountResourceId": {
                                   "type": "string",
+                                  "nullable": true,
                                   "metadata": {
-                                    "description": "Required. Resource ID of the AI project."
+                                    "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
                                   }
                                 },
-                                "apiEndpoint": {
+                                "applicationInsightResourceId": {
                                   "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                  }
+                                },
+                                "retainCurrentAppSettings": {
+                                  "type": "bool",
+                                  "nullable": true,
                                   "metadata": {
-                                    "description": "Required. API endpoint for the AI project."
+                                    "description": "Optional. The retain the current app settings. Defaults to true."
                                   }
                                 },
-                                "aiprojectSystemAssignedMIPrincipalId": {
-                                  "type": "string",
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "Required. An app settings key-value pair."
+                                    }
+                                  },
+                                  "nullable": true,
                                   "metadata": {
-                                    "description": "Required. System Assigned Managed Identity Principal Id of the AI project."
+                                    "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
                                   }
                                 }
                               },
                               "metadata": {
-                                "__bicep_export!": true,
-                                "description": "Output type representing AI project information."
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the AI Services project."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Required. The location of the Project resource."
-                              }
-                            },
-                            "desc": {
-                              "type": "string",
-                              "defaultValue": "[parameters('name')]",
-                              "metadata": {
-                                "description": "Optional. The description of the AI Foundry project to create. Defaults to the project name."
-                              }
-                            },
-                            "aiServicesName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the existing Cognitive Services resource to create the AI Foundry project in."
+                                "description": "The type of an app settings configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
                               }
                             },
-                            "tags": {
+                            "authSettingsConfigType": {
                               "type": "object",
-                              "defaultValue": {},
-                              "metadata": {
-                                "description": "Optional. Tags to be applied to the resources."
-                              }
-                            },
-                            "existingFoundryProjectResourceId": {
-                              "type": "string",
-                              "defaultValue": "",
-                              "metadata": {
-                                "description": "Optional. Use this parameter to use an existing AI project resource ID from different resource group"
-                              }
-                            }
-                          },
-                          "variables": {
-                            "useExistingProject": "[not(empty(parameters('existingFoundryProjectResourceId')))]",
-                            "existingProjName": "[if(variables('useExistingProject'), last(split(parameters('existingFoundryProjectResourceId'), '/')), '')]",
-                            "existingAiFoundryAiServicesSubscriptionId": "[if(variables('useExistingProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], '')]",
-                            "existingAiFoundryAiServicesResourceGroupName": "[if(variables('useExistingProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], '')]",
-                            "existingAiFoundryAiServicesServiceName": "[if(variables('useExistingProject'), split(parameters('existingFoundryProjectResourceId'), '/')[8], '')]",
-                            "existingProjEndpoint": "[if(variables('useExistingProject'), format('https://{0}.services.ai.azure.com/api/projects/{1}', variables('existingAiFoundryAiServicesServiceName'), variables('existingProjName')), '')]"
-                          },
-                          "resources": {
-                            "cogServiceReference": {
-                              "existing": true,
-                              "type": "Microsoft.CognitiveServices/accounts",
-                              "apiVersion": "2025-06-01",
-                              "name": "[parameters('aiServicesName')]"
-                            },
-                            "aiProject": {
-                              "condition": "[not(variables('useExistingProject'))]",
-                              "type": "Microsoft.CognitiveServices/accounts/projects",
-                              "apiVersion": "2025-06-01",
-                              "name": "[format('{0}/{1}', parameters('aiServicesName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "location": "[parameters('location')]",
-                              "identity": {
-                                "type": "SystemAssigned"
-                              },
                               "properties": {
-                                "description": "[parameters('desc')]",
-                                "displayName": "[parameters('name')]"
-                              }
-                            },
-                            "existingAiProject": {
-                              "condition": "[variables('useExistingProject')]",
-                              "existing": true,
-                              "type": "Microsoft.CognitiveServices/accounts/projects",
-                              "apiVersion": "2025-06-01",
-                              "subscriptionId": "[variables('existingAiFoundryAiServicesSubscriptionId')]",
-                              "resourceGroup": "[variables('existingAiFoundryAiServicesResourceGroupName')]",
-                              "name": "[format('{0}/{1}', variables('existingAiFoundryAiServicesServiceName'), variables('existingProjName'))]"
-                            }
-                          },
-                          "outputs": {
-                            "aiProjectInfo": {
-                              "$ref": "#/definitions/aiProjectOutputType",
-                              "metadata": {
-                                "description": "AI Project metadata including name, resource ID, and API endpoint."
-                              },
-                              "value": {
-                                "name": "[if(variables('useExistingProject'), variables('existingProjName'), parameters('name'))]",
-                                "resourceId": "[if(variables('useExistingProject'), parameters('existingFoundryProjectResourceId'), resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('aiServicesName'), parameters('name')))]",
-                                "apiEndpoint": "[if(variables('useExistingProject'), variables('existingProjEndpoint'), reference('aiProject').endpoints['AI Foundry API'])]",
-                                "aiprojectSystemAssignedMIPrincipalId": "[if(variables('useExistingProject'), reference('existingAiProject', '2025-06-01', 'full').identity.principalId, reference('aiProject', '2025-06-01', 'full').identity.principalId)]"
-                              }
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "cognitiveService_deployments"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointOutputType"
-                      },
-                      "metadata": {
-                        "description": "The private endpoints of the congitive services account."
-                      },
-                      "copy": {
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                        "input": {
-                          "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                          "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                          "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                          "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                          "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                        }
-                      }
-                    },
-                    "aiProjectInfo": {
-                      "$ref": "#/definitions/aiProjectOutputType",
-                      "value": "[reference('aiProject').outputs.aiProjectInfo.value]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "cognitiveServiceNew"
-              ]
-            },
-            "existing_cognitive_service_dependencies": {
-              "condition": "[variables('useExistingService')]",
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('existing_cognitive_service_dependencies-{0}', uniqueString('existing_cognitive_service_dependencies', deployment().name))]",
-              "subscriptionId": "[variables('existingCognitiveServiceDetails')[2]]",
-              "resourceGroup": "[variables('existingCognitiveServiceDetails')[4]]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[variables('existingCognitiveServiceDetails')[8]]"
-                  },
-                  "projectName": {
-                    "value": "[parameters('projectName')]"
-                  },
-                  "projectDescription": {
-                    "value": "[parameters('projectDescription')]"
-                  },
-                  "existingFoundryProjectResourceId": {
-                    "value": "[parameters('existingFoundryProjectResourceId')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "deployments": {
-                    "value": "[parameters('deployments')]"
-                  },
-                  "diagnosticSettings": {
-                    "value": "[parameters('diagnosticSettings')]"
-                  },
-                  "lock": {
-                    "value": "[parameters('lock')]"
-                  },
-                  "privateEndpoints": {
-                    "value": "[parameters('privateEndpoints')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[parameters('roleAssignments')]"
-                  },
-                  "sku": {
-                    "value": "[parameters('sku')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.44.1.10279",
-                      "templateHash": "15040137489848152723"
-                    }
-                  },
-                  "definitions": {
-                    "privateEndpointOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The name of the private endpoint."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resource ID of the private endpoint."
-                          }
-                        },
-                        "groupId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "The group Id for the private endpoint Group."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "fqdn": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "FQDN that resolves to private endpoint IP address."
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "authsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "aadClaimsAuthorization": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a JSON string containing the Azure AD Acl settings."
+                                      }
+                                    },
+                                    "additionalLoginParams": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                      }
+                                    },
+                                    "allowedAudiences": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting."
+                                      }
+                                    },
+                                    "allowedExternalRedirectUrls": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                      }
+                                    },
+                                    "authFilePath": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The path of the config file containing auth settings. If the path is relative, base will the site's root directory."
+                                      }
+                                    },
+                                    "clientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                      }
+                                    },
+                                    "clientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                      }
+                                    },
+                                    "clientSecretCertificateThumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                      }
+                                    },
+                                    "clientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                      }
+                                    },
+                                    "configVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization."
+                                      }
+                                    },
+                                    "defaultProvider": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AzureActiveDirectory",
+                                        "Facebook",
+                                        "Github",
+                                        "Google",
+                                        "MicrosoftAccount",
+                                        "Twitter"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                      }
+                                    },
+                                    "facebookAppId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "facebookAppSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "facebookAppSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the app secret used for Facebook Login."
+                                      }
+                                    },
+                                    "facebookOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                      }
+                                    },
+                                    "gitHubClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Id of the GitHub app used for login. This setting is required for enabling Github login."
+                                      }
+                                    },
+                                    "gitHubClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login."
+                                      }
+                                    },
+                                    "gitHubClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret of the Github app used for GitHub Login."
+                                      }
+                                    },
+                                    "gitHubOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication."
+                                      }
+                                    },
+                                    "googleClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "googleClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "googleClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the client secret associated with the Google web application."
+                                      }
+                                    },
+                                    "googleOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, \"openid\", \"profile\", and \"email\" are used as default scopes. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                      }
+                                    },
+                                    "isAuthFromFile": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "false",
+                                        "true"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. \"true\" if the auth config settings should be read from a file, \"false\" otherwise."
+                                      }
+                                    },
+                                    "issuer": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                      }
+                                    },
+                                    "microsoftAccountClientId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                      }
+                                    },
+                                    "microsoftAccountClientSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                      }
+                                    },
+                                    "microsoftAccountClientSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication."
+                                      }
+                                    },
+                                    "microsoftAccountOAuthScopes": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, \"wl.basic\" is used as the default scope. Microsoft Account Scopes and permissions [documentation](https://msdn.microsoft.com/en-us/library/dn631845.aspx)."
+                                      }
+                                    },
+                                    "runtimeVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                      }
+                                    },
+                                    "tokenRefreshExtensionHours": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                      }
+                                    },
+                                    "tokenStoreEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows. The default is `false`."
+                                      }
+                                    },
+                                    "twitterConsumerKey": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                      }
+                                    },
+                                    "twitterConsumerSecret": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                      }
+                                    },
+                                    "twitterConsumerSecretSettingName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                      }
+                                    },
+                                    "unauthenticatedClientAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AllowAnonymous",
+                                        "RedirectToLoginPage"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                      }
+                                    },
+                                    "validateIssuer": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of an auth settings configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "authSettingsV2ConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "authsettingsV2"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "globalValidation": {
+                                      "type": "object",
+                                      "properties": {
+                                        "excludedPaths": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The paths for which unauthenticated flow would not be redirected to the login page."
+                                          }
+                                        },
+                                        "redirectToProvider": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                          }
+                                        },
+                                        "requireAuthentication": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the authentication flow is required by every request."
+                                          }
+                                        },
+                                        "unauthenticatedClientAction": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AllowAnonymous",
+                                            "RedirectToLoginPage",
+                                            "Return401",
+                                            "Return403"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings that determines the validation flow of users using App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "httpSettings": {
+                                      "type": "object",
+                                      "properties": {
+                                        "forwardProxy": {
+                                          "type": "object",
+                                          "properties": {
+                                            "convention": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Custom",
+                                                "NoProxy",
+                                                "Standard"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The convention used to determine the url of the request made."
+                                              }
+                                            },
+                                            "customHostHeaderName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The name of the header containing the host of the request."
+                                              }
+                                            },
+                                            "customProtoHeaderName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The name of the header containing the scheme of the request."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of a forward proxy used to make the requests."
+                                          }
+                                        },
+                                        "requireHttps": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `false` if the authentication/authorization responses not having the HTTPS scheme are permissible."
+                                          }
+                                        },
+                                        "routes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "apiPrefix": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The prefix that should precede all the authentication/authorization paths."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the paths HTTP requests."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "identityProviders": {
+                                      "type": "object",
+                                      "properties": {
+                                        "apple": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Apple provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Apple registration."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Apple provider."
+                                          }
+                                        },
+                                        "azureActiveDirectory": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "isAutoProvisioned": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "disableWWWAuthenticate": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the www-authenticate provider should be omitted from the request."
+                                                  }
+                                                },
+                                                "loginParameters": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                                  }
+                                                },
+                                                "clientSecretCertificateIssuer": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                  }
+                                                },
+                                                "clientSecretCertificateSubjectAlternativeName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                  }
+                                                },
+                                                "clientSecretCertificateThumbprint": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                                  }
+                                                },
+                                                "openIdIssuer": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory app registration."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The list of audiences that can make successful authentication/authorization requests."
+                                                  }
+                                                },
+                                                "defaultAuthorizationPolicy": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "allowedApplications": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory allowed applications."
+                                                      }
+                                                    },
+                                                    "allowedPrincipals": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "groups": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of the allowed groups."
+                                                          }
+                                                        },
+                                                        "identities": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of the allowed identities."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory allowed principals."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the default authorization policy."
+                                                  }
+                                                },
+                                                "jwtClaimChecks": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "allowedClientApplications": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The list of the allowed client applications."
+                                                      }
+                                                    },
+                                                    "allowedGroups": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The list of the allowed groups."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the checks that should be made while validating the JWT Claims."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Azure Active directory provider."
+                                          }
+                                        },
+                                        "azureStaticWebApps": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Azure Static Web Apps provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Static Web Apps registration."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Azure Static Web Apps provider."
+                                          }
+                                        },
+                                        "customOpenIdConnectProviders": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Set to `false` if the custom Open ID provider provider should not be enabled."
+                                                }
+                                              },
+                                              "login": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "nameClaimType": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of the claim that contains the users name."
+                                                    }
+                                                  },
+                                                  "scopes": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "string"
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The configuration settings of the login flow of the custom Open ID Connect provider."
+                                                }
+                                              },
+                                              "registration": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "clientCredential": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "clientSecretSettingName": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. The app setting that contains the client secret for the custom Open ID Connect provider."
+                                                        }
+                                                      },
+                                                      "method": {
+                                                        "type": "string",
+                                                        "allowedValues": [
+                                                          "ClientSecretPost"
+                                                        ],
+                                                        "metadata": {
+                                                          "description": "Required. The method that should be used to authenticate the user."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The authentication credentials of the custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "clientId": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The client id of the custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "openIdConnectConfiguration": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "authorizationEndpoint": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint to be used to make an authorization request."
+                                                        }
+                                                      },
+                                                      "certificationUri": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that provides the keys necessary to validate the token."
+                                                        }
+                                                      },
+                                                      "issuer": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that issues the token."
+                                                        }
+                                                      },
+                                                      "tokenEndpoint": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint to be used to request a token."
+                                                        }
+                                                      },
+                                                      "wellKnownOpenIdConfiguration": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The endpoint that contains all the configuration endpoints for the provider."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The configuration settings of the endpoints used for the custom Open ID Connect provider."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The configuration settings of the app registration for the custom Open ID Connect provider."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The alias of each custom Open ID Connect provider."
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider."
+                                          }
+                                        },
+                                        "facebook": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Facebook provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "graphApiVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The version of the Facebook api to be used while logging in."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "appId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The App ID of the app used for login."
+                                                  }
+                                                },
+                                                "appSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the app secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Facebook provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Facebook provider."
+                                          }
+                                        },
+                                        "gitHub": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the GitHub provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the GitHub provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the GitHub provider."
+                                          }
+                                        },
+                                        "google": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Google provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Google provider."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Google provider."
+                                          }
+                                        },
+                                        "legacyMicrosoftAccount": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the legacy Microsoft Account provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "scopes": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "clientId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The Client ID of the app used for login."
+                                                  }
+                                                },
+                                                "clientSecretSettingName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The app setting name that contains the client secret."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the legacy Microsoft Account provider."
+                                              }
+                                            },
+                                            "validation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedAudiences": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the legacy Microsoft Account provider token validation flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the legacy Microsoft Account provider."
+                                          }
+                                        },
+                                        "twitter": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the Twitter provider should not be enabled despite the set registration."
+                                              }
+                                            },
+                                            "registration": {
+                                              "type": "object",
+                                              "properties": {
+                                                "consumerKey": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                                  }
+                                                },
+                                                "consumerSecretSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the app registration for the Twitter provider."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the Twitter provider."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of each of the identity providers used to configure App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "login": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedExternalRedirectUrls": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                          }
+                                        },
+                                        "cookieExpiration": {
+                                          "type": "object",
+                                          "properties": {
+                                            "convention": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "FixedTime",
+                                                "IdentityProviderDerived"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The convention used when determining the session cookie's expiration."
+                                              }
+                                            },
+                                            "timeToExpiration": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The time after the request is made when the session cookie should expire."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the session cookie's expiration."
+                                          }
+                                        },
+                                        "nonce": {
+                                          "type": "object",
+                                          "properties": {
+                                            "nonceExpirationInterval": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The time after the request is made when the nonce should expire."
+                                              }
+                                            },
+                                            "validateNonce": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `false` if the nonce should not be validated while completing the login flow."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the nonce used in the login flow."
+                                          }
+                                        },
+                                        "preserveUrlFragmentsForLogins": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the fragments from the request are preserved after the login request is made."
+                                          }
+                                        },
+                                        "routes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "logoutEndpoint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The endpoint at which a logout request should be made."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The routes that specify the endpoints used for login and logout requests."
+                                          }
+                                        },
+                                        "tokenStore": {
+                                          "type": "object",
+                                          "properties": {
+                                            "azureBlobStorage": {
+                                              "type": "object",
+                                              "properties": {
+                                                "sasUrlSettingName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the app setting containing the SAS URL of the blob storage containing the tokens."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the storage of the tokens if blob storage is used."
+                                              }
+                                            },
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows."
+                                              }
+                                            },
+                                            "fileSystem": {
+                                              "type": "object",
+                                              "properties": {
+                                                "directory": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The directory in which the tokens will be stored."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the storage of the tokens if a file system is used."
+                                              }
+                                            },
+                                            "tokenRefreshExtensionHours": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration settings of the token store."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the login flow of users using App Service Authentication/Authorization."
+                                      }
+                                    },
+                                    "platform": {
+                                      "type": "object",
+                                      "properties": {
+                                        "configFilePath": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The path of the config file containing auth settings if they come from a file. If the path is relative, base will the site's root directory."
+                                          }
+                                        },
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                          }
+                                        },
+                                        "runtimeVersion": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The configuration settings of the platform of App Service Authentication/Authorization."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
                                 }
                               },
-                              "ipAddresses": {
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                },
-                                "metadata": {
-                                  "description": "A list of private IP addresses of the private endpoint."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "The custom DNS configurations of the private endpoint."
-                          }
-                        },
-                        "networkInterfaceResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the private endpoint output."
-                      }
-                    },
-                    "deploymentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of cognitive service account deployment."
-                          }
-                        },
-                        "model": {
-                          "type": "object",
-                          "properties": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of Cognitive Services account deployment model."
-                              }
-                            },
-                            "format": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The format of Cognitive Services account deployment model."
-                              }
-                            },
-                            "version": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The version of Cognitive Services account deployment model."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of Cognitive Services account deployment model."
-                          }
-                        },
-                        "sku": {
-                          "type": "object",
-                          "properties": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the resource model definition representing SKU."
-                              }
-                            },
-                            "capacity": {
-                              "type": "int",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The capacity of the resource model definition representing SKU."
-                              }
-                            },
-                            "tier": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The tier of the resource model definition representing SKU."
-                              }
-                            },
-                            "size": {
-                              "type": "string",
-                              "nullable": true,
                               "metadata": {
-                                "description": "Optional. The size of the resource model definition representing SKU."
+                                "description": "The type of an authSettingsV2 configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
                               }
                             },
-                            "family": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The family of the resource model definition representing SKU."
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource model definition representing SKU."
-                          }
-                        },
-                        "raiPolicyName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of RAI policy."
-                          }
-                        },
-                        "versionUpgradeOption": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The version upgrade option."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a cognitive services account deployment."
-                      }
-                    },
-                    "endpointType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Type of the endpoint."
-                          }
-                        },
-                        "endpoint": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "The endpoint URI."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a cognitive services account endpoint."
-                      }
-                    },
-                    "_1.privateEndpointCustomDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointIpConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
+                            "azureStorageAccountConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "azurestorageaccounts"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "accessKey": {
+                                        "type": "securestring",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Access key for the storage account."
+                                        }
+                                      },
+                                      "accountName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the storage account."
+                                        }
+                                      },
+                                      "mountPath": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                        }
+                                      },
+                                      "protocol": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "Http",
+                                          "Nfs",
+                                          "Smb"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Mounting protocol to use for the storage account."
+                                        }
+                                      },
+                                      "shareName": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                        }
+                                      },
+                                      "type": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "AzureBlob",
+                                          "AzureFiles"
+                                        ],
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Type of storage."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The Azure Storage Info configuration."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                "description": "The type of an Azure Storage Account configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
                               }
                             },
-                            "memberName": {
-                              "type": "string",
+                            "backupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "backup"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "backupName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name of the backup."
+                                      }
+                                    },
+                                    "backupSchedule": {
+                                      "type": "object",
+                                      "properties": {
+                                        "frequencyInterval": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. How often the backup should be executed (e.g. for weekly backup, this should be set to 7 and FrequencyUnit should be set to Day)."
+                                          }
+                                        },
+                                        "frequencyUnit": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Day",
+                                            "Hour"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The unit of time for how often the backup should be executed (e.g. for weekly backup, this should be set to Day and FrequencyInterval should be set to 7)."
+                                          }
+                                        },
+                                        "keepAtLeastOneBackup": {
+                                          "type": "bool",
+                                          "metadata": {
+                                            "description": "Required. Set to `True` if the retention policy should always keep at least one backup in the storage account, regardless how old it is."
+                                          }
+                                        },
+                                        "retentionPeriodInDays": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. After how many days backups should be deleted."
+                                          }
+                                        },
+                                        "startTime": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. When the schedule should start working."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Schedule for the backup if it is executed periodically."
+                                      }
+                                    },
+                                    "databases": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "connectionString": {
+                                            "type": "securestring",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Contains a connection string to a database which is being backed up or restored. If the restore should happen to a new database, the database name inside is the new one."
+                                            }
+                                          },
+                                          "connectionStringName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Contains a connection string name that is linked to the SiteConfig.ConnectionStrings. This is used during restore with overwrite connection strings options."
+                                            }
+                                          },
+                                          "databaseType": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "LocalMySql",
+                                              "MySql",
+                                              "PostgreSql",
+                                              "SqlAzure"
+                                            ],
+                                            "metadata": {
+                                              "description": "Required. Database type (e.g. SqlAzure / MySql)."
+                                            }
+                                          },
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of the setting."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Databases included in the backup."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `True` if the backup schedule is enabled (must be included in that case), `false` if the backup schedule should be disabled."
+                                      }
+                                    },
+                                    "storageAccountUrl": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SAS URL to the container."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
                               "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                "description": "The type for a backup configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
                               }
                             },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointPrivateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "name": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. The name of the private DNS Zone Group config."
+                            "connectionStringsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "connectionstrings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "object",
+                                    "properties": {
+                                      "type": {
+                                        "type": "string",
+                                        "allowedValues": [
+                                          "ApiHub",
+                                          "Custom",
+                                          "DocDb",
+                                          "EventHub",
+                                          "MySql",
+                                          "NotificationHub",
+                                          "PostgreSQL",
+                                          "RedisCache",
+                                          "SQLAzure",
+                                          "SQLServer",
+                                          "ServiceBus"
+                                        ],
+                                        "metadata": {
+                                          "description": "Required. Type of database."
+                                        }
+                                      },
+                                      "value": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Value of pair."
+                                        }
+                                      }
+                                    },
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The name of the connection string setting."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
                                 }
                               },
-                              "privateDnsZoneResourceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of the private DNS zone."
+                              "metadata": {
+                                "description": "The type for a connection string configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
                                 }
                               }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "aiProjectOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the AI project."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Resource ID of the AI project."
-                          }
-                        },
-                        "apiEndpoint": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. API endpoint for the AI project."
-                          }
-                        },
-                        "aiprojectSystemAssignedMIPrincipalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. System Assigned Managed Identity Principal Id of the AI project."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "Output type representing AI project information.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "project.bicep"
-                        }
-                      }
-                    },
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
                                 }
                               },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
                                 }
                               }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                            },
+                            "hostNameBindingsOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the host name binding."
+                                  }
+                                },
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resource ID of the host name binding."
+                                  }
+                                },
+                                "resourceGroupName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The name of the resource group the resource was deployed into."
+                                  }
+                                },
+                                "certificateThumbprint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The thumbprint of the certificate."
+                                  }
+                                },
+                                "certificateResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "The resource ID of the certificate."
+                                  }
                                 }
                               },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
                                 }
                               }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "privateEndpointSingleServiceType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private Endpoint."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The location to deploy the Private Endpoint to."
-                          }
-                        },
-                        "privateLinkServiceConnectionName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private link connection to create."
-                          }
-                        },
-                        "service": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                          }
-                        },
-                        "subnetResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                          }
-                        },
-                        "resourceGroupResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                          }
-                        },
-                        "privateDnsZoneGroup": {
-                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                          }
-                        },
-                        "isManualConnection": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. If Manual Private Link Connection is required."
-                          }
-                        },
-                        "manualConnectionRequestMessage": {
-                          "type": "string",
-                          "nullable": true,
-                          "maxLength": 140,
-                          "metadata": {
-                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Custom DNS configurations."
-                          }
-                        },
-                        "ipConfigurations": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                          }
-                        },
-                        "applicationSecurityGroupResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                          }
-                        },
-                        "customNetworkInterfaceName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                          }
-                        },
-                        "lock": {
-                          "$ref": "#/definitions/lockType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/roleAssignmentType"
+                            },
+                            "hostNameBindingType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hostname in the hostname binding. Defaults to the host name of the app/slot if not specified."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Kind of resource."
+                                  }
+                                },
+                                "azureResourceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure resource name."
+                                  }
+                                },
+                                "azureResourceType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "TrafficManager",
+                                    "Website"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                  }
+                                },
+                                "customHostNameDnsRecordType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "A",
+                                    "CName"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                  }
+                                },
+                                "domainResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Fully qualified ARM domain resource URI."
+                                  }
+                                },
+                                "hostNameType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Managed",
+                                    "Verified"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                  }
+                                },
+                                "siteName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. App Service app name."
+                                  }
+                                },
+                                "sslState": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Disabled",
+                                    "IpBasedEnabled",
+                                    "SniEnabled"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                  }
+                                },
+                                "thumbprint": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. SSL certificate thumbprint."
+                                  }
+                                },
+                                "certificate": {
+                                  "$ref": "#/definitions/_2.certificateType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Certificate creation properties. If specified, a certificate will be created and used for this hostname binding."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a host name binding.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "logsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "logs"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "applicationLogs": {
+                                      "type": "object",
+                                      "properties": {
+                                        "azureBlobStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to blob storage configuration."
+                                          }
+                                        },
+                                        "azureTableStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. SAS URL to an Azure table with add/query/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to azure table storage configuration."
+                                          }
+                                        },
+                                        "fileSystem": {
+                                          "type": "object",
+                                          "properties": {
+                                            "level": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Error",
+                                                "Information",
+                                                "Off",
+                                                "Verbose",
+                                                "Warning"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Log level."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application logs to file system configuration."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application Logs for Azure configuration."
+                                      }
+                                    },
+                                    "detailedErrorMessages": {
+                                      "type": "object",
+                                      "properties": {
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Detailed error messages configuration."
+                                      }
+                                    },
+                                    "failedRequestsTracing": {
+                                      "type": "object",
+                                      "properties": {
+                                        "enabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Failed requests tracing configuration."
+                                      }
+                                    },
+                                    "httpLogs": {
+                                      "type": "object",
+                                      "properties": {
+                                        "azureBlobStorage": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "sasUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Http logs to azure blob storage configuration."
+                                          }
+                                        },
+                                        "fileSystem": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                              }
+                                            },
+                                            "retentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Retention in days. Remove files older than X days. 0 or lower means no retention."
+                                              }
+                                            },
+                                            "retentionInMb": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 25,
+                                              "maxValue": 100,
+                                              "metadata": {
+                                                "description": "Optional. Maximum size in megabytes that http log files can use. When reached old log files will be removed to make space for new ones."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Http logs to file system configuration."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. HTTP logs configuration."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a logs configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "managedIdentityAllType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                },
+                                "userAssignedResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "metadataConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "metadata"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {},
+                                  "additionalProperties": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Optional. The metadata key value pair."
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a metadata configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "privateEndpointSingleServiceType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private Endpoint."
+                                  }
+                                },
+                                "location": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The location to deploy the Private Endpoint to."
+                                  }
+                                },
+                                "privateLinkServiceConnectionName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private link connection to create."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                  }
+                                },
+                                "subnetResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                  }
+                                },
+                                "resourceGroupResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                  }
+                                },
+                                "privateDnsZoneGroup": {
+                                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                  }
+                                },
+                                "isManualConnection": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. If Manual Private Link Connection is required."
+                                  }
+                                },
+                                "manualConnectionRequestMessage": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "maxLength": 140,
+                                  "metadata": {
+                                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                  }
+                                },
+                                "customDnsConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Custom DNS configurations."
+                                  }
+                                },
+                                "ipConfigurations": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                  }
+                                },
+                                "applicationSecurityGroupResourceIds": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                  }
+                                },
+                                "customNetworkInterfaceName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                  }
+                                },
+                                "lock": {
+                                  "$ref": "#/definitions/lockType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                },
+                                "tags": {
+                                  "type": "object",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                    },
+                                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                  }
+                                },
+                                "enableTelemetry": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable/Disable usage telemetry for module."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "pushSettingsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "pushsettings"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "dynamicTagsJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                      }
+                                    },
+                                    "isPushEnabled": {
+                                      "type": "bool",
+                                      "metadata": {
+                                        "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                      }
+                                    },
+                                    "tagsRequiringAuth": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                      }
+                                    },
+                                    "tagWhitelistJson": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a pushSettings configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "webConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "web"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The type of config."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "acrUseManagedIdentityCreds": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Flag to use Managed Identity Creds for ACR pull."
+                                      }
+                                    },
+                                    "acrUserManagedIdentityID": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. If using user managed identity, the user managed identity ClientId."
+                                      }
+                                    },
+                                    "alwaysOn": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if 'Always On' is enabled."
+                                      }
+                                    },
+                                    "apiDefinition": {
+                                      "type": "object",
+                                      "properties": {
+                                        "url": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The URL of the API definition."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Information about the formal API definition for the app."
+                                      }
+                                    },
+                                    "apiManagementConfig": {
+                                      "type": "object",
+                                      "properties": {
+                                        "id": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. APIM-Api Identifier."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure API management settings linked to the app."
+                                      }
+                                    },
+                                    "appCommandLine": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. App command line to launch."
+                                      }
+                                    },
+                                    "appSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Name of the pair."
+                                            }
+                                          },
+                                          "value": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Value of the pair."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application settings."
+                                      }
+                                    },
+                                    "autoHealEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if Auto Heal is enabled."
+                                      }
+                                    },
+                                    "autoHealRules": {
+                                      "type": "object",
+                                      "properties": {
+                                        "actions": {
+                                          "type": "object",
+                                          "properties": {
+                                            "actionType": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "CustomAction",
+                                                "LogEvent",
+                                                "Recycle"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Predefined action to be taken."
+                                              }
+                                            },
+                                            "customAction": {
+                                              "type": "object",
+                                              "properties": {
+                                                "exe": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Executable to be run."
+                                                  }
+                                                },
+                                                "parameters": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Parameters for the executable."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Custom action to be taken."
+                                              }
+                                            },
+                                            "minProcessExecutionTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Minimum time the process must execute before taking the action."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Actions to be executed when a rule is triggered."
+                                          }
+                                        },
+                                        "triggers": {
+                                          "type": "object",
+                                          "properties": {
+                                            "privateBytesInKB": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on private bytes."
+                                              }
+                                            },
+                                            "requests": {
+                                              "type": "object",
+                                              "properties": {
+                                                "count": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Request Count."
+                                                  }
+                                                },
+                                                "timeInterval": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Time interval."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on total requests."
+                                              }
+                                            },
+                                            "slowRequests": {
+                                              "$ref": "#/definitions/_3.slowRequestBasedTriggerType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on request execution time."
+                                              }
+                                            },
+                                            "slowRequestsWithPath": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/_3.slowRequestBasedTriggerType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on multiple Slow Requests Rule with path."
+                                              }
+                                            },
+                                            "statusCodes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "count": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Count."
+                                                    }
+                                                  },
+                                                  "path": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Path."
+                                                    }
+                                                  },
+                                                  "status": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. HTTP status code."
+                                                    }
+                                                  },
+                                                  "subStatus": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Sub Status."
+                                                    }
+                                                  },
+                                                  "timeInterval": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Time interval."
+                                                    }
+                                                  },
+                                                  "win32Status": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Win32 error code."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on status codes."
+                                              }
+                                            },
+                                            "statusCodesRange": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "count": {
+                                                    "type": "int",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Request Count."
+                                                    }
+                                                  },
+                                                  "path": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Path."
+                                                    }
+                                                  },
+                                                  "statusCodes": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. HTTP status code."
+                                                    }
+                                                  },
+                                                  "timeInterval": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Time interval."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A rule based on status codes ranges."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Conditions that describe when to execute the auto-heal actions."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Auto Heal rules."
+                                      }
+                                    },
+                                    "autoSwapSlotName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Auto-swap slot name."
+                                      }
+                                    },
+                                    "azureStorageAccounts": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "type": "object",
+                                        "properties": {
+                                          "accessKey": {
+                                            "type": "securestring",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Access key for the storage account."
+                                            }
+                                          },
+                                          "accountName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the storage account."
+                                            }
+                                          },
+                                          "mountPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                            }
+                                          },
+                                          "protocol": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "Http",
+                                              "Nfs",
+                                              "Smb"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Mounting protocol to use for the storage account."
+                                            }
+                                          },
+                                          "shareName": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                            }
+                                          },
+                                          "type": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "AzureBlob",
+                                              "AzureFiles"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Type of storage."
+                                            }
+                                          }
+                                        },
+                                        "metadata": {
+                                          "description": "Required. A storage account configuration."
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of Azure Storage Accounts."
+                                      }
+                                    },
+                                    "connectionStrings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "connectionString": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Connection string value."
+                                            }
+                                          },
+                                          "name": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Name of connection string."
+                                            }
+                                          },
+                                          "type": {
+                                            "type": "string",
+                                            "allowedValues": [
+                                              "ApiHub",
+                                              "Custom",
+                                              "DocDb",
+                                              "EventHub",
+                                              "MySql",
+                                              "NotificationHub",
+                                              "PostgreSQL",
+                                              "RedisCache",
+                                              "SQLAzure",
+                                              "SQLServer",
+                                              "ServiceBus"
+                                            ],
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Type of database."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Connection strings."
+                                      }
+                                    },
+                                    "cors": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedOrigins": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Gets or sets the list of origins that should be allowed to make cross-origin calls (for example: http://example.com:12345). Use \"*\" to allow all."
+                                          }
+                                        },
+                                        "supportCredentials": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Gets or sets whether CORS requests with credentials are allowed. See [ref](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Requests_with_credentials) for more details."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Cross-Origin Resource Sharing (CORS) settings."
+                                      }
+                                    },
+                                    "defaultDocuments": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default documents."
+                                      }
+                                    },
+                                    "detailedErrorLoggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if detailed error logging is enabled."
+                                      }
+                                    },
+                                    "documentRoot": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Document root."
+                                      }
+                                    },
+                                    "elasticWebAppScaleLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to apps in plans where ElasticScaleEnabled is `true`."
+                                      }
+                                    },
+                                    "experiments": {
+                                      "type": "object",
+                                      "properties": {
+                                        "rampUpRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "actionHostName": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Hostname of a slot to which the traffic will be redirected if decided to. E.g. myapp-stage.azurewebsites.net."
+                                                }
+                                              },
+                                              "changeDecisionCallbackUrl": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified."
+                                                }
+                                              },
+                                              "changeIntervalInMinutes": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies interval in minutes to reevaluate ReroutePercentage."
+                                                }
+                                              },
+                                              "changeStep": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. In auto ramp up scenario this is the step to add/remove from `ReroutePercentage` until it reaches `MinReroutePercentage` or `MaxReroutePercentage`. Site metrics are checked every N minutes specified in `ChangeIntervalInMinutes`. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified in `ChangeDecisionCallbackUrl`."
+                                                }
+                                              },
+                                              "maxReroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies upper boundary below which ReroutePercentage will stay."
+                                                }
+                                              },
+                                              "minReroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies lower boundary above which ReroutePercentage will stay."
+                                                }
+                                              },
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of the routing rule. The recommended name would be to point to the slot which will receive the traffic in the experiment."
+                                                }
+                                              },
+                                              "reroutePercentage": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Percentage of the traffic which will be redirected to `ActionHostName`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. List of ramp-up rules."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. This is work around for polymorphic types."
+                                      }
+                                    },
+                                    "ftpsState": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AllAllowed",
+                                        "Disabled",
+                                        "FtpsOnly"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. State of FTP / FTPS service."
+                                      }
+                                    },
+                                    "functionAppScaleLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to the Consumption and Elastic Premium Plans."
+                                      }
+                                    },
+                                    "functionsRuntimeScaleMonitoringEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Gets or sets a value indicating whether functions runtime scale monitoring is enabled. When enabled, the ScaleController will not monitor event sources directly, but will instead call to the runtime to get scale status."
+                                      }
+                                    },
+                                    "handlerMappings": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "arguments": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Command-line arguments to be passed to the script processor."
+                                            }
+                                          },
+                                          "extension": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Requests with this extension will be handled using the specified FastCGI application."
+                                            }
+                                          },
+                                          "scriptProcessor": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The absolute path to the FastCGI application."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Handler mappings."
+                                      }
+                                    },
+                                    "healthCheckPath": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Health check path."
+                                      }
+                                    },
+                                    "http20Enabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allow clients to connect over http2.0."
+                                      }
+                                    },
+                                    "httpLoggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if HTTP logging is enabled."
+                                      }
+                                    },
+                                    "ipSecurityRestrictions": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/_3.scmIpSecurityRestrictionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for main."
+                                      }
+                                    },
+                                    "ipSecurityRestrictionsDefaultAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default action for main access restriction if no rules are matched."
+                                      }
+                                    },
+                                    "javaContainer": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java container."
+                                      }
+                                    },
+                                    "javaContainerVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java container version."
+                                      }
+                                    },
+                                    "javaVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Java version."
+                                      }
+                                    },
+                                    "keyVaultReferenceIdentity": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Identity to use for Key Vault Reference authentication."
+                                      }
+                                    },
+                                    "limits": {
+                                      "type": "object",
+                                      "properties": {
+                                        "maxDiskSizeInMb": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed disk size usage in MB."
+                                          }
+                                        },
+                                        "maxMemoryInMb": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed memory usage in MB."
+                                          }
+                                        },
+                                        "maxPercentageCpu": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Maximum allowed CPU usage percentage."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Site limits."
+                                      }
+                                    },
+                                    "linuxFxVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Linux App Framework and version."
+                                      }
+                                    },
+                                    "loadBalancing": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "LeastRequests",
+                                        "LeastRequestsWithTieBreaker",
+                                        "LeastResponseTime",
+                                        "PerSiteRoundRobin",
+                                        "RequestHash",
+                                        "WeightedRoundRobin",
+                                        "WeightedTotalTraffic"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Site load balancing."
+                                      }
+                                    },
+                                    "localMySqlEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to enable local MySQL."
+                                      }
+                                    },
+                                    "logsDirectorySizeLimit": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. HTTP logs directory size limit."
+                                      }
+                                    },
+                                    "managedPipelineMode": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Classic",
+                                        "Integrated"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Managed pipeline mode."
+                                      }
+                                    },
+                                    "managedServiceIdentityId": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Managed Service Identity Id."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "name": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Pair name."
+                                            }
+                                          },
+                                          "value": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. Pair Value."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Application metadata. This property cannot be retrieved, since it may contain secrets."
+                                      }
+                                    },
+                                    "minimumElasticInstanceCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 20,
+                                      "metadata": {
+                                        "description": "Optional. Number of minimum instance count for a site. This setting only applies to the Elastic Plans."
+                                      }
+                                    },
+                                    "minTlsCipherSuite": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "TLS_AES_128_GCM_SHA256",
+                                        "TLS_AES_256_GCM_SHA384",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                                        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                                        "TLS_RSA_WITH_AES_128_CBC_SHA",
+                                        "TLS_RSA_WITH_AES_128_CBC_SHA256",
+                                        "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                                        "TLS_RSA_WITH_AES_256_CBC_SHA",
+                                        "TLS_RSA_WITH_AES_256_CBC_SHA256",
+                                        "TLS_RSA_WITH_AES_256_GCM_SHA384"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The minimum strength TLS cipher suite allowed for an application."
+                                      }
+                                    },
+                                    "minTlsVersion": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "1.0",
+                                        "1.1",
+                                        "1.2",
+                                        "1.3"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. MinTlsVersion: configures the minimum version of TLS required for SSL requests."
+                                      }
+                                    },
+                                    "netFrameworkVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. .NET Framework version."
+                                      }
+                                    },
+                                    "nodeVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of Node.js."
+                                      }
+                                    },
+                                    "numberOfWorkers": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Number of workers."
+                                      }
+                                    },
+                                    "phpVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of PHP."
+                                      }
+                                    },
+                                    "powerShellVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of PowerShell."
+                                      }
+                                    },
+                                    "preWarmedInstanceCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "minValue": 0,
+                                      "maxValue": 10,
+                                      "metadata": {
+                                        "description": "Optional. Number of preWarmed instances. This setting only applies to the Consumption and Elastic Plans."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Property to allow or block all public traffic."
+                                      }
+                                    },
+                                    "publishingUsername": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Publishing user name."
+                                      }
+                                    },
+                                    "push": {
+                                      "type": "object",
+                                      "properties": {
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "dynamicTagsJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                              }
+                                            },
+                                            "isPushEnabled": {
+                                              "type": "bool",
+                                              "metadata": {
+                                                "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                              }
+                                            },
+                                            "tagsRequiringAuth": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                              }
+                                            },
+                                            "tagWhitelistJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. PushSettings resource specific properties."
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Push endpoint settings."
+                                      }
+                                    },
+                                    "pythonVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Version of Python."
+                                      }
+                                    },
+                                    "remoteDebuggingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if remote debugging is enabled."
+                                      }
+                                    },
+                                    "remoteDebuggingVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Remote debugging version."
+                                      }
+                                    },
+                                    "requestTracingEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if request tracing is enabled."
+                                      }
+                                    },
+                                    "requestTracingExpirationTime": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Request tracing expiration time."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictions": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/_3.scmIpSecurityRestrictionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for scm."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionsDefaultAction": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "Allow",
+                                        "Deny"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default action for scm access restriction if no rules are matched."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionsUseMain": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. IP security restrictions for scm to use main."
+                                      }
+                                    },
+                                    "scmMinTlsVersion": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "1.0",
+                                        "1.1",
+                                        "1.2",
+                                        "1.3"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. ScmMinTlsVersion: configures the minimum version of TLS required for SSL requests for SCM site."
+                                      }
+                                    },
+                                    "scmType": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "BitbucketGit",
+                                        "BitbucketHg",
+                                        "CodePlexGit",
+                                        "CodePlexHg",
+                                        "Dropbox",
+                                        "ExternalGit",
+                                        "ExternalHg",
+                                        "GitHub",
+                                        "LocalGit",
+                                        "None",
+                                        "OneDrive",
+                                        "Tfs",
+                                        "VSO",
+                                        "VSTSRM"
+                                      ],
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SCM type."
+                                      }
+                                    },
+                                    "tracingOptions": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tracing options."
+                                      }
+                                    },
+                                    "use32BitWorkerProcess": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` to use 32-bit worker process."
+                                      }
+                                    },
+                                    "virtualApplications": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object",
+                                        "properties": {
+                                          "physicalPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Physical path."
+                                            }
+                                          },
+                                          "preloadEnabled": {
+                                            "type": "bool",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Set to `true` if preloading is enabled."
+                                            }
+                                          },
+                                          "virtualDirectories": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "object",
+                                              "properties": {
+                                                "physicalPath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Physical path."
+                                                  }
+                                                },
+                                                "virtualPath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Path to virtual application."
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Virtual directories for virtual application."
+                                            }
+                                          },
+                                          "virtualPath": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. Virtual path."
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual applications."
+                                      }
+                                    },
+                                    "vnetName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual Network name."
+                                      }
+                                    },
+                                    "vnetPrivatePortsCount": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The number of private ports assigned to this app. These will be assigned dynamically on runtime."
+                                      }
+                                    },
+                                    "vnetRouteAllEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+                                      }
+                                    },
+                                    "websiteTimeZone": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Sets the time zone a site uses for generating timestamps. Compatible with Linux and Windows App Service. Setting the WEBSITE_TIME_ZONE app setting takes precedence over this config. For Linux, expects tz database values https://www.iana.org/time-zones (for a quick reference see [ref](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)). For Windows, expects one of the time zones listed under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones."
+                                      }
+                                    },
+                                    "webSocketsEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to `true` if WebSocket is enabled."
+                                      }
+                                    },
+                                    "windowsFxVersion": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Xenon App Framework and version."
+                                      }
+                                    },
+                                    "xManagedServiceIdentityId": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Explicit Managed Service Identity Id."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The config settings."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type of a web configuration.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "slot/main.bicep"
+                                }
+                              }
+                            }
                           },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Array of role assignments to create."
-                          }
-                        },
-                        "tags": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                          }
-                        },
-                        "enableTelemetry": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable/Disable usage telemetry for module."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of Cognitive Services account."
-                      }
-                    },
-                    "sku": {
-                      "type": "string",
-                      "defaultValue": "S0",
-                      "allowedValues": [
-                        "C2",
-                        "C3",
-                        "C4",
-                        "F0",
-                        "F1",
-                        "S",
-                        "S0",
-                        "S1",
-                        "S10",
-                        "S2",
-                        "S3",
-                        "S4",
-                        "S5",
-                        "S6",
-                        "S7",
-                        "S8",
-                        "S9"
-                      ],
-                      "metadata": {
-                        "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "deployments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/deploymentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of deployments about cognitive service accounts to create."
-                      }
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointSingleServiceType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingFullType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    },
-                    "projectName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Optional. Name for the project which needs to be created."
-                      }
-                    },
-                    "projectDescription": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Optional. Description  for the project which needs to be created."
-                      }
-                    },
-                    "existingFoundryProjectResourceId": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Provide the existing project resource id in case if it needs to be reused"
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]",
-                      "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]",
-                      "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]",
-                      "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]",
-                      "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]",
-                      "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]",
-                      "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]",
-                      "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]",
-                      "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]",
-                      "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]",
-                      "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]",
-                      "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]",
-                      "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]",
-                      "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]",
-                      "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]",
-                      "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]",
-                      "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]",
-                      "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]",
-                      "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
-                      "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]",
-                      "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]",
-                      "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]",
-                      "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]",
-                      "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
-                      "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    },
-                    "enableReferencedModulesTelemetry": false
-                  },
-                  "resources": {
-                    "cognitiveService": {
-                      "existing": true,
-                      "type": "Microsoft.CognitiveServices/accounts",
-                      "apiVersion": "2025-06-01",
-                      "name": "[parameters('name')]"
-                    },
-                    "cognitiveService_deployments": {
-                      "copy": {
-                        "name": "cognitiveService_deployments",
-                        "count": "[length(coalesce(parameters('deployments'), createArray()))]",
-                        "mode": "serial",
-                        "batchSize": 1
-                      },
-                      "type": "Microsoft.CognitiveServices/accounts/deployments",
-                      "apiVersion": "2024-10-01",
-                      "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]",
-                      "properties": {
-                        "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]",
-                        "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]",
-                        "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]"
-                      },
-                      "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', 10))]"
-                    },
-                    "cognitiveService_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      }
-                    },
-                    "cognitiveService_diagnosticSettings": {
-                      "copy": {
-                        "name": "cognitiveService_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the site."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "allowedValues": [
+                                "functionapp",
+                                "functionapp,linux",
+                                "functionapp,workflowapp",
+                                "functionapp,workflowapp,linux",
+                                "functionapp,linux,container",
+                                "functionapp,linux,container,azurecontainerapps",
+                                "app,linux",
+                                "app",
+                                "linux,api",
+                                "api",
+                                "app,linux,container",
+                                "app,container,windows"
+                              ],
+                              "metadata": {
+                                "description": "Required. Type of site to deploy."
+                              }
+                            },
+                            "serverFarmResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The resource ID of the app service plan to use for the site. Set as empty string when using a managed environment id for container apps."
+                              }
+                            },
+                            "managedEnvironmentResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                              }
+                            },
+                            "httpsOnly": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Configures a site to accept only HTTPS requests. Issues redirect for HTTP requests."
+                              }
+                            },
+                            "clientAffinityEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. If client affinity is enabled."
+                              }
+                            },
+                            "clientAffinityProxyEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance. Default is true."
+                              }
+                            },
+                            "clientAffinityPartitioningEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. To enable client affinity partitioning using CHIPS cookies, this will add the partitioned property to the affinity cookies; false to stop sending partitioned affinity cookies. Default is false."
+                              }
+                            },
+                            "appServiceEnvironmentResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the app service environment to use for this resource."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityAllType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "keyVaultAccessIdentityResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                              }
+                            },
+                            "storageAccountRequired": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Checks if Customer provided storage account is required."
+                              }
+                            },
+                            "virtualNetworkSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                              }
+                            },
+                            "scmSiteAlsoStopped": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                              }
+                            },
+                            "siteConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/siteConfig"
+                                },
+                                "description": "Optional. The site config object. The defaults are set to the following values: alwaysOn: true, minTlsVersion: '1.2', ftpsState: 'FtpsOnly'."
+                              },
+                              "defaultValue": {
+                                "alwaysOn": true,
+                                "minTlsVersion": "1.2",
+                                "ftpsState": "FtpsOnly"
+                              }
+                            },
+                            "outboundVnetRouting": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                                },
+                                "description": "Optional. The outbound VNET routing configuration for the site."
+                              },
+                              "nullable": true
+                            },
+                            "configs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/configType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The web site config."
+                              }
+                            },
+                            "functionAppConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/functionAppConfig"
+                                },
+                                "description": "Optional. The Function App configuration object."
+                              },
+                              "nullable": true
+                            },
+                            "extensions": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/extensionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The extensions configuration."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointSingleServiceType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                              }
+                            },
+                            "slots": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/slotType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Configuration for deployment slots for an app."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/tags"
+                                },
+                                "description": "Optional. Tags of the resource."
+                              },
+                              "nullable": true
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "clientCertEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                              }
+                            },
+                            "clientCertExclusionPaths": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                              }
+                            },
+                            "clientCertMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/clientCertMode"
+                                },
+                                "description": "Optional. This composes with ClientCertEnabled setting.\n- ClientCertEnabled=false means ClientCert is ignored.\n- ClientCertEnabled=true and ClientCertMode=Required means ClientCert is required.\n- ClientCertEnabled=true and ClientCertMode=Optional means ClientCert is optional or accepted.\n"
+                              },
+                              "defaultValue": "Optional"
+                            },
+                            "cloningInfo": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/cloningInfo"
+                                },
+                                "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                              },
+                              "nullable": true
+                            },
+                            "containerSize": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Size of the function container."
+                              }
+                            },
+                            "dailyMemoryTimeQuota": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                              }
+                            },
+                            "enabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                              }
+                            },
+                            "hostNameSslStates": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/hostNameSslStates"
+                                },
+                                "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                              },
+                              "nullable": true
+                            },
+                            "hyperV": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Hyper-V sandbox."
+                              }
+                            },
+                            "redundancyMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/redundancyMode"
+                                },
+                                "description": "Optional. Site redundancy mode."
+                              },
+                              "defaultValue": "None"
+                            },
+                            "basicPublishingCredentialsPolicies": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The site publishing credential policy names which are associated with the sites."
+                              }
+                            },
+                            "hybridConnectionRelays": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hybridConnectionRelayType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Names of hybrid connection relays to connect app with."
+                              }
+                            },
+                            "hostNameBindings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hostNameBindingType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Host Name Bindings for the site."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                                },
+                                "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set."
+                              },
+                              "nullable": true
+                            },
+                            "e2eEncryptionEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. End to End Encryption Setting."
+                              }
+                            },
+                            "dnsConfiguration": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/dnsConfiguration"
+                                },
+                                "description": "Optional. Property to configure various DNS related settings for a site."
+                              },
+                              "nullable": true
+                            },
+                            "autoGeneratedDomainNameLabelScope": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                                },
+                                "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                              },
+                              "nullable": true
+                            },
+                            "sshEnabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Whether to enable SSH access."
+                              }
+                            },
+                            "daprConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/daprConfig"
+                                },
+                                "description": "Optional. Dapr configuration of the app."
+                              },
+                              "nullable": true
+                            },
+                            "ipMode": {
+                              "type": "string",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/ipMode"
+                                },
+                                "description": "Optional. Specifies the IP mode of the app."
+                              },
+                              "nullable": true
+                            },
+                            "resourceConfig": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/properties/properties/resourceConfig"
+                                },
+                                "description": "Optional. Function app resource requirements."
+                              },
+                              "nullable": true
+                            },
+                            "workloadProfileName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Workload profile name for function app to execute on."
+                              }
+                            },
+                            "hostNamesDisabled": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                              }
+                            },
+                            "reserved": {
+                              "type": "bool",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                              }
+                            },
+                            "extendedLocation": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Web/sites@2025-03-01#properties/extendedLocation"
+                                },
+                                "description": "Optional. Extended location of the resource."
+                              },
+                              "nullable": true
                             }
                           },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "enableReferencedModulesTelemetry": false,
+                            "managedEnvironmentSupportedKinds": [
+                              "functionapp,linux,container,azurecontainerapps"
+                            ],
+                            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                            "builtInRoleNames": {
+                              "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                              "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                              "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
                             }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      }
-                    },
-                    "cognitiveService_roleAssignments": {
-                      "copy": {
-                        "name": "cognitiveService_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      }
-                    },
-                    "cognitiveService_privateEndpoints": {
-                      "copy": {
-                        "name": "cognitiveService_privateEndpoints",
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]"
-                          },
-                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]",
-                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                          "subnetResourceId": {
-                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                          },
-                          "location": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                          },
-                          "lock": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                          },
-                          "privateDnsZoneGroup": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
                           },
-                          "customDnsConfigs": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                          },
-                          "ipConfigurations": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                          },
-                          "applicationSecurityGroupResourceIds": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                          },
-                          "customNetworkInterfaceName": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.5.1644",
-                              "templateHash": "16604612898799598358"
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('46d3xbcp.res.web-site.{0}.{1}', replace('0.23.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "app": {
+                              "type": "Microsoft.Web/sites",
+                              "apiVersion": "2025-03-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "kind": "[parameters('kind')]",
+                              "tags": "[parameters('tags')]",
+                              "identity": "[variables('identity')]",
+                              "extendedLocation": "[parameters('extendedLocation')]",
+                              "properties": {
+                                "managedEnvironmentId": "[parameters('managedEnvironmentResourceId')]",
+                                "serverFarmId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), not(empty(parameters('managedEnvironmentResourceId')))), null(), parameters('serverFarmResourceId'))]",
+                                "clientAffinityEnabled": "[if(not(empty(parameters('serverFarmResourceId'))), parameters('clientAffinityEnabled'), null())]",
+                                "clientAffinityProxyEnabled": "[parameters('clientAffinityProxyEnabled')]",
+                                "clientAffinityPartitioningEnabled": "[parameters('clientAffinityPartitioningEnabled')]",
+                                "httpsOnly": "[parameters('httpsOnly')]",
+                                "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                                "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                                "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                                "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]",
+                                "siteConfig": "[parameters('siteConfig')]",
+                                "functionAppConfig": "[parameters('functionAppConfig')]",
+                                "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                                "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                                "clientCertMode": "[if(not(empty(parameters('serverFarmResourceId'))), parameters('clientCertMode'), null())]",
+                                "cloningInfo": "[parameters('cloningInfo')]",
+                                "containerSize": "[parameters('containerSize')]",
+                                "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                                "enabled": "[parameters('enabled')]",
+                                "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                                "hyperV": "[parameters('hyperV')]",
+                                "redundancyMode": "[parameters('redundancyMode')]",
+                                "publicNetworkAccess": "[if(not(empty(parameters('serverFarmResourceId'))), if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled')), null())]",
+                                "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
+                                "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]",
+                                "dnsConfiguration": "[parameters('dnsConfiguration')]",
+                                "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                                "outboundVnetRouting": "[parameters('outboundVnetRouting')]",
+                                "sshEnabled": "[parameters('sshEnabled')]",
+                                "daprConfig": "[parameters('daprConfig')]",
+                                "ipMode": "[parameters('ipMode')]",
+                                "resourceConfig": "[parameters('resourceConfig')]",
+                                "workloadProfileName": "[parameters('workloadProfileName')]",
+                                "hostNamesDisabled": "[parameters('hostNamesDisabled')]",
+                                "reserved": "[parameters('reserved')]"
+                              }
+                            },
+                            "app_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_diagnosticSettings": {
+                              "copy": {
+                                "name": "app_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_roleAssignments": {
+                              "copy": {
+                                "name": "app_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_config": {
+                              "copy": {
+                                "name": "app_config",
+                                "count": "[length(coalesce(parameters('configs'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Site-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                                  },
+                                  "applicationInsightResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                                  },
+                                  "storageAccountResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountResourceId')]"
+                                  },
+                                  "storageAccountUseIdentityAuthentication": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication')]"
+                                  },
+                                  "properties": {
+                                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                                  },
+                                  "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites', parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]",
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "8196639045793921819"
+                                    },
+                                    "name": "Site App Settings",
+                                    "description": "This module deploys a Site App Setting."
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "appsettings",
+                                        "authsettings",
+                                        "authsettingsV2",
+                                        "azurestorageaccounts",
+                                        "backup",
+                                        "connectionstrings",
+                                        "logs",
+                                        "metadata",
+                                        "pushsettings",
+                                        "slotConfigNames",
+                                        "web"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The name of the config."
+                                      }
+                                    },
+                                    "properties": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. The properties of the config. Note: This parameter is highly dependent on the config type, defined by its name."
+                                      }
+                                    },
+                                    "storageAccountUseIdentityAuthentication": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                      }
+                                    },
+                                    "storageAccountResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                      }
+                                    },
+                                    "applicationInsightResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "currentAppSettings": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. The key-values pairs of the current app settings."
+                                        }
+                                      },
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. The current app settings."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-siteconfig.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "applicationInsights": {
+                                      "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.Insights/components",
+                                      "apiVersion": "2020-02-02",
+                                      "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
+                                      "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
+                                    },
+                                    "storageAccount": {
+                                      "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-06-01",
+                                      "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                                      "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "config": {
+                                      "type": "Microsoft.Web/sites/config",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                                      "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys('storageAccount', '2025-06-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/')), 'AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob, 'AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue, 'AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table), createObject())), if(not(empty(parameters('applicationInsightResourceId'))), shallowMerge(createArray(createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), if(not(contains(parameters('properties'), 'ApplicationInsightsAgent_EXTENSION_VERSION')), createObject('ApplicationInsightsAgent_EXTENSION_VERSION', if(contains(createArray('functionapp,linux', 'functionapp,workflowapp,linux', 'functionapp,linux,container', 'functionapp,linux,container,azurecontainerapps', 'app,linux', 'linux,api', 'app,linux,container'), reference('app', '2025-03-01', 'full').kind), '~3', '~2')), createObject()))), createObject()))]",
+                                      "dependsOn": [
+                                        "app",
+                                        "applicationInsights",
+                                        "storageAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the site config."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the site config."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the site config was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
                             },
-                            "name": "Private Endpoints",
-                            "description": "This module deploys a Private Endpoint."
-                          },
-                          "definitions": {
-                            "privateDnsZoneGroupType": {
-                              "type": "object",
+                            "app_extensions": {
+                              "copy": {
+                                "name": "app_extensions",
+                                "count": "[length(coalesce(parameters('extensions'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Site-Extension-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
                               "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "properties": {
+                                    "value": "[coalesce(parameters('extensions'), createArray())[copyIndex()].properties]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
                                   "metadata": {
-                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "13172204291630325256"
+                                    },
+                                    "name": "Site Deployment Extension ",
+                                    "description": "This module deploys a Site extension for MSDeploy."
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the parent site resource."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "MSDeploy",
+                                      "allowedValues": [
+                                        "MSDeploy"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The name of the extension."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "defaultValue": "MSDeploy",
+                                      "allowedValues": [
+                                        "MSDeploy"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The kind of extension."
+                                      }
+                                    },
+                                    "properties": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/extensions@2025-03-01#properties/properties"
+                                        },
+                                        "description": "Optional. Sets the properties."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-extension.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "msdeploy": {
+                                      "type": "Microsoft.Web/sites/extensions",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                                      "kind": "[parameters('kind')]",
+                                      "properties": "[parameters('properties')]"
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the extension."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the extension."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/extensions', parameters('appName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the extension was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
                                   }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            },
+                            "app_slots": {
+                              "copy": {
+                                "name": "app_slots",
+                                "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                                "mode": "serial",
+                                "batchSize": 1
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
                                 },
-                                "privateDnsZoneGroupConfigs": {
-                                  "type": "array",
-                                  "items": {
-                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(parameters('slots'), createArray())[copyIndex()].name]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "kind": {
+                                    "value": "[parameters('kind')]"
+                                  },
+                                  "serverFarmResourceId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), not(empty(parameters('managedEnvironmentResourceId')))), createObject('value', null()), createObject('value', parameters('serverFarmResourceId')))]",
+                                  "managedEnvironmentResourceId": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedEnvironmentResourceId'), parameters('managedEnvironmentResourceId'))]"
+                                  },
+                                  "httpsOnly": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'httpsOnly'), parameters('httpsOnly'))]"
+                                  },
+                                  "appServiceEnvironmentResourceId": {
+                                    "value": "[parameters('appServiceEnvironmentResourceId')]"
+                                  },
+                                  "clientAffinityEnabled": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityEnabled'), parameters('clientAffinityEnabled'))]"
+                                  },
+                                  "clientAffinityProxyEnabled": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityProxyEnabled'), parameters('clientAffinityProxyEnabled'))]"
+                                  },
+                                  "clientAffinityPartitioningEnabled": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientAffinityPartitioningEnabled'), parameters('clientAffinityPartitioningEnabled'))]"
+                                  },
+                                  "managedIdentities": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'managedIdentities'), parameters('managedIdentities'))]"
+                                  },
+                                  "keyVaultAccessIdentityResourceId": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'keyVaultAccessIdentityResourceId'), parameters('keyVaultAccessIdentityResourceId'))]"
+                                  },
+                                  "storageAccountRequired": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'storageAccountRequired'), parameters('storageAccountRequired'))]"
+                                  },
+                                  "virtualNetworkSubnetResourceId": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'virtualNetworkSubnetResourceId'), parameters('virtualNetworkSubnetResourceId'))]"
+                                  },
+                                  "siteConfig": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'siteConfig'), parameters('siteConfig'))]"
+                                  },
+                                  "functionAppConfig": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'functionAppConfig'), parameters('functionAppConfig'))]"
+                                  },
+                                  "configs": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'configs'), parameters('configs'))]"
+                                  },
+                                  "extensions": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'extensions'), parameters('extensions'))]"
+                                  },
+                                  "diagnosticSettings": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'diagnosticSettings')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "basicPublishingCredentialsPolicies": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'basicPublishingCredentialsPolicies'), parameters('basicPublishingCredentialsPolicies'))]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateEndpoints": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'), createArray())]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "clientCertEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertEnabled')]"
+                                  },
+                                  "clientCertExclusionPaths": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertExclusionPaths')]"
+                                  },
+                                  "clientCertMode": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'clientCertMode')]"
+                                  },
+                                  "cloningInfo": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'cloningInfo')]"
+                                  },
+                                  "containerSize": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'containerSize')]"
+                                  },
+                                  "customDomainVerificationId": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'customDomainVerificationId')]"
+                                  },
+                                  "dailyMemoryTimeQuota": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dailyMemoryTimeQuota')]"
+                                  },
+                                  "enabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'enabled')]"
+                                  },
+                                  "hostNameSslStates": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameSslStates')]"
+                                  },
+                                  "hyperV": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hyperV')]"
+                                  },
+                                  "publicNetworkAccess": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'publicNetworkAccess'), if(or(not(empty(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'privateEndpoints'))), not(empty(parameters('privateEndpoints')))), 'Disabled', 'Enabled'))]"
+                                  },
+                                  "redundancyMode": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'redundancyMode')]"
+                                  },
+                                  "hybridConnectionRelays": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hybridConnectionRelays')]"
+                                  },
+                                  "hostNameBindings": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNameBindings')]"
+                                  },
+                                  "dnsConfiguration": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'dnsConfiguration')]"
+                                  },
+                                  "autoGeneratedDomainNameLabelScope": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'autoGeneratedDomainNameLabelScope')]"
+                                  },
+                                  "outboundVnetRouting": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'outboundVnetRouting'), parameters('outboundVnetRouting'))]"
+                                  },
+                                  "sshEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'sshEnabled')]"
+                                  },
+                                  "daprConfig": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'daprConfig')]"
+                                  },
+                                  "ipMode": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'ipMode')]"
+                                  },
+                                  "resourceConfig": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'resourceConfig')]"
+                                  },
+                                  "workloadProfileName": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'workloadProfileName')]"
+                                  },
+                                  "hostNamesDisabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'hostNamesDisabled')]"
+                                  },
+                                  "reserved": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'reserved')]"
+                                  },
+                                  "scmSiteAlsoStopped": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'scmSiteAlsoStopped'), parameters('scmSiteAlsoStopped'))]"
+                                  },
+                                  "e2eEncryptionEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('slots'), createArray())[copyIndex()], 'e2eEncryptionEnabled')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "14501171431519947073"
+                                    },
+                                    "name": "Web/Function App Deployment Slots",
+                                    "description": "This module deploys a Web or Function App Deployment Slot."
+                                  },
+                                  "definitions": {
+                                    "hostNameBindingsOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the host name binding."
+                                          }
+                                        },
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resource ID of the host name binding."
+                                          }
+                                        },
+                                        "resourceGroupName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the resource group the resource was deployed into."
+                                          }
+                                        },
+                                        "certificateThumbprint": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The thumbprint of the certificate."
+                                          }
+                                        },
+                                        "certificateResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The resource ID of the certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "privateEndpointOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the private endpoint."
+                                          }
+                                        },
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resource ID of the private endpoint."
+                                          }
+                                        },
+                                        "groupId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The group Id for the private endpoint Group."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "fqdn": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "FQDN that resolves to private endpoint IP address."
+                                                }
+                                              },
+                                              "ipAddresses": {
+                                                "type": "array",
+                                                "items": {
+                                                  "type": "string"
+                                                },
+                                                "metadata": {
+                                                  "description": "A list of private IP addresses of the private endpoint."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "The custom DNS configurations of the private endpoint."
+                                          }
+                                        },
+                                        "networkInterfaceResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "configType": {
+                                      "type": "object",
+                                      "discriminator": {
+                                        "propertyName": "name",
+                                        "mapping": {
+                                          "appsettings": {
+                                            "$ref": "#/definitions/appSettingsConfigType"
+                                          },
+                                          "authsettings": {
+                                            "$ref": "#/definitions/authSettingsConfigType"
+                                          },
+                                          "authsettingsV2": {
+                                            "$ref": "#/definitions/authSettingsV2ConfigType"
+                                          },
+                                          "azurestorageaccounts": {
+                                            "$ref": "#/definitions/azureStorageAccountConfigType"
+                                          },
+                                          "backup": {
+                                            "$ref": "#/definitions/backupConfigType"
+                                          },
+                                          "connectionstrings": {
+                                            "$ref": "#/definitions/connectionStringsConfigType"
+                                          },
+                                          "logs": {
+                                            "$ref": "#/definitions/logsConfigType"
+                                          },
+                                          "metadata": {
+                                            "$ref": "#/definitions/metadataConfigType"
+                                          },
+                                          "pushsettings": {
+                                            "$ref": "#/definitions/pushSettingsConfigType"
+                                          },
+                                          "web": {
+                                            "$ref": "#/definitions/webConfigType"
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a site configuration."
+                                      }
+                                    },
+                                    "appSettingsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "appsettings"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "storageAccountUseIdentityAuthentication": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                          }
+                                        },
+                                        "applicationInsightResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                          }
+                                        },
+                                        "retainCurrentAppSettings": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The retain the current app settings. Defaults to true."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "string",
+                                            "metadata": {
+                                              "description": "Required. An app settings key-value pair."
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The app settings key-value pairs except for AzureWebJobsStorage, AzureWebJobsDashboard, APPINSIGHTS_INSTRUMENTATIONKEY and APPLICATIONINSIGHTS_CONNECTION_STRING."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an app settings configuration."
+                                      }
+                                    },
+                                    "authSettingsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "authsettings"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "aadClaimsAuthorization": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets a JSON string containing the Azure AD Acl settings."
+                                              }
+                                            },
+                                            "additionalLoginParams": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                              }
+                                            },
+                                            "allowedAudiences": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting."
+                                              }
+                                            },
+                                            "allowedExternalRedirectUrls": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                              }
+                                            },
+                                            "authFilePath": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The path of the config file containing auth settings. If the path is relative, base will the site's root directory."
+                                              }
+                                            },
+                                            "clientId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                              }
+                                            },
+                                            "clientSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                              }
+                                            },
+                                            "clientSecretCertificateThumbprint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                              }
+                                            },
+                                            "clientSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                              }
+                                            },
+                                            "configVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The ConfigVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of the control plane for Authentication / Authorization."
+                                              }
+                                            },
+                                            "defaultProvider": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "AzureActiveDirectory",
+                                                "Facebook",
+                                                "Github",
+                                                "Google",
+                                                "MicrosoftAccount",
+                                                "Twitter"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                              }
+                                            },
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                              }
+                                            },
+                                            "facebookAppId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The App ID of the Facebook app used for login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                              }
+                                            },
+                                            "facebookAppSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The App Secret of the Facebook app used for Facebook Login. This setting is required for enabling Facebook Login. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                              }
+                                            },
+                                            "facebookAppSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the app secret used for Facebook Login."
+                                              }
+                                            },
+                                            "facebookOAuthScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Facebook Login authentication. This setting is optional. Facebook Login [documentation](https://developers.facebook.com/docs/facebook-login)."
+                                              }
+                                            },
+                                            "gitHubClientId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The Client Id of the GitHub app used for login. This setting is required for enabling Github login."
+                                              }
+                                            },
+                                            "gitHubClientSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The Client Secret of the GitHub app used for Github Login. This setting is required for enabling Github login."
+                                              }
+                                            },
+                                            "gitHubClientSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the client secret of the Github app used for GitHub Login."
+                                              }
+                                            },
+                                            "gitHubOAuthScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of GitHub Login authentication."
+                                              }
+                                            },
+                                            "googleClientId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OpenID Connect Client ID for the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                              }
+                                            },
+                                            "googleClientSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The client secret associated with the Google web application. This setting is required for enabling Google Sign-In. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                              }
+                                            },
+                                            "googleClientSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the client secret associated with the Google web application."
+                                              }
+                                            },
+                                            "googleOAuthScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Google Sign-In authentication. This setting is optional. If not specified, \"openid\", \"profile\", and \"email\" are used as default scopes. Google Sign-In [documentation](https://developers.google.com/identity/sign-in/web)."
+                                              }
+                                            },
+                                            "isAuthFromFile": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "false",
+                                                "true"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. \"true\" if the auth config settings should be read from a file, \"false\" otherwise."
+                                              }
+                                            },
+                                            "issuer": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                              }
+                                            },
+                                            "microsoftAccountClientId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 client ID that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                              }
+                                            },
+                                            "microsoftAccountClientSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 client secret that was created for the app used for authentication. This setting is required for enabling Microsoft Account authentication. Microsoft Account OAuth [documentation](https://dev.onedrive.com/auth/msa_oauth.htm)."
+                                              }
+                                            },
+                                            "microsoftAccountClientSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name containing the OAuth 2.0 client secret that was created for the app used for authentication."
+                                              }
+                                            },
+                                            "microsoftAccountOAuthScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 2.0 scopes that will be requested as part of Microsoft Account authentication. This setting is optional. If not specified, \"wl.basic\" is used as the default scope. Microsoft Account Scopes and permissions [documentation](https://msdn.microsoft.com/en-us/library/dn631845.aspx)."
+                                              }
+                                            },
+                                            "runtimeVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                              }
+                                            },
+                                            "tokenRefreshExtensionHours": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                              }
+                                            },
+                                            "tokenStoreEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows. The default is `false`."
+                                              }
+                                            },
+                                            "twitterConsumerKey": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                              }
+                                            },
+                                            "twitterConsumerSecret": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The OAuth 1.0a consumer secret of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                              }
+                                            },
+                                            "twitterConsumerSecretSettingName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                              }
+                                            },
+                                            "unauthenticatedClientAction": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "AllowAnonymous",
+                                                "RedirectToLoginPage"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                              }
+                                            },
+                                            "validateIssuer": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets a value indicating whether the issuer should be a valid HTTPS url and be validated as such."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an auth settings configuration."
+                                      }
+                                    },
+                                    "authSettingsV2ConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "authsettingsV2"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "globalValidation": {
+                                              "type": "object",
+                                              "properties": {
+                                                "excludedPaths": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The paths for which unauthenticated flow would not be redirected to the login page."
+                                                  }
+                                                },
+                                                "redirectToProvider": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The default authentication provider to use when multiple providers are configured. This setting is only needed if multiple providers are configured and the unauthenticated client action is set to \"RedirectToLoginPage\"."
+                                                  }
+                                                },
+                                                "requireAuthentication": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the authentication flow is required by every request."
+                                                  }
+                                                },
+                                                "unauthenticatedClientAction": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "AllowAnonymous",
+                                                    "RedirectToLoginPage",
+                                                    "Return401",
+                                                    "Return403"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The action to take when an unauthenticated client attempts to access the app."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings that determines the validation flow of users using App Service Authentication/Authorization."
+                                              }
+                                            },
+                                            "httpSettings": {
+                                              "type": "object",
+                                              "properties": {
+                                                "forwardProxy": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "convention": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "Custom",
+                                                        "NoProxy",
+                                                        "Standard"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The convention used to determine the url of the request made."
+                                                      }
+                                                    },
+                                                    "customHostHeaderName": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the header containing the host of the request."
+                                                      }
+                                                    },
+                                                    "customProtoHeaderName": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the header containing the scheme of the request."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of a forward proxy used to make the requests."
+                                                  }
+                                                },
+                                                "requireHttps": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `false` if the authentication/authorization responses not having the HTTPS scheme are permissible."
+                                                  }
+                                                },
+                                                "routes": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "apiPrefix": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The prefix that should precede all the authentication/authorization paths."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the paths HTTP requests."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against App Service Authentication/Authorization."
+                                              }
+                                            },
+                                            "identityProviders": {
+                                              "type": "object",
+                                              "properties": {
+                                                "apple": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Apple provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the client secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Apple registration."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Apple provider."
+                                                  }
+                                                },
+                                                "azureActiveDirectory": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "isAutoProvisioned": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "disableWWWAuthenticate": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Set to `true` if the www-authenticate provider should be omitted from the request."
+                                                          }
+                                                        },
+                                                        "loginParameters": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Login parameters to send to the OpenID Connect authorization endpoint when a user logs in. Each parameter must be in the form \"key=value\"."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)."
+                                                          }
+                                                        },
+                                                        "clientSecretCertificateIssuer": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. An alternative to the client secret thumbprint, that is the issuer of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                          }
+                                                        },
+                                                        "clientSecretCertificateSubjectAlternativeName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. An alternative to the client secret thumbprint, that is the subject alternative name of a certificate used for signing purposes. This property acts as a replacement for the Client Secret Certificate Thumbprint."
+                                                          }
+                                                        },
+                                                        "clientSecretCertificateThumbprint": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. An alternative to the client secret, that is the thumbprint of a certificate used for signing purposes. This property acts as a replacement for the Client Secret."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The app setting name that contains the client secret of the relying party application."
+                                                          }
+                                                        },
+                                                        "openIdIssuer": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory app registration."
+                                                      }
+                                                    },
+                                                    "validation": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "allowedAudiences": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The list of audiences that can make successful authentication/authorization requests."
+                                                          }
+                                                        },
+                                                        "defaultAuthorizationPolicy": {
+                                                          "type": "object",
+                                                          "properties": {
+                                                            "allowedApplications": {
+                                                              "type": "array",
+                                                              "items": {
+                                                                "type": "string"
+                                                              },
+                                                              "nullable": true,
+                                                              "metadata": {
+                                                                "description": "Optional. The configuration settings of the Azure Active Directory allowed applications."
+                                                              }
+                                                            },
+                                                            "allowedPrincipals": {
+                                                              "type": "object",
+                                                              "properties": {
+                                                                "groups": {
+                                                                  "type": "array",
+                                                                  "items": {
+                                                                    "type": "string"
+                                                                  },
+                                                                  "nullable": true,
+                                                                  "metadata": {
+                                                                    "description": "Optional. The list of the allowed groups."
+                                                                  }
+                                                                },
+                                                                "identities": {
+                                                                  "type": "array",
+                                                                  "items": {
+                                                                    "type": "string"
+                                                                  },
+                                                                  "nullable": true,
+                                                                  "metadata": {
+                                                                    "description": "Optional. The list of the allowed identities."
+                                                                  }
+                                                                }
+                                                              },
+                                                              "nullable": true,
+                                                              "metadata": {
+                                                                "description": "Optional. The configuration settings of the Azure Active Directory allowed principals."
+                                                              }
+                                                            }
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The configuration settings of the default authorization policy."
+                                                          }
+                                                        },
+                                                        "jwtClaimChecks": {
+                                                          "type": "object",
+                                                          "properties": {
+                                                            "allowedClientApplications": {
+                                                              "type": "array",
+                                                              "items": {
+                                                                "type": "string"
+                                                              },
+                                                              "nullable": true,
+                                                              "metadata": {
+                                                                "description": "Optional. The list of the allowed client applications."
+                                                              }
+                                                            },
+                                                            "allowedGroups": {
+                                                              "type": "array",
+                                                              "items": {
+                                                                "type": "string"
+                                                              },
+                                                              "nullable": true,
+                                                              "metadata": {
+                                                                "description": "Optional. The list of the allowed groups."
+                                                              }
+                                                            }
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The configuration settings of the checks that should be made while validating the JWT Claims."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Azure Active directory provider."
+                                                  }
+                                                },
+                                                "azureStaticWebApps": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Azure Static Web Apps provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Static Web Apps registration."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Azure Static Web Apps provider."
+                                                  }
+                                                },
+                                                "customOpenIdConnectProviders": {
+                                                  "type": "object",
+                                                  "properties": {},
+                                                  "additionalProperties": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Set to `false` if the custom Open ID provider provider should not be enabled."
+                                                        }
+                                                      },
+                                                      "login": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "nameClaimType": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The name of the claim that contains the users name."
+                                                            }
+                                                          },
+                                                          "scopes": {
+                                                            "type": "array",
+                                                            "items": {
+                                                              "type": "string"
+                                                            },
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                            }
+                                                          }
+                                                        },
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The configuration settings of the login flow of the custom Open ID Connect provider."
+                                                        }
+                                                      },
+                                                      "registration": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "clientCredential": {
+                                                            "type": "object",
+                                                            "properties": {
+                                                              "clientSecretSettingName": {
+                                                                "type": "string",
+                                                                "metadata": {
+                                                                  "description": "Required. The app setting that contains the client secret for the custom Open ID Connect provider."
+                                                                }
+                                                              },
+                                                              "method": {
+                                                                "type": "string",
+                                                                "allowedValues": [
+                                                                  "ClientSecretPost"
+                                                                ],
+                                                                "metadata": {
+                                                                  "description": "Required. The method that should be used to authenticate the user."
+                                                                }
+                                                              }
+                                                            },
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The authentication credentials of the custom Open ID Connect provider."
+                                                            }
+                                                          },
+                                                          "clientId": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The client id of the custom Open ID Connect provider."
+                                                            }
+                                                          },
+                                                          "openIdConnectConfiguration": {
+                                                            "type": "object",
+                                                            "properties": {
+                                                              "authorizationEndpoint": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint to be used to make an authorization request."
+                                                                }
+                                                              },
+                                                              "certificationUri": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint that provides the keys necessary to validate the token."
+                                                                }
+                                                              },
+                                                              "issuer": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint that issues the token."
+                                                                }
+                                                              },
+                                                              "tokenEndpoint": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint to be used to request a token."
+                                                                }
+                                                              },
+                                                              "wellKnownOpenIdConfiguration": {
+                                                                "type": "string",
+                                                                "nullable": true,
+                                                                "metadata": {
+                                                                  "description": "Optional. The endpoint that contains all the configuration endpoints for the provider."
+                                                                }
+                                                              }
+                                                            },
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The configuration settings of the endpoints used for the custom Open ID Connect provider."
+                                                            }
+                                                          }
+                                                        },
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The configuration settings of the app registration for the custom Open ID Connect provider."
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The alias of each custom Open ID Connect provider."
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The map of the name of the alias of each custom Open ID Connect provider to the configuration settings of the custom Open ID Connect provider."
+                                                  }
+                                                },
+                                                "facebook": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Facebook provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "graphApiVersion": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The version of the Facebook api to be used while logging in."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "appId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The App ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "appSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the app secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the Facebook provider."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Facebook provider."
+                                                  }
+                                                },
+                                                "gitHub": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the GitHub provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the client secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the GitHub provider."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the GitHub provider."
+                                                  }
+                                                },
+                                                "google": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Google provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the client secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the Google provider."
+                                                      }
+                                                    },
+                                                    "validation": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "allowedAudiences": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the Azure Active Directory token validation flow."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Google provider."
+                                                  }
+                                                },
+                                                "legacyMicrosoftAccount": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the legacy Microsoft Account provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "login": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "scopes": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. A list of the scopes that should be requested while authenticating."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the login flow."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "clientId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The Client ID of the app used for login."
+                                                          }
+                                                        },
+                                                        "clientSecretSettingName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The app setting name that contains the client secret."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the legacy Microsoft Account provider."
+                                                      }
+                                                    },
+                                                    "validation": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "allowedAudiences": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The configuration settings of the allowed list of audiences from which to validate the JWT token."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the legacy Microsoft Account provider token validation flow."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the legacy Microsoft Account provider."
+                                                  }
+                                                },
+                                                "twitter": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the Twitter provider should not be enabled despite the set registration."
+                                                      }
+                                                    },
+                                                    "registration": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "consumerKey": {
+                                                          "type": "securestring",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The OAuth 1.0a consumer key of the Twitter application used for sign-in. This setting is required for enabling Twitter Sign-In. Twitter Sign-In [documentation](https://dev.twitter.com/web/sign-in)."
+                                                          }
+                                                        },
+                                                        "consumerSecretSettingName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The app setting name that contains the OAuth 1.0a consumer secret of the Twitter application used for sign-in."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the app registration for the Twitter provider."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the Twitter provider."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of each of the identity providers used to configure App Service Authentication/Authorization."
+                                              }
+                                            },
+                                            "login": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedExternalRedirectUrls": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. External URLs that can be redirected to as part of logging in or logging out of the app. Note that the query string part of the URL is ignored. This is an advanced setting typically only needed by Windows Store application backends. Note that URLs within the current domain are always implicitly allowed."
+                                                  }
+                                                },
+                                                "cookieExpiration": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "convention": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "FixedTime",
+                                                        "IdentityProviderDerived"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The convention used when determining the session cookie's expiration."
+                                                      }
+                                                    },
+                                                    "timeToExpiration": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The time after the request is made when the session cookie should expire."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the session cookie's expiration."
+                                                  }
+                                                },
+                                                "nonce": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "nonceExpirationInterval": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The time after the request is made when the nonce should expire."
+                                                      }
+                                                    },
+                                                    "validateNonce": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `false` if the nonce should not be validated while completing the login flow."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the nonce used in the login flow."
+                                                  }
+                                                },
+                                                "preserveUrlFragmentsForLogins": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the fragments from the request are preserved after the login request is made."
+                                                  }
+                                                },
+                                                "routes": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "logoutEndpoint": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The endpoint at which a logout request should be made."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The routes that specify the endpoints used for login and logout requests."
+                                                  }
+                                                },
+                                                "tokenStore": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "azureBlobStorage": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "sasUrlSettingName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name of the app setting containing the SAS URL of the blob storage containing the tokens."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the storage of the tokens if blob storage is used."
+                                                      }
+                                                    },
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `true` to durably store platform-specific security tokens that are obtained during login flows."
+                                                      }
+                                                    },
+                                                    "fileSystem": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "directory": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The directory in which the tokens will be stored."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The configuration settings of the storage of the tokens if a file system is used."
+                                                      }
+                                                    },
+                                                    "tokenRefreshExtensionHours": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The number of hours after session token expiration that a session token can be used to call the token refresh API. The default is 72 hours."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The configuration settings of the token store."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the login flow of users using App Service Authentication/Authorization."
+                                              }
+                                            },
+                                            "platform": {
+                                              "type": "object",
+                                              "properties": {
+                                                "configFilePath": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The path of the config file containing auth settings if they come from a file. If the path is relative, base will the site's root directory."
+                                                  }
+                                                },
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `true` if the Authentication / Authorization feature is enabled for the current app."
+                                                  }
+                                                },
+                                                "runtimeVersion": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The RuntimeVersion of the Authentication / Authorization feature in use for the current app. The setting in this value can control the behavior of certain features in the Authentication / Authorization module."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The configuration settings of the platform of App Service Authentication/Authorization."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an authSettingsV2 configuration."
+                                      }
+                                    },
+                                    "azureStorageAccountConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "azurestorageaccounts"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "accessKey": {
+                                                "type": "securestring",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Access key for the storage account."
+                                                }
+                                              },
+                                              "accountName": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of the storage account."
+                                                }
+                                              },
+                                              "mountPath": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                                }
+                                              },
+                                              "protocol": {
+                                                "type": "string",
+                                                "allowedValues": [
+                                                  "Http",
+                                                  "Nfs",
+                                                  "Smb"
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Mounting protocol to use for the storage account."
+                                                }
+                                              },
+                                              "shareName": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                                }
+                                              },
+                                              "type": {
+                                                "type": "string",
+                                                "allowedValues": [
+                                                  "AzureBlob",
+                                                  "AzureFiles"
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Type of storage."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The Azure Storage Info configuration."
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of an Azure Storage Account configuration."
+                                      }
+                                    },
+                                    "backupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "backup"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "backupName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Name of the backup."
+                                              }
+                                            },
+                                            "backupSchedule": {
+                                              "type": "object",
+                                              "properties": {
+                                                "frequencyInterval": {
+                                                  "type": "int",
+                                                  "metadata": {
+                                                    "description": "Required. How often the backup should be executed (e.g. for weekly backup, this should be set to 7 and FrequencyUnit should be set to Day)."
+                                                  }
+                                                },
+                                                "frequencyUnit": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Day",
+                                                    "Hour"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. The unit of time for how often the backup should be executed (e.g. for weekly backup, this should be set to Day and FrequencyInterval should be set to 7)."
+                                                  }
+                                                },
+                                                "keepAtLeastOneBackup": {
+                                                  "type": "bool",
+                                                  "metadata": {
+                                                    "description": "Required. Set to `True` if the retention policy should always keep at least one backup in the storage account, regardless how old it is."
+                                                  }
+                                                },
+                                                "retentionPeriodInDays": {
+                                                  "type": "int",
+                                                  "metadata": {
+                                                    "description": "Required. After how many days backups should be deleted."
+                                                  }
+                                                },
+                                                "startTime": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. When the schedule should start working."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Schedule for the backup if it is executed periodically."
+                                              }
+                                            },
+                                            "databases": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "connectionString": {
+                                                    "type": "securestring",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Contains a connection string to a database which is being backed up or restored. If the restore should happen to a new database, the database name inside is the new one."
+                                                    }
+                                                  },
+                                                  "connectionStringName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Contains a connection string name that is linked to the SiteConfig.ConnectionStrings. This is used during restore with overwrite connection strings options."
+                                                    }
+                                                  },
+                                                  "databaseType": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "LocalMySql",
+                                                      "MySql",
+                                                      "PostgreSql",
+                                                      "SqlAzure"
+                                                    ],
+                                                    "metadata": {
+                                                      "description": "Required. Database type (e.g. SqlAzure / MySql)."
+                                                    }
+                                                  },
+                                                  "name": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The name of the setting."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Databases included in the backup."
+                                              }
+                                            },
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `True` if the backup schedule is enabled (must be included in that case), `false` if the backup schedule should be disabled."
+                                              }
+                                            },
+                                            "storageAccountUrl": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SAS URL to the container."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a backup configuration."
+                                      }
+                                    },
+                                    "connectionStringsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "connectionstrings"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "object",
+                                            "properties": {
+                                              "type": {
+                                                "type": "string",
+                                                "allowedValues": [
+                                                  "ApiHub",
+                                                  "Custom",
+                                                  "DocDb",
+                                                  "EventHub",
+                                                  "MySql",
+                                                  "NotificationHub",
+                                                  "PostgreSQL",
+                                                  "RedisCache",
+                                                  "SQLAzure",
+                                                  "SQLServer",
+                                                  "ServiceBus"
+                                                ],
+                                                "metadata": {
+                                                  "description": "Required. Type of database."
+                                                }
+                                              },
+                                              "value": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Value of pair."
+                                                }
+                                              }
+                                            },
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The name of the connection string setting."
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a connection string configuration."
+                                      }
+                                    },
+                                    "logsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "logs"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "applicationLogs": {
+                                              "type": "object",
+                                              "properties": {
+                                                "azureBlobStorage": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "level": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "Error",
+                                                        "Information",
+                                                        "Off",
+                                                        "Verbose",
+                                                        "Warning"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Log level."
+                                                      }
+                                                    },
+                                                    "retentionInDays": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                                      }
+                                                    },
+                                                    "sasUrl": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Application logs to blob storage configuration."
+                                                  }
+                                                },
+                                                "azureTableStorage": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "level": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "Error",
+                                                        "Information",
+                                                        "Off",
+                                                        "Verbose",
+                                                        "Warning"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Log level."
+                                                      }
+                                                    },
+                                                    "sasUrl": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. SAS URL to an Azure table with add/query/delete permissions."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Application logs to azure table storage configuration."
+                                                  }
+                                                },
+                                                "fileSystem": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "level": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "Error",
+                                                        "Information",
+                                                        "Off",
+                                                        "Verbose",
+                                                        "Warning"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Log level."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Application logs to file system configuration."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application Logs for Azure configuration."
+                                              }
+                                            },
+                                            "detailedErrorMessages": {
+                                              "type": "object",
+                                              "properties": {
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Detailed error messages configuration."
+                                              }
+                                            },
+                                            "failedRequestsTracing": {
+                                              "type": "object",
+                                              "properties": {
+                                                "enabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Failed requests tracing configuration."
+                                              }
+                                            },
+                                            "httpLogs": {
+                                              "type": "object",
+                                              "properties": {
+                                                "azureBlobStorage": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                                      }
+                                                    },
+                                                    "retentionInDays": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Retention in days. Remove blobs older than X days. 0 or lower means no retention."
+                                                      }
+                                                    },
+                                                    "sasUrl": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. SAS url to a azure blob container with read/write/list/delete permissions."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Http logs to azure blob storage configuration."
+                                                  }
+                                                },
+                                                "fileSystem": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "enabled": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Set to `True` if configuration is enabled, false if it is disabled."
+                                                      }
+                                                    },
+                                                    "retentionInDays": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Retention in days. Remove files older than X days. 0 or lower means no retention."
+                                                      }
+                                                    },
+                                                    "retentionInMb": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "minValue": 25,
+                                                      "maxValue": 100,
+                                                      "metadata": {
+                                                        "description": "Optional. Maximum size in megabytes that http log files can use. When reached old log files will be removed to make space for new ones."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Http logs to file system configuration."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. HTTP logs configuration."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a logs configuration."
+                                      }
+                                    },
+                                    "metadataConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "metadata"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "string",
+                                            "nullable": true,
+                                            "metadata": {
+                                              "description": "Optional. The metadata key value pair."
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a metadata configuration."
+                                      }
+                                    },
+                                    "pushSettingsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "pushsettings"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "dynamicTagsJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                              }
+                                            },
+                                            "isPushEnabled": {
+                                              "type": "bool",
+                                              "metadata": {
+                                                "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                              }
+                                            },
+                                            "tagsRequiringAuth": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                              }
+                                            },
+                                            "tagWhitelistJson": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a pushSettings configuration."
+                                      }
+                                    },
+                                    "webConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "web"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The type of config."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "acrUseManagedIdentityCreds": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Flag to use Managed Identity Creds for ACR pull."
+                                              }
+                                            },
+                                            "acrUserManagedIdentityID": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. If using user managed identity, the user managed identity ClientId."
+                                              }
+                                            },
+                                            "alwaysOn": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if 'Always On' is enabled."
+                                              }
+                                            },
+                                            "apiDefinition": {
+                                              "type": "object",
+                                              "properties": {
+                                                "url": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The URL of the API definition."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Information about the formal API definition for the app."
+                                              }
+                                            },
+                                            "apiManagementConfig": {
+                                              "type": "object",
+                                              "properties": {
+                                                "id": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. APIM-Api Identifier."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Azure API management settings linked to the app."
+                                              }
+                                            },
+                                            "appCommandLine": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. App command line to launch."
+                                              }
+                                            },
+                                            "appSettings": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "name": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. Name of the pair."
+                                                    }
+                                                  },
+                                                  "value": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. Value of the pair."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application settings."
+                                              }
+                                            },
+                                            "autoHealEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if Auto Heal is enabled."
+                                              }
+                                            },
+                                            "autoHealRules": {
+                                              "type": "object",
+                                              "properties": {
+                                                "actions": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "actionType": {
+                                                      "type": "string",
+                                                      "allowedValues": [
+                                                        "CustomAction",
+                                                        "LogEvent",
+                                                        "Recycle"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Predefined action to be taken."
+                                                      }
+                                                    },
+                                                    "customAction": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "exe": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Executable to be run."
+                                                          }
+                                                        },
+                                                        "parameters": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Parameters for the executable."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Custom action to be taken."
+                                                      }
+                                                    },
+                                                    "minProcessExecutionTime": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Minimum time the process must execute before taking the action."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Actions to be executed when a rule is triggered."
+                                                  }
+                                                },
+                                                "triggers": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "privateBytesInKB": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on private bytes."
+                                                      }
+                                                    },
+                                                    "requests": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "count": {
+                                                          "type": "int",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Request Count."
+                                                          }
+                                                        },
+                                                        "timeInterval": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Time interval."
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on total requests."
+                                                      }
+                                                    },
+                                                    "slowRequests": {
+                                                      "$ref": "#/definitions/slowRequestBasedTriggerType",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on request execution time."
+                                                      }
+                                                    },
+                                                    "slowRequestsWithPath": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/slowRequestBasedTriggerType"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on multiple Slow Requests Rule with path."
+                                                      }
+                                                    },
+                                                    "statusCodes": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "count": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Request Count."
+                                                            }
+                                                          },
+                                                          "path": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Request Path."
+                                                            }
+                                                          },
+                                                          "status": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. HTTP status code."
+                                                            }
+                                                          },
+                                                          "subStatus": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Request Sub Status."
+                                                            }
+                                                          },
+                                                          "timeInterval": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Time interval."
+                                                            }
+                                                          },
+                                                          "win32Status": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Win32 error code."
+                                                            }
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on status codes."
+                                                      }
+                                                    },
+                                                    "statusCodesRange": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "count": {
+                                                            "type": "int",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Request Count."
+                                                            }
+                                                          },
+                                                          "path": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Path."
+                                                            }
+                                                          },
+                                                          "statusCodes": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. HTTP status code."
+                                                            }
+                                                          },
+                                                          "timeInterval": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. Time interval."
+                                                            }
+                                                          }
+                                                        }
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A rule based on status codes ranges."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Conditions that describe when to execute the auto-heal actions."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Auto Heal rules."
+                                              }
+                                            },
+                                            "autoSwapSlotName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Auto-swap slot name."
+                                              }
+                                            },
+                                            "azureStorageAccounts": {
+                                              "type": "object",
+                                              "properties": {},
+                                              "additionalProperties": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "accessKey": {
+                                                    "type": "securestring",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Access key for the storage account."
+                                                    }
+                                                  },
+                                                  "accountName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of the storage account."
+                                                    }
+                                                  },
+                                                  "mountPath": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Path to mount the storage within the site's runtime environment."
+                                                    }
+                                                  },
+                                                  "protocol": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "Http",
+                                                      "Nfs",
+                                                      "Smb"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Mounting protocol to use for the storage account."
+                                                    }
+                                                  },
+                                                  "shareName": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of the file share (container name, for Blob storage)."
+                                                    }
+                                                  },
+                                                  "type": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "AzureBlob",
+                                                      "AzureFiles"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Type of storage."
+                                                    }
+                                                  }
+                                                },
+                                                "metadata": {
+                                                  "description": "Required. A storage account configuration."
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. List of Azure Storage Accounts."
+                                              }
+                                            },
+                                            "connectionStrings": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "connectionString": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Connection string value."
+                                                    }
+                                                  },
+                                                  "name": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Name of connection string."
+                                                    }
+                                                  },
+                                                  "type": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "ApiHub",
+                                                      "Custom",
+                                                      "DocDb",
+                                                      "EventHub",
+                                                      "MySql",
+                                                      "NotificationHub",
+                                                      "PostgreSQL",
+                                                      "RedisCache",
+                                                      "SQLAzure",
+                                                      "SQLServer",
+                                                      "ServiceBus"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Type of database."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Connection strings."
+                                              }
+                                            },
+                                            "cors": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedOrigins": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Gets or sets the list of origins that should be allowed to make cross-origin calls (for example: http://example.com:12345). Use \"*\" to allow all."
+                                                  }
+                                                },
+                                                "supportCredentials": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Gets or sets whether CORS requests with credentials are allowed. See [ref](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS#Requests_with_credentials) for more details."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Cross-Origin Resource Sharing (CORS) settings."
+                                              }
+                                            },
+                                            "defaultDocuments": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Default documents."
+                                              }
+                                            },
+                                            "detailedErrorLoggingEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if detailed error logging is enabled."
+                                              }
+                                            },
+                                            "documentRoot": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Document root."
+                                              }
+                                            },
+                                            "elasticWebAppScaleLimit": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "metadata": {
+                                                "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to apps in plans where ElasticScaleEnabled is `true`."
+                                              }
+                                            },
+                                            "experiments": {
+                                              "type": "object",
+                                              "properties": {
+                                                "rampUpRules": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "actionHostName": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Hostname of a slot to which the traffic will be redirected if decided to. E.g. myapp-stage.azurewebsites.net."
+                                                        }
+                                                      },
+                                                      "changeDecisionCallbackUrl": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified."
+                                                        }
+                                                      },
+                                                      "changeIntervalInMinutes": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Specifies interval in minutes to reevaluate ReroutePercentage."
+                                                        }
+                                                      },
+                                                      "changeStep": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. In auto ramp up scenario this is the step to add/remove from `ReroutePercentage` until it reaches `MinReroutePercentage` or `MaxReroutePercentage`. Site metrics are checked every N minutes specified in `ChangeIntervalInMinutes`. Custom decision algorithm can be provided in TiPCallback site extension which URL can be specified in `ChangeDecisionCallbackUrl`."
+                                                        }
+                                                      },
+                                                      "maxReroutePercentage": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Specifies upper boundary below which ReroutePercentage will stay."
+                                                        }
+                                                      },
+                                                      "minReroutePercentage": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Specifies lower boundary above which ReroutePercentage will stay."
+                                                        }
+                                                      },
+                                                      "name": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of the routing rule. The recommended name would be to point to the slot which will receive the traffic in the experiment."
+                                                        }
+                                                      },
+                                                      "reroutePercentage": {
+                                                        "type": "int",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Percentage of the traffic which will be redirected to `ActionHostName`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. List of ramp-up rules."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. This is work around for polymorphic types."
+                                              }
+                                            },
+                                            "ftpsState": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "AllAllowed",
+                                                "Disabled",
+                                                "FtpsOnly"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. State of FTP / FTPS service."
+                                              }
+                                            },
+                                            "functionAppScaleLimit": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "metadata": {
+                                                "description": "Optional. Maximum number of workers that a site can scale out to. This setting only applies to the Consumption and Elastic Premium Plans."
+                                              }
+                                            },
+                                            "functionsRuntimeScaleMonitoringEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Gets or sets a value indicating whether functions runtime scale monitoring is enabled. When enabled, the ScaleController will not monitor event sources directly, but will instead call to the runtime to get scale status."
+                                              }
+                                            },
+                                            "handlerMappings": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "arguments": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Command-line arguments to be passed to the script processor."
+                                                    }
+                                                  },
+                                                  "extension": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Requests with this extension will be handled using the specified FastCGI application."
+                                                    }
+                                                  },
+                                                  "scriptProcessor": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The absolute path to the FastCGI application."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Handler mappings."
+                                              }
+                                            },
+                                            "healthCheckPath": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Health check path."
+                                              }
+                                            },
+                                            "http20Enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Allow clients to connect over http2.0."
+                                              }
+                                            },
+                                            "httpLoggingEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if HTTP logging is enabled."
+                                              }
+                                            },
+                                            "ipSecurityRestrictions": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/scmIpSecurityRestrictionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. IP security restrictions for main."
+                                              }
+                                            },
+                                            "ipSecurityRestrictionsDefaultAction": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Allow",
+                                                "Deny"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Default action for main access restriction if no rules are matched."
+                                              }
+                                            },
+                                            "javaContainer": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Java container."
+                                              }
+                                            },
+                                            "javaContainerVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Java container version."
+                                              }
+                                            },
+                                            "javaVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Java version."
+                                              }
+                                            },
+                                            "keyVaultReferenceIdentity": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Identity to use for Key Vault Reference authentication."
+                                              }
+                                            },
+                                            "limits": {
+                                              "type": "object",
+                                              "properties": {
+                                                "maxDiskSizeInMb": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Maximum allowed disk size usage in MB."
+                                                  }
+                                                },
+                                                "maxMemoryInMb": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Maximum allowed memory usage in MB."
+                                                  }
+                                                },
+                                                "maxPercentageCpu": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Maximum allowed CPU usage percentage."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Site limits."
+                                              }
+                                            },
+                                            "linuxFxVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Linux App Framework and version."
+                                              }
+                                            },
+                                            "loadBalancing": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "LeastRequests",
+                                                "LeastRequestsWithTieBreaker",
+                                                "LeastResponseTime",
+                                                "PerSiteRoundRobin",
+                                                "RequestHash",
+                                                "WeightedRoundRobin",
+                                                "WeightedTotalTraffic"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Site load balancing."
+                                              }
+                                            },
+                                            "localMySqlEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to enable local MySQL."
+                                              }
+                                            },
+                                            "logsDirectorySizeLimit": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. HTTP logs directory size limit."
+                                              }
+                                            },
+                                            "managedPipelineMode": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Classic",
+                                                "Integrated"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Managed pipeline mode."
+                                              }
+                                            },
+                                            "managedServiceIdentityId": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Managed Service Identity Id."
+                                              }
+                                            },
+                                            "metadata": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "name": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. Pair name."
+                                                    }
+                                                  },
+                                                  "value": {
+                                                    "type": "string",
+                                                    "metadata": {
+                                                      "description": "Required. Pair Value."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application metadata. This property cannot be retrieved, since it may contain secrets."
+                                              }
+                                            },
+                                            "minimumElasticInstanceCount": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "maxValue": 20,
+                                              "metadata": {
+                                                "description": "Optional. Number of minimum instance count for a site. This setting only applies to the Elastic Plans."
+                                              }
+                                            },
+                                            "minTlsCipherSuite": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "TLS_AES_128_GCM_SHA256",
+                                                "TLS_AES_256_GCM_SHA384",
+                                                "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
+                                                "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
+                                                "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+                                                "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
+                                                "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
+                                                "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+                                                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
+                                                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
+                                                "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+                                                "TLS_RSA_WITH_AES_128_CBC_SHA",
+                                                "TLS_RSA_WITH_AES_128_CBC_SHA256",
+                                                "TLS_RSA_WITH_AES_128_GCM_SHA256",
+                                                "TLS_RSA_WITH_AES_256_CBC_SHA",
+                                                "TLS_RSA_WITH_AES_256_CBC_SHA256",
+                                                "TLS_RSA_WITH_AES_256_GCM_SHA384"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The minimum strength TLS cipher suite allowed for an application."
+                                              }
+                                            },
+                                            "minTlsVersion": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "1.0",
+                                                "1.1",
+                                                "1.2",
+                                                "1.3"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. MinTlsVersion: configures the minimum version of TLS required for SSL requests."
+                                              }
+                                            },
+                                            "netFrameworkVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. .NET Framework version."
+                                              }
+                                            },
+                                            "nodeVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Version of Node.js."
+                                              }
+                                            },
+                                            "numberOfWorkers": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Number of workers."
+                                              }
+                                            },
+                                            "phpVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Version of PHP."
+                                              }
+                                            },
+                                            "powerShellVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Version of PowerShell."
+                                              }
+                                            },
+                                            "preWarmedInstanceCount": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 0,
+                                              "maxValue": 10,
+                                              "metadata": {
+                                                "description": "Optional. Number of preWarmed instances. This setting only applies to the Consumption and Elastic Plans."
+                                              }
+                                            },
+                                            "publicNetworkAccess": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Property to allow or block all public traffic."
+                                              }
+                                            },
+                                            "publishingUsername": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Publishing user name."
+                                              }
+                                            },
+                                            "push": {
+                                              "type": "object",
+                                              "properties": {
+                                                "kind": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Kind of resource."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "dynamicTagsJson": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Gets or sets a JSON string containing a list of dynamic tags that will be evaluated from user claims in the push registration endpoint."
+                                                      }
+                                                    },
+                                                    "isPushEnabled": {
+                                                      "type": "bool",
+                                                      "metadata": {
+                                                        "description": "Required. Gets or sets a flag indicating whether the Push endpoint is enabled."
+                                                      }
+                                                    },
+                                                    "tagsRequiringAuth": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that require user authentication to be used in the push registration endpoint. Tags can consist of alphanumeric characters and the following: '_', '@', '#', '.', ':', '-'. Validation should be performed at the PushRequestHandler."
+                                                      }
+                                                    },
+                                                    "tagWhitelistJson": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Gets or sets a JSON string containing a list of tags that are whitelisted for use by the push registration endpoint."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. PushSettings resource specific properties."
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Push endpoint settings."
+                                              }
+                                            },
+                                            "pythonVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Version of Python."
+                                              }
+                                            },
+                                            "remoteDebuggingEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if remote debugging is enabled."
+                                              }
+                                            },
+                                            "remoteDebuggingVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Remote debugging version."
+                                              }
+                                            },
+                                            "requestTracingEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if request tracing is enabled."
+                                              }
+                                            },
+                                            "requestTracingExpirationTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Request tracing expiration time."
+                                              }
+                                            },
+                                            "scmIpSecurityRestrictions": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/scmIpSecurityRestrictionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. IP security restrictions for scm."
+                                              }
+                                            },
+                                            "scmIpSecurityRestrictionsDefaultAction": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Allow",
+                                                "Deny"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Default action for scm access restriction if no rules are matched."
+                                              }
+                                            },
+                                            "scmIpSecurityRestrictionsUseMain": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. IP security restrictions for scm to use main."
+                                              }
+                                            },
+                                            "scmMinTlsVersion": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "1.0",
+                                                "1.1",
+                                                "1.2",
+                                                "1.3"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. ScmMinTlsVersion: configures the minimum version of TLS required for SSL requests for SCM site."
+                                              }
+                                            },
+                                            "scmType": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "BitbucketGit",
+                                                "BitbucketHg",
+                                                "CodePlexGit",
+                                                "CodePlexHg",
+                                                "Dropbox",
+                                                "ExternalGit",
+                                                "ExternalHg",
+                                                "GitHub",
+                                                "LocalGit",
+                                                "None",
+                                                "OneDrive",
+                                                "Tfs",
+                                                "VSO",
+                                                "VSTSRM"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SCM type."
+                                              }
+                                            },
+                                            "tracingOptions": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tracing options."
+                                              }
+                                            },
+                                            "use32BitWorkerProcess": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` to use 32-bit worker process."
+                                              }
+                                            },
+                                            "virtualApplications": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "physicalPath": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Physical path."
+                                                    }
+                                                  },
+                                                  "preloadEnabled": {
+                                                    "type": "bool",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Set to `true` if preloading is enabled."
+                                                    }
+                                                  },
+                                                  "virtualDirectories": {
+                                                    "type": "array",
+                                                    "items": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "physicalPath": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Physical path."
+                                                          }
+                                                        },
+                                                        "virtualPath": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Path to virtual application."
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Virtual directories for virtual application."
+                                                    }
+                                                  },
+                                                  "virtualPath": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. Virtual path."
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Virtual applications."
+                                              }
+                                            },
+                                            "vnetName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Virtual Network name."
+                                              }
+                                            },
+                                            "vnetPrivatePortsCount": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The number of private ports assigned to this app. These will be assigned dynamically on runtime."
+                                              }
+                                            },
+                                            "vnetRouteAllEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Virtual Network Route All enabled. This causes all outbound traffic to have Virtual Network Security Groups and User Defined Routes applied."
+                                              }
+                                            },
+                                            "websiteTimeZone": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Sets the time zone a site uses for generating timestamps. Compatible with Linux and Windows App Service. Setting the WEBSITE_TIME_ZONE app setting takes precedence over this config. For Linux, expects tz database values https://www.iana.org/time-zones (for a quick reference see [ref](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)). For Windows, expects one of the time zones listed under HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones."
+                                              }
+                                            },
+                                            "webSocketsEnabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to `true` if WebSocket is enabled."
+                                              }
+                                            },
+                                            "windowsFxVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Xenon App Framework and version."
+                                              }
+                                            },
+                                            "xManagedServiceIdentityId": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Explicit Managed Service Identity Id."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The config settings."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a web configuration."
+                                      }
+                                    },
+                                    "slowRequestBasedTriggerType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "count": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request Count."
+                                          }
+                                        },
+                                        "path": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request Path."
+                                          }
+                                        },
+                                        "timeInterval": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Time interval."
+                                          }
+                                        },
+                                        "timeTaken": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Time taken."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of aslow request based trigger."
+                                      }
+                                    },
+                                    "scmIpSecurityRestrictionType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "action": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Allow",
+                                            "Deny"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Allow or Deny access for this IP range."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. IP restriction rule description."
+                                          }
+                                        },
+                                        "headers": {
+                                          "type": "object",
+                                          "properties": {},
+                                          "additionalProperties": {
+                                            "type": "array",
+                                            "items": {
+                                              "type": "string"
+                                            },
+                                            "metadata": {
+                                              "description": "Required. A header."
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. IP restriction rule headers.\nX-Forwarded-Host (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-Host#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), all hosts(or lack of) are allowed.\n- A value is compared using ordinal-ignore-case (excluding port number).\n- Subdomain wildcards are permitted but don't match the root domain. For example, *.contoso.com matches the subdomain foo.contoso.com\nbut not the root domain contoso.com or multi-level foo.bar.contoso.com\n- Unicode host names are allowed but are converted to Punycode for matching.\n\nX-Forwarded-For (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#Examples).\nThe matching logic is ..\n- If the property is null or empty (default), any forwarded-for chains (or lack of) are allowed.\n- If any address (excluding port number) in the chain (comma separated) matches the CIDR defined by the property.\n\nX-Azure-FDID and X-FD-HealthProbe.\nThe matching logic is exact match."
+                                          }
+                                        },
+                                        "ipAddress": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. IP address the security restriction is valid for. It can be in form of pure ipv4 address (required SubnetMask property) or CIDR notation such as ipv4/mask (leading bit match). For CIDR, SubnetMask property must not be specified."
+                                          }
+                                        },
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. IP restriction rule name."
+                                          }
+                                        },
+                                        "priority": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Priority of IP restriction rule."
+                                          }
+                                        },
+                                        "subnetMask": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Subnet mask for the range of IP addresses the restriction is valid for."
+                                          }
+                                        },
+                                        "subnetTrafficTag": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. (internal) Subnet traffic tag."
+                                          }
+                                        },
+                                        "tag": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Default",
+                                            "ServiceTag",
+                                            "XffProxy"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Defines what this IP filter will be used for. This is to support IP filtering on proxies."
+                                          }
+                                        },
+                                        "vnetSubnetResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Virtual network resource id."
+                                          }
+                                        },
+                                        "vnetTrafficTag": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. (internal) Vnet traffic tag."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a IP security restriction."
+                                      }
+                                    },
+                                    "basicPublishingCredentialsPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "ftp",
+                                            "scm"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The name of the resource."
+                                          }
+                                        },
+                                        "allow": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Location for all Resources."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a basic publishing credential policy."
+                                      }
+                                    },
+                                    "hybridConnectionRelayType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "hybridConnectionResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                          }
+                                        },
+                                        "sendKeyName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the authorization rule send key to use."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a hybrid connection relay."
+                                      }
+                                    },
+                                    "hostNameBindingType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Hostname in the hostname binding. Defaults to the host name of the app/slot if not specified."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "azureResourceName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Azure resource name."
+                                          }
+                                        },
+                                        "azureResourceType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "TrafficManager",
+                                            "Website"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                          }
+                                        },
+                                        "customHostNameDnsRecordType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "A",
+                                            "CName"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                          }
+                                        },
+                                        "domainResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Fully qualified ARM domain resource URI."
+                                          }
+                                        },
+                                        "hostNameType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Managed",
+                                            "Verified"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                          }
+                                        },
+                                        "siteName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. App Service app name."
+                                          }
+                                        },
+                                        "sslState": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Disabled",
+                                            "IpBasedEnabled",
+                                            "SniEnabled"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                          }
+                                        },
+                                        "thumbprint": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. SSL certificate thumbprint."
+                                          }
+                                        },
+                                        "certificate": {
+                                          "$ref": "#/definitions/certificateType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate creation properties. If specified, a certificate will be created and used for this hostname binding."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a host name binding."
+                                      }
+                                    },
+                                    "_1.privateEndpointCustomDnsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                          }
+                                        },
+                                        "ipAddresses": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of private IP addresses of the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointIpConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the resource that is unique within a resource group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "memberName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "privateIPAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of private endpoint IP configurations."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                                }
+                                              },
+                                              "privateDnsZoneResourceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of the private DNS zone."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "certificateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Certificate name."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource location."
+                                          }
+                                        },
+                                        "hostNames": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate host names."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault resource ID."
+                                          }
+                                        },
+                                        "keyVaultSecretName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault secret name."
+                                          }
+                                        },
+                                        "serverFarmResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Server farm resource ID."
+                                          }
+                                        },
+                                        "canonicalName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                          }
+                                        },
+                                        "password": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate password."
+                                          }
+                                        },
+                                        "pfxBlob": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate data in PFX format."
+                                          }
+                                        },
+                                        "domainValidationMethod": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Method of domain validation for free certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a certificate.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "../modules/certificate.bicep"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "managedIdentityAllType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "systemAssigned": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enables system assigned managed identity on the resource."
+                                          }
+                                        },
+                                        "userAssignedResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpointSingleServiceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private Endpoint."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The location to deploy the Private Endpoint to."
+                                          }
+                                        },
+                                        "privateLinkServiceConnectionName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private link connection to create."
+                                          }
+                                        },
+                                        "service": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                          }
+                                        },
+                                        "resourceGroupResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                          }
+                                        },
+                                        "privateDnsZoneGroup": {
+                                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                          }
+                                        },
+                                        "isManualConnection": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If Manual Private Link Connection is required."
+                                          }
+                                        },
+                                        "manualConnectionRequestMessage": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "maxLength": 140,
+                                          "metadata": {
+                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Custom DNS configurations."
+                                          }
+                                        },
+                                        "ipConfigurations": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                          }
+                                        },
+                                        "applicationSecurityGroupResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                          }
+                                        },
+                                        "customNetworkInterfaceName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                          }
+                                        },
+                                        "lock": {
+                                          "$ref": "#/definitions/lockType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                          }
+                                        },
+                                        "enableTelemetry": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable/Disable usage telemetry for module."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the slot."
+                                      }
+                                    },
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "functionapp",
+                                        "functionapp,linux",
+                                        "functionapp,workflowapp",
+                                        "functionapp,workflowapp,linux",
+                                        "functionapp,linux,container",
+                                        "functionapp,linux,container,azurecontainerapps",
+                                        "app,linux",
+                                        "app",
+                                        "linux,api",
+                                        "api",
+                                        "app,linux,container",
+                                        "app,container,windows"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Type of site to deploy."
+                                      }
+                                    },
+                                    "serverFarmResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the app service plan to use for the slot."
+                                      }
+                                    },
+                                    "managedEnvironmentResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure Resource Manager ID of the customers selected Managed Environment on which to host this app."
+                                      }
+                                    },
+                                    "httpsOnly": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Configures a slot to accept only HTTPS requests. Issues redirect for HTTP requests."
+                                      }
+                                    },
+                                    "clientAffinityEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. If client affinity is enabled."
+                                      }
+                                    },
+                                    "clientAffinityProxyEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. To enable client affinity; false to stop sending session affinity cookies, which route client requests in the same session to the same instance. Default is true."
+                                      }
+                                    },
+                                    "clientAffinityPartitioningEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. To enable client affinity partitioning using CHIPS cookies, this will add the partitioned property to the affinity cookies; false to stop sending partitioned affinity cookies. Default is false."
+                                      }
+                                    },
+                                    "appServiceEnvironmentResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the app service environment to use for this resource."
+                                      }
+                                    },
+                                    "managedIdentities": {
+                                      "$ref": "#/definitions/managedIdentityAllType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity definition for this resource."
+                                      }
+                                    },
+                                    "keyVaultAccessIdentityResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The resource ID of the assigned identity to be used to access a key vault with."
+                                      }
+                                    },
+                                    "storageAccountRequired": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Checks if Customer provided storage account is required."
+                                      }
+                                    },
+                                    "virtualNetworkSubnetResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined by Regional VNET Integration. This must be of the form /subscriptions/{subscriptionName}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/virtualNetworks/{vnetName}/subnets/{subnetName}."
+                                      }
+                                    },
+                                    "siteConfig": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/siteConfig"
+                                        },
+                                        "description": "Optional. The site config object."
+                                      },
+                                      "defaultValue": {
+                                        "alwaysOn": true
+                                      }
+                                    },
+                                    "functionAppConfig": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/functionAppConfig"
+                                        },
+                                        "description": "Optional. The Function App config object."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "configs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/configType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The web site config."
+                                      }
+                                    },
+                                    "extensions": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "object"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The extensions configuration."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration details for private endpoints."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    },
+                                    "clientCertEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. To enable client certificate authentication (TLS mutual authentication)."
+                                      }
+                                    },
+                                    "clientCertExclusionPaths": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Client certificate authentication comma-separated exclusion paths."
+                                      }
+                                    },
+                                    "clientCertMode": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/clientCertMode"
+                                        },
+                                        "description": "Optional. This composes with ClientCertEnabled setting.</p>- ClientCertEnabled: false means ClientCert is ignored.</p>- ClientCertEnabled: true and ClientCertMode: Required means ClientCert is required.</p>- ClientCertEnabled: true and ClientCertMode: Optional means ClientCert is optional or accepted."
+                                      },
+                                      "defaultValue": "Optional"
+                                    },
+                                    "cloningInfo": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/cloningInfo"
+                                        },
+                                        "description": "Optional. If specified during app creation, the app is cloned from a source app."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "containerSize": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Size of the function container."
+                                      }
+                                    },
+                                    "customDomainVerificationId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                                      }
+                                    },
+                                    "dailyMemoryTimeQuota": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Maximum allowed daily memory-time quota (applicable on dynamic apps only)."
+                                      }
+                                    },
+                                    "enabled": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Setting this value to false disables the app (takes the app offline)."
+                                      }
+                                    },
+                                    "hostNameSslStates": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/hostNameSslStates"
+                                        },
+                                        "description": "Optional. Hostname SSL states are used to manage the SSL bindings for app's hostnames."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "hyperV": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Hyper-V sandbox."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/publicNetworkAccess"
+                                        },
+                                        "description": "Optional. Allow or block all public traffic."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "redundancyMode": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/redundancyMode"
+                                        },
+                                        "description": "Optional. Site redundancy mode."
+                                      },
+                                      "defaultValue": "None"
+                                    },
+                                    "basicPublishingCredentialsPolicies": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/basicPublishingCredentialsPolicyType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The site publishing credential policy names which are associated with the site slot."
+                                      }
+                                    },
+                                    "outboundVnetRouting": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/outboundVnetRouting"
+                                        },
+                                        "description": "Optional. The outbound VNET routing configuration for the site."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "hybridConnectionRelays": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/hybridConnectionRelayType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Names of hybrid connection relays to connect app with."
+                                      }
+                                    },
+                                    "hostNameBindings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/hostNameBindingType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Host Name Bindings for the slot."
+                                      }
+                                    },
+                                    "dnsConfiguration": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/dnsConfiguration"
+                                        },
+                                        "description": "Optional. Property to configure various DNS related settings for a site."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "autoGeneratedDomainNameLabelScope": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/autoGeneratedDomainNameLabelScope"
+                                        },
+                                        "description": "Optional. Specifies the scope of uniqueness for the default hostname during resource creation."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "sshEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Whether to enable SSH access."
+                                      }
+                                    },
+                                    "daprConfig": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/daprConfig"
+                                        },
+                                        "description": "Optional. Dapr configuration of the app."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipMode": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/ipMode"
+                                        },
+                                        "description": "Optional. Specifies the IP mode of the app."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "resourceConfig": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Web/sites/slots@2025-03-01#properties/properties/properties/resourceConfig"
+                                        },
+                                        "description": "Optional. Function app resource requirements."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "workloadProfileName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Workload profile name for function app to execute on."
+                                      }
+                                    },
+                                    "hostNamesDisabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. True to disable the public hostnames of the app; otherwise, false. If true, the app is only accessible via API management process."
+                                      }
+                                    },
+                                    "reserved": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. True if reserved (Linux); otherwise, false (Windows)."
+                                      }
+                                    },
+                                    "scmSiteAlsoStopped": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Stop SCM (KUDU) site when the app is stopped."
+                                      }
+                                    },
+                                    "e2eEncryptionEnabled": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. End to End Encryption Setting."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
                                   },
-                                  "metadata": {
-                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type of a private dns zone group."
-                              }
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                },
-                                "notes": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the notes of the lock."
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "enableReferencedModulesTelemetry": false,
+                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                                    "builtInRoleNames": {
+                                      "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                                      "Web Plan Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2cc479cb-7b4d-49a8-b449-8c00fd0f0a4b')]",
+                                      "Website Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'de139f84-1756-47ae-9be6-808fbbe84772')]"
+                                    },
+                                    "managedEnvironmentSupportedKinds": [
+                                      "functionapp,linux,container,azurecontainerapps"
+                                    ]
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-siteslot.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "slot": {
+                                      "type": "Microsoft.Web/sites/slots",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "kind": "[parameters('kind')]",
+                                      "tags": "[parameters('tags')]",
+                                      "identity": "[variables('identity')]",
+                                      "properties": {
+                                        "managedEnvironmentId": "[if(not(empty(parameters('managedEnvironmentResourceId'))), parameters('managedEnvironmentResourceId'), null())]",
+                                        "serverFarmId": "[if(and(contains(variables('managedEnvironmentSupportedKinds'), parameters('kind')), or(not(empty(reference('app').managedEnvironmentId)), not(empty(parameters('managedEnvironmentResourceId'))))), null(), parameters('serverFarmResourceId'))]",
+                                        "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
+                                        "clientAffinityProxyEnabled": "[parameters('clientAffinityProxyEnabled')]",
+                                        "clientAffinityPartitioningEnabled": "[parameters('clientAffinityPartitioningEnabled')]",
+                                        "httpsOnly": "[parameters('httpsOnly')]",
+                                        "hostingEnvironmentProfile": "[if(not(empty(parameters('appServiceEnvironmentResourceId'))), createObject('id', parameters('appServiceEnvironmentResourceId')), null())]",
+                                        "storageAccountRequired": "[parameters('storageAccountRequired')]",
+                                        "keyVaultReferenceIdentity": "[parameters('keyVaultAccessIdentityResourceId')]",
+                                        "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetResourceId')]",
+                                        "siteConfig": "[parameters('siteConfig')]",
+                                        "functionAppConfig": "[parameters('functionAppConfig')]",
+                                        "clientCertEnabled": "[parameters('clientCertEnabled')]",
+                                        "clientCertExclusionPaths": "[parameters('clientCertExclusionPaths')]",
+                                        "clientCertMode": "[parameters('clientCertMode')]",
+                                        "cloningInfo": "[parameters('cloningInfo')]",
+                                        "containerSize": "[parameters('containerSize')]",
+                                        "customDomainVerificationId": "[parameters('customDomainVerificationId')]",
+                                        "dailyMemoryTimeQuota": "[parameters('dailyMemoryTimeQuota')]",
+                                        "enabled": "[parameters('enabled')]",
+                                        "hostNameSslStates": "[parameters('hostNameSslStates')]",
+                                        "hyperV": "[parameters('hyperV')]",
+                                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                                        "redundancyMode": "[parameters('redundancyMode')]",
+                                        "dnsConfiguration": "[parameters('dnsConfiguration')]",
+                                        "autoGeneratedDomainNameLabelScope": "[parameters('autoGeneratedDomainNameLabelScope')]",
+                                        "outboundVnetRouting": "[parameters('outboundVnetRouting')]",
+                                        "sshEnabled": "[parameters('sshEnabled')]",
+                                        "daprConfig": "[parameters('daprConfig')]",
+                                        "ipMode": "[parameters('ipMode')]",
+                                        "resourceConfig": "[parameters('resourceConfig')]",
+                                        "workloadProfileName": "[parameters('workloadProfileName')]",
+                                        "hostNamesDisabled": "[parameters('hostNamesDisabled')]",
+                                        "reserved": "[parameters('reserved')]",
+                                        "scmSiteAlsoStopped": "[parameters('scmSiteAlsoStopped')]",
+                                        "endToEndEncryptionEnabled": "[parameters('e2eEncryptionEnabled')]"
+                                      },
+                                      "dependsOn": [
+                                        "app"
+                                      ]
+                                    },
+                                    "slot_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "slot_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_roleAssignments": {
+                                      "copy": {
+                                        "name": "slot_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_basicPublishingCredentialsPolicies": {
+                                      "copy": {
+                                        "name": "slot_basicPublishingCredentialsPolicies",
+                                        "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                                          },
+                                          "allow": {
+                                            "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "11365254968018384105"
+                                            },
+                                            "name": "Web Site Slot Basic Publishing Credentials Policies",
+                                            "description": "This module deploys a Web Site Slot Basic Publishing Credentials Policy."
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "scm",
+                                                "ftp"
+                                              ],
+                                              "metadata": {
+                                                "description": "Required. The name of the resource."
+                                              }
+                                            },
+                                            "allow": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                              }
+                                            },
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all Resources."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.web-site-slotbasicpubcredpolicy.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            {
+                                              "type": "Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                              "location": "[parameters('location')]",
+                                              "properties": {
+                                                "allow": "[parameters('allow')]"
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the basic publishing credential policy."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the basic publishing credential policy."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference(resourceId('Microsoft.Web/sites/slots/basicPublishingCredentialsPolicies', parameters('appName'), parameters('slotName'), parameters('name')), '2025-03-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_hybridConnectionRelays": {
+                                      "copy": {
+                                        "name": "slot_hybridConnectionRelays",
+                                        "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "hybridConnectionResourceId": {
+                                            "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].hybridConnectionResourceId]"
+                                          },
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "sendKeyName": {
+                                            "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "8029912709642202991"
+                                            },
+                                            "name": "Web/Function Apps Slot Hybrid Connection Relay",
+                                            "description": "This module deploys a Site Slot Hybrid Connection Namespace Relay."
+                                          },
+                                          "parameters": {
+                                            "hybridConnectionResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "sendKeyName": {
+                                              "type": "string",
+                                              "defaultValue": "defaultSender",
+                                              "metadata": {
+                                                "description": "Optional. Name of the authorization rule send key to use."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.web-site-slothybconnnamespacerelay.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            {
+                                              "type": "Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                              "properties": {
+                                                "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                                                "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                                                "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                                                "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                                "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[0]]",
+                                                "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[1])]",
+                                                "sendKeyName": "[parameters('sendKeyName')]",
+                                                "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2024-01-01').primaryKey]"
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the hybrid connection relay.."
+                                              },
+                                              "value": "[format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the hybrid connection relay."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2], split(format('{0}/{1}/{2}/{3}', parameters('appName'), parameters('slotName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[3])]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the resource was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_hostNameBindings": {
+                                      "copy": {
+                                        "name": "slot_hostNameBindings",
+                                        "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-HostNameBinding-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'name'), reference('slot').defaultHostName)]"
+                                          },
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "kind": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'kind')]"
+                                          },
+                                          "azureResourceName": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceName')]"
+                                          },
+                                          "azureResourceType": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceType')]"
+                                          },
+                                          "customHostNameDnsRecordType": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'customHostNameDnsRecordType')]"
+                                          },
+                                          "domainResourceId": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'domainResourceId')]"
+                                          },
+                                          "hostNameType": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'hostNameType')]"
+                                          },
+                                          "siteName": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'siteName')]"
+                                          },
+                                          "sslState": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'sslState')]"
+                                          },
+                                          "thumbprint": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'thumbprint')]"
+                                          },
+                                          "certificate": {
+                                            "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'certificate')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "16648305975161016120"
+                                            },
+                                            "name": "Web/Function Apps Slot Host Name Bindings",
+                                            "description": "This module deploys a Site Slot Host Name Binding."
+                                          },
+                                          "definitions": {
+                                            "certificateType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. Certificate name."
+                                                  }
+                                                },
+                                                "location": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource location."
+                                                  }
+                                                },
+                                                "hostNames": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate host names."
+                                                  }
+                                                },
+                                                "tags": {
+                                                  "type": "object",
+                                                  "metadata": {
+                                                    "__bicep_resource_derived_type!": {
+                                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                    },
+                                                    "description": "Optional. Tags of the resource."
+                                                  },
+                                                  "nullable": true
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Kind of resource."
+                                                  }
+                                                },
+                                                "keyVaultResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault resource ID."
+                                                  }
+                                                },
+                                                "keyVaultSecretName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault secret name."
+                                                  }
+                                                },
+                                                "serverFarmResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Server farm resource ID."
+                                                  }
+                                                },
+                                                "canonicalName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                  }
+                                                },
+                                                "password": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate password."
+                                                  }
+                                                },
+                                                "pfxBlob": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate data in PFX format."
+                                                  }
+                                                },
+                                                "domainValidationMethod": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Method of domain validation for free certificate."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "The type of a certificate.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "../../modules/certificate.bicep"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Hostname in the hostname binding."
+                                              }
+                                            },
+                                            "kind": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Kind of resource."
+                                              }
+                                            },
+                                            "azureResourceName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Azure resource name."
+                                              }
+                                            },
+                                            "azureResourceType": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "Website",
+                                                "TrafficManager"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                              }
+                                            },
+                                            "customHostNameDnsRecordType": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "CName",
+                                                "A"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                              }
+                                            },
+                                            "domainResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Fully qualified ARM domain resource URI."
+                                              }
+                                            },
+                                            "hostNameType": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "Verified",
+                                                "Managed"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                              }
+                                            },
+                                            "siteName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. App Service app name."
+                                              }
+                                            },
+                                            "sslState": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "Disabled",
+                                                "SniEnabled",
+                                                "IpBasedEnabled"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                              }
+                                            },
+                                            "thumbprint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. SSL certificate thumbprint."
+                                              }
+                                            },
+                                            "certificate": {
+                                              "$ref": "#/definitions/certificateType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate object with properties for certificate creation. The expected structure matches the certificateType defined in host-name-binding-type.bicep."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Resource location."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "app::slot": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites/slots",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                            },
+                                            "app": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('appName')]"
+                                            },
+                                            "hostNameBinding": {
+                                              "type": "Microsoft.Web/sites/slots/hostNameBindings",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                              "kind": "[parameters('kind')]",
+                                              "properties": {
+                                                "azureResourceName": "[parameters('azureResourceName')]",
+                                                "azureResourceType": "[parameters('azureResourceType')]",
+                                                "customHostNameDnsRecordType": "[parameters('customHostNameDnsRecordType')]",
+                                                "domainId": "[parameters('domainResourceId')]",
+                                                "hostNameType": "[parameters('hostNameType')]",
+                                                "siteName": "[parameters('siteName')]",
+                                                "sslState": "[coalesce(parameters('sslState'), if(or(not(empty(parameters('thumbprint'))), not(empty(parameters('certificate')))), 'SniEnabled', null()))]",
+                                                "thumbprint": "[coalesce(parameters('thumbprint'), tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value'))]"
+                                              },
+                                              "dependsOn": [
+                                                "sslCertificate"
+                                              ]
+                                            },
+                                            "sslCertificate": {
+                                              "condition": "[not(empty(parameters('certificate')))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('{0}-Cert', uniqueString(deployment().name, parameters('location')))]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', replace(parameters('name'), '.', '-')))]"
+                                                  },
+                                                  "location": {
+                                                    "value": "[parameters('location')]"
+                                                  },
+                                                  "kind": {
+                                                    "value": "[parameters('kind')]"
+                                                  },
+                                                  "hostNames": {
+                                                    "value": "[coalesce(tryGet(parameters('certificate'), 'hostNames'), createArray(parameters('name')))]"
+                                                  },
+                                                  "password": {
+                                                    "value": "[tryGet(parameters('certificate'), 'password')]"
+                                                  },
+                                                  "pfxBlob": {
+                                                    "value": "[tryGet(parameters('certificate'), 'pfxBlob')]"
+                                                  },
+                                                  "serverFarmResourceId": {
+                                                    "value": "[tryGet(parameters('certificate'), 'serverFarmResourceId')]"
+                                                  },
+                                                  "keyVaultResourceId": {
+                                                    "value": "[tryGet(parameters('certificate'), 'keyVaultResourceId')]"
+                                                  },
+                                                  "keyVaultSecretName": {
+                                                    "value": "[tryGet(parameters('certificate'), 'keyVaultSecretName')]"
+                                                  },
+                                                  "canonicalName": {
+                                                    "value": "[tryGet(parameters('certificate'), 'canonicalName')]"
+                                                  },
+                                                  "domainValidationMethod": {
+                                                    "value": "[tryGet(parameters('certificate'), 'domainValidationMethod')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.43.8.12551",
+                                                      "templateHash": "5581960621773069173"
+                                                    },
+                                                    "name": "Web/Function Apps Certificates",
+                                                    "description": "This module deploys a Web/Function App Certificate."
+                                                  },
+                                                  "definitions": {
+                                                    "certificateType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. Certificate name."
+                                                          }
+                                                        },
+                                                        "location": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Resource location."
+                                                          }
+                                                        },
+                                                        "hostNames": {
+                                                          "type": "array",
+                                                          "items": {
+                                                            "type": "string"
+                                                          },
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Certificate host names."
+                                                          }
+                                                        },
+                                                        "tags": {
+                                                          "type": "object",
+                                                          "metadata": {
+                                                            "__bicep_resource_derived_type!": {
+                                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                            },
+                                                            "description": "Optional. Tags of the resource."
+                                                          },
+                                                          "nullable": true
+                                                        },
+                                                        "kind": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Kind of resource."
+                                                          }
+                                                        },
+                                                        "keyVaultResourceId": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Key Vault resource ID."
+                                                          }
+                                                        },
+                                                        "keyVaultSecretName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Key Vault secret name."
+                                                          }
+                                                        },
+                                                        "serverFarmResourceId": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Server farm resource ID."
+                                                          }
+                                                        },
+                                                        "canonicalName": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                          }
+                                                        },
+                                                        "password": {
+                                                          "type": "securestring",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Certificate password."
+                                                          }
+                                                        },
+                                                        "pfxBlob": {
+                                                          "type": "securestring",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Certificate data in PFX format."
+                                                          }
+                                                        },
+                                                        "domainValidationMethod": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Method of domain validation for free certificate."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true,
+                                                        "description": "The type of a certificate."
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. Certificate name."
+                                                      }
+                                                    },
+                                                    "location": {
+                                                      "type": "string",
+                                                      "defaultValue": "[resourceGroup().location]",
+                                                      "metadata": {
+                                                        "description": "Optional. Resource location."
+                                                      }
+                                                    },
+                                                    "hostNames": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Certificate host names."
+                                                      }
+                                                    },
+                                                    "tags": {
+                                                      "type": "object",
+                                                      "metadata": {
+                                                        "__bicep_resource_derived_type!": {
+                                                          "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                        },
+                                                        "description": "Optional. Tags of the resource."
+                                                      },
+                                                      "nullable": true
+                                                    },
+                                                    "kind": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Kind of resource."
+                                                      }
+                                                    },
+                                                    "keyVaultResourceId": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Key Vault resource ID."
+                                                      }
+                                                    },
+                                                    "keyVaultSecretName": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Key Vault secret name."
+                                                      }
+                                                    },
+                                                    "serverFarmResourceId": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Server farm resource ID."
+                                                      }
+                                                    },
+                                                    "canonicalName": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                      }
+                                                    },
+                                                    "password": {
+                                                      "type": "securestring",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Certificate password."
+                                                      }
+                                                    },
+                                                    "pfxBlob": {
+                                                      "type": "securestring",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Certificate data in PFX format."
+                                                      }
+                                                    },
+                                                    "domainValidationMethod": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Method of domain validation for free certificate."
+                                                      }
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "certificate": {
+                                                      "type": "Microsoft.Web/certificates",
+                                                      "apiVersion": "2024-11-01",
+                                                      "name": "[parameters('name')]",
+                                                      "location": "[parameters('location')]",
+                                                      "kind": "[parameters('kind')]",
+                                                      "tags": "[parameters('tags')]",
+                                                      "properties": {
+                                                        "hostNames": "[parameters('hostNames')]",
+                                                        "password": "[parameters('password')]",
+                                                        "pfxBlob": "[parameters('pfxBlob')]",
+                                                        "serverFarmId": "[parameters('serverFarmResourceId')]",
+                                                        "keyVaultId": "[parameters('keyVaultResourceId')]",
+                                                        "keyVaultSecretName": "[parameters('keyVaultSecretName')]",
+                                                        "canonicalName": "[parameters('canonicalName')]",
+                                                        "domainValidationMethod": "[parameters('domainValidationMethod')]"
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the certificate."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Web/certificates', parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group the certificate was deployed into."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the certificate."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "thumbprint": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The thumbprint of the certificate."
+                                                      },
+                                                      "value": "[reference('certificate').thumbprint]"
+                                                    },
+                                                    "location": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The location the resource was deployed into."
+                                                      },
+                                                      "value": "[reference('certificate', '2024-11-01', 'full').location]"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the host name binding."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the host name binding."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/hostNameBindings', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the resource was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "certificateThumbprint": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The thumbprint of the certificate."
+                                              },
+                                              "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value')]"
+                                            },
+                                            "certificateResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The resource ID of the certificate."
+                                              },
+                                              "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'resourceId'), 'value')]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_config": {
+                                      "copy": {
+                                        "name": "slot_config",
+                                        "count": "[length(coalesce(parameters('configs'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "applicationInsightResourceId": {
+                                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                                          },
+                                          "properties": {
+                                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                                          },
+                                          "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]",
+                                          "storageAccountResourceId": {
+                                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountResourceId')]"
+                                          },
+                                          "storageAccountUseIdentityAuthentication": {
+                                            "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'storageAccountUseIdentityAuthentication')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "12001043390442225147"
+                                            },
+                                            "name": "Site App Settings",
+                                            "description": "This module deploys a Site App Setting."
+                                          },
+                                          "parameters": {
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "appsettings",
+                                                "authsettings",
+                                                "authsettingsV2",
+                                                "azurestorageaccounts",
+                                                "backup",
+                                                "connectionstrings",
+                                                "logs",
+                                                "metadata",
+                                                "pushsettings",
+                                                "web"
+                                              ],
+                                              "metadata": {
+                                                "description": "Required. The name of the config."
+                                              }
+                                            },
+                                            "properties": {
+                                              "type": "object",
+                                              "defaultValue": {},
+                                              "metadata": {
+                                                "description": "Optional. The properties of the config. Note: This parameter is highly dependent on the config type, defined by its name."
+                                              }
+                                            },
+                                            "currentAppSettings": {
+                                              "type": "object",
+                                              "properties": {},
+                                              "additionalProperties": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The key-values pairs of the current app settings."
+                                                }
+                                              },
+                                              "defaultValue": {},
+                                              "metadata": {
+                                                "description": "Optional. The current app settings."
+                                              }
+                                            },
+                                            "storageAccountUseIdentityAuthentication": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. If the provided storage account requires Identity based authentication ('allowSharedKeyAccess' is set to false). When set to true, the minimum role assignment required for the App Service Managed Identity to the storage account is 'Storage Blob Data Owner'."
+                                              }
+                                            },
+                                            "storageAccountResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Required if app of kind functionapp. Resource ID of the storage account to manage triggers and logging function executions."
+                                              }
+                                            },
+                                            "applicationInsightResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "app::slot": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites/slots",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                            },
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.web-site-slotconfig.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "applicationInsights": {
+                                              "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
+                                              "existing": true,
+                                              "type": "Microsoft.Insights/components",
+                                              "apiVersion": "2020-02-02",
+                                              "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
+                                              "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
+                                              "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
+                                            },
+                                            "storageAccount": {
+                                              "condition": "[not(empty(parameters('storageAccountResourceId')))]",
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2025-01-01",
+                                              "subscriptionId": "[split(parameters('storageAccountResourceId'), '/')[2]]",
+                                              "resourceGroup": "[split(parameters('storageAccountResourceId'), '/')[4]]",
+                                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                                            },
+                                            "app": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[parameters('appName')]"
+                                            },
+                                            "config": {
+                                              "type": "Microsoft.Web/sites/slots/config",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                              "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(and(not(empty(parameters('storageAccountResourceId'))), not(parameters('storageAccountUseIdentityAuthentication'))), createObject('AzureWebJobsStorage', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', last(split(parameters('storageAccountResourceId'), '/')), listKeys('storageAccount', '2025-01-01').keys[0].value, environment().suffixes.storage)), if(and(not(empty(parameters('storageAccountResourceId'))), parameters('storageAccountUseIdentityAuthentication')), createObject('AzureWebJobsStorage__accountName', last(split(parameters('storageAccountResourceId'), '/')), 'AzureWebJobsStorage__blobServiceUri', reference('storageAccount').primaryEndpoints.blob, 'AzureWebJobsStorage__queueServiceUri', reference('storageAccount').primaryEndpoints.queue, 'AzureWebJobsStorage__tableServiceUri', reference('storageAccount').primaryEndpoints.table), createObject())), if(not(empty(parameters('applicationInsightResourceId'))), shallowMerge(createArray(createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), if(not(contains(parameters('properties'), 'ApplicationInsightsAgent_EXTENSION_VERSION')), createObject('ApplicationInsightsAgent_EXTENSION_VERSION', if(contains(createArray('functionapp,linux', 'functionapp,workflowapp,linux', 'functionapp,linux,container', 'functionapp,linux,container,azurecontainerapps', 'app,linux', 'linux,api', 'app,linux,container'), reference('app::slot', '2025-03-01', 'full').kind), '~3', '~2')), createObject()))), createObject()))]",
+                                              "dependsOn": [
+                                                "app::slot",
+                                                "applicationInsights",
+                                                "storageAccount"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the site config."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the site config."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/config', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the site config was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "app_extensions": {
+                                      "copy": {
+                                        "name": "app_extensions",
+                                        "count": "[length(coalesce(parameters('extensions'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Slot-Extension={1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "appName": {
+                                            "value": "[parameters('appName')]"
+                                          },
+                                          "slotName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[tryGet(coalesce(parameters('extensions'), createArray())[copyIndex()], 'name')]"
+                                          },
+                                          "kind": {
+                                            "value": "[tryGet(coalesce(parameters('extensions'), createArray())[copyIndex()], 'kind')]"
+                                          },
+                                          "properties": {
+                                            "value": "[coalesce(parameters('extensions'), createArray())[copyIndex()].properties]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "8496500083519229596"
+                                            },
+                                            "name": "Site Deployment Extension ",
+                                            "description": "This module deploys a Site extension for MSDeploy."
+                                          },
+                                          "parameters": {
+                                            "appName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "slotName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent web site slot. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "MSDeploy",
+                                              "allowedValues": [
+                                                "MSDeploy"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. The name of the extension."
+                                              }
+                                            },
+                                            "kind": {
+                                              "type": "string",
+                                              "defaultValue": "MSDeploy",
+                                              "allowedValues": [
+                                                "MSDeploy"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. The kind of extension."
+                                              }
+                                            },
+                                            "properties": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Web/sites/extensions@2024-04-01#properties/properties"
+                                                },
+                                                "description": "Optional. Sets the properties."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "app::slot": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites/slots",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}', parameters('appName'), parameters('slotName'))]"
+                                            },
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.web-site-slotextension.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "app": {
+                                              "existing": true,
+                                              "type": "Microsoft.Web/sites",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[parameters('appName')]"
+                                            },
+                                            "msdeploy": {
+                                              "type": "Microsoft.Web/sites/slots/extensions",
+                                              "apiVersion": "2025-03-01",
+                                              "name": "[format('{0}/{1}/{2}', parameters('appName'), parameters('slotName'), parameters('name'))]",
+                                              "kind": "[parameters('kind')]",
+                                              "properties": "[parameters('properties')]"
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the extension."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the extension."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/sites/slots/extensions', parameters('appName'), parameters('slotName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the extensino was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    },
+                                    "slot_privateEndpoints": {
+                                      "copy": {
+                                        "name": "slot_privateEndpoints",
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-slot-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex()))]"
+                                          },
+                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))))))), createObject('value', null()))]",
+                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('appName')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name'))), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('appName')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), format('sites-{0}', parameters('name')))), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                          "subnetResourceId": {
+                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          },
+                                          "location": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                          },
+                                          "lock": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                          },
+                                          "privateDnsZoneGroup": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "customDnsConfigs": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                          },
+                                          "applicationSecurityGroupResourceIds": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                          },
+                                          "customNetworkInterfaceName": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "18436885663402767850"
+                                            },
+                                            "name": "Private Endpoints",
+                                            "description": "This module deploys a Private Endpoint."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                                  }
+                                                },
+                                                "privateDnsZoneGroupConfigs": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private dns zone group."
+                                              }
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                },
+                                                "notes": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the notes of the lock."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a lock.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                                }
+                                              }
+                                            },
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "The type of a private DNS zone group configuration.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the private endpoint resource to create."
+                                              }
+                                            },
+                                            "subnetResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                              }
+                                            },
+                                            "applicationSecurityGroupResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                              }
+                                            },
+                                            "customNetworkInterfaceName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                                },
+                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "ipVersionType": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                                },
+                                                "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                                              },
+                                              "defaultValue": "IPv4"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all Resources."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                                },
+                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                                },
+                                                "description": "Optional. Custom DNS configurations."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "manualPrivateLinkServiceConnections": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                                },
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "privateLinkServiceConnections": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                                },
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint": {
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "applicationSecurityGroups",
+                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                                    "input": {
+                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                                    }
+                                                  }
+                                                ],
+                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                                "subnet": {
+                                                  "id": "[parameters('subnetResourceId')]"
+                                                },
+                                                "ipVersionType": "[parameters('ipVersionType')]"
+                                              }
+                                            },
+                                            "privateEndpoint_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_roleAssignments": {
+                                              "copy": {
+                                                "name": "privateEndpoint_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_privateDnsZoneGroup": {
+                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2025-04-01",
+                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                                  },
+                                                  "privateEndpointName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "privateDnsZoneConfigs": {
+                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.41.2.15936",
+                                                      "templateHash": "9935179114830442414"
+                                                    },
+                                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                                  },
+                                                  "definitions": {
+                                                    "privateDnsZoneGroupConfigType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name of the private DNS zone group config."
+                                                          }
+                                                        },
+                                                        "privateDnsZoneResourceId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The resource id of the private DNS zone."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true,
+                                                        "description": "The type of a private DNS zone group configuration."
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "privateEndpointName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "privateDnsZoneConfigs": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                      },
+                                                      "minLength": 1,
+                                                      "maxLength": 5,
+                                                      "metadata": {
+                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "defaultValue": "default",
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the private DNS zone group."
+                                                      }
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "privateEndpoint": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Network/privateEndpoints",
+                                                      "apiVersion": "2025-05-01",
+                                                      "name": "[parameters('privateEndpointName')]"
+                                                    },
+                                                    "privateDnsZoneGroup": {
+                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                                      "apiVersion": "2025-05-01",
+                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "copy": [
+                                                          {
+                                                            "name": "privateDnsZoneConfigs",
+                                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                            "input": {
+                                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                              "properties": {
+                                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                              }
+                                                            }
+                                                          }
+                                                        ]
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                                  "output": true
+                                                },
+                                                "description": "The custom DNS configurations of the private endpoint."
+                                              },
+                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                            },
+                                            "networkInterfaceResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "metadata": {
+                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                              },
+                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                            },
+                                            "groupId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The group Id for the private endpoint Group."
+                                              },
+                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "slot"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the slot."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the slot."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/slots', parameters('appName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the slot was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "systemAssignedMIPrincipalId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The principal ID of the system assigned identity."
+                                      },
+                                      "value": "[tryGet(tryGet(reference('slot', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('slot', '2025-03-01', 'full').location]"
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The private endpoints of the slot."
+                                      },
+                                      "copy": {
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                        "input": {
+                                          "name": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                          "resourceId": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                          "groupId": "[tryGet(tryGet(reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                          "customDnsConfigs": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                          "networkInterfaceResourceIds": "[reference(format('slot_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                        }
+                                      }
+                                    },
+                                    "hostNameBindings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/hostNameBindingsOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The host name bindings of the slot."
+                                      },
+                                      "copy": {
+                                        "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]",
+                                        "input": {
+                                          "name": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.name.value]",
+                                          "resourceId": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.resourceId.value]",
+                                          "resourceGroupName": "[reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs.resourceGroupName.value]",
+                                          "certificateThumbprint": "[tryGet(tryGet(reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateThumbprint'), 'value')]",
+                                          "certificateResourceId": "[tryGet(tryGet(reference(format('slot_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateResourceId'), 'value')]"
+                                        }
+                                      }
+                                    }
                                   }
                                 }
                               },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a lock.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                }
-                              }
+                              "dependsOn": [
+                                "app"
+                              ]
                             },
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
-                                  }
-                                },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
+                            "app_basicPublishingCredentialsPolicies": {
+                              "copy": {
+                                "name": "app_basicPublishingCredentialsPolicies",
+                                "count": "[length(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray()))]"
                               },
-                              "metadata": {
-                                "description": "The type of a private DNS zone group configuration.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                }
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-Site-Publish-Cred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
                               "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
                                 },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "webAppName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()].name]"
+                                  },
+                                  "allow": {
+                                    "value": "[tryGet(coalesce(parameters('basicPublishingCredentialsPolicies'), createArray())[copyIndex()], 'allow')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
                                   }
                                 },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
                                   "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the private endpoint resource to create."
-                              }
-                            },
-                            "subnetResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                              }
-                            },
-                            "applicationSecurityGroupResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                              }
-                            },
-                            "customNetworkInterfaceName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                              }
-                            },
-                            "ipConfigurations": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/ipConfigurations"
-                                },
-                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                              },
-                              "nullable": true
-                            },
-                            "privateDnsZoneGroup": {
-                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "14948693817081044849"
+                                    },
+                                    "name": "Web Site Basic Publishing Credentials Policies",
+                                    "description": "This module deploys a Web Site Basic Publishing Credentials Policy."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "scm",
+                                        "ftp"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. The name of the resource."
+                                      }
+                                    },
+                                    "allow": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Set to true to enable or false to disable a publishing method."
+                                      }
+                                    },
+                                    "webAppName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-basicpublishingcredpolicy.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}', parameters('webAppName'), parameters('name'))]",
+                                      "location": "[parameters('location')]",
+                                      "properties": {
+                                        "allow": "[parameters('allow')]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the basic publishing credential policy."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the basic publishing credential policy."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the basic publishing credential policy was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference(resourceId('Microsoft.Web/sites/basicPublishingCredentialsPolicies', parameters('webAppName'), parameters('name')), '2025-03-01', 'full').location]"
+                                    }
+                                  }
+                                }
                               },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
+                              "dependsOn": [
+                                "app"
+                              ]
                             },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/tags"
-                                },
-                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                            "app_hybridConnectionRelays": {
+                              "copy": {
+                                "name": "app_hybridConnectionRelays",
+                                "count": "[length(coalesce(parameters('hybridConnectionRelays'), createArray()))]"
                               },
-                              "nullable": true
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs"
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[format('{0}-HybridConnectionRelay-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
                                 },
-                                "description": "Optional. Custom DNS configurations."
-                              },
-                              "nullable": true
-                            },
-                            "manualPrivateLinkServiceConnections": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "hybridConnectionResourceId": {
+                                    "value": "[coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()].hybridConnectionResourceId]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "sendKeyName": {
+                                    "value": "[tryGet(coalesce(parameters('hybridConnectionRelays'), createArray())[copyIndex()], 'sendKeyName')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
                                 },
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "16409478718621567661"
+                                    },
+                                    "name": "Web/Function Apps Hybrid Connection Relay",
+                                    "description": "This module deploys a Site Hybrid Connection Namespace Relay."
+                                  },
+                                  "parameters": {
+                                    "hybridConnectionResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource ID of the relay namespace hybrid connection."
+                                      }
+                                    },
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent web site. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "sendKeyName": {
+                                      "type": "string",
+                                      "defaultValue": "defaultSender",
+                                      "metadata": {
+                                        "description": "Optional. Name of the authorization rule send key to use."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.web-site-hybconnnamespacerelay.{0}.{1}', replace('0.1.0', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Web/sites/hybridConnectionNamespaces/relays",
+                                      "apiVersion": "2025-03-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                      "properties": {
+                                        "serviceBusNamespace": "[split(parameters('hybridConnectionResourceId'), '/')[8]]",
+                                        "serviceBusSuffix": "[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2024-01-01').serviceBusEndpoint, '.servicebus')), ':')[0]]",
+                                        "relayName": "[split(parameters('hybridConnectionResourceId'), '/')[10]]",
+                                        "relayArmUri": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]",
+                                        "hostname": "[split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[0]]",
+                                        "port": "[int(split(json(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '2024-01-01').userMetadata)[0].value, ':')[1])]",
+                                        "sendKeyName": "[parameters('sendKeyName')]",
+                                        "sendKeyValue": "[listKeys(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces/hybridConnections/authorizationRules', split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10], parameters('sendKeyName')), '2024-01-01').primaryKey]"
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the hybrid connection relay.."
+                                      },
+                                      "value": "[format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10])]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the hybrid connection relay."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/hybridConnectionNamespaces/relays', split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[0], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[1], split(format('{0}/{1}/{2}', parameters('appName'), split(parameters('hybridConnectionResourceId'), '/')[8], split(parameters('hybridConnectionResourceId'), '/')[10]), '/')[2])]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the resource was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
                               },
-                              "nullable": true
+                              "dependsOn": [
+                                "app"
+                              ]
                             },
-                            "privateLinkServiceConnections": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/privateLinkServiceConnections"
-                                },
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                            "app_hostNameBindings": {
+                              "copy": {
+                                "name": "app_hostNameBindings",
+                                "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]"
                               },
-                              "nullable": true
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
                               "type": "Microsoft.Resources/deployments",
                               "apiVersion": "2025-04-01",
-                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "name": "[format('{0}-HostNameBinding-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
                               "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
                                 "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'name'), reference('app').defaultHostName)]"
+                                  },
+                                  "appName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "kind": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'kind')]"
+                                  },
+                                  "azureResourceName": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceName')]"
+                                  },
+                                  "azureResourceType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'azureResourceType')]"
+                                  },
+                                  "customHostNameDnsRecordType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'customHostNameDnsRecordType')]"
+                                  },
+                                  "domainResourceId": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'domainResourceId')]"
+                                  },
+                                  "hostNameType": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'hostNameType')]"
+                                  },
+                                  "siteName": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'siteName')]"
+                                  },
+                                  "sslState": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'sslState')]"
+                                  },
+                                  "thumbprint": {
+                                    "value": "[tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'thumbprint')]"
+                                  },
+                                  "certificate": "[if(contains(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()], 'certificate'), createObject('value', union(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()].certificate, createObject('serverFarmResourceId', coalesce(tryGet(coalesce(parameters('hostNameBindings'), createArray())[copyIndex()].certificate, 'serverFarmResourceId'), parameters('serverFarmResourceId'))))), createObject('value', null()))]",
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  }
+                                },
                                 "template": {
                                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
                                   "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.43.8.12551",
+                                      "templateHash": "3602988070549748557"
+                                    },
+                                    "name": "Web/Function Apps Slot Host Name Bindings",
+                                    "description": "This module deploys a Site Slot Host Name Binding."
+                                  },
+                                  "definitions": {
+                                    "certificateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Certificate name."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource location."
+                                          }
+                                        },
+                                        "hostNames": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate host names."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags of the resource."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Kind of resource."
+                                          }
+                                        },
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault resource ID."
+                                          }
+                                        },
+                                        "keyVaultSecretName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key Vault secret name."
+                                          }
+                                        },
+                                        "serverFarmResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Server farm resource ID."
+                                          }
+                                        },
+                                        "canonicalName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                          }
+                                        },
+                                        "password": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate password."
+                                          }
+                                        },
+                                        "pfxBlob": {
+                                          "type": "securestring",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Certificate data in PFX format."
+                                          }
+                                        },
+                                        "domainValidationMethod": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Method of domain validation for free certificate."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a certificate.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "../modules/certificate.bicep"
+                                        }
+                                      }
                                     }
-                                  }
-                                }
-                              }
-                            },
-                            "privateEndpoint": {
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2024-10-01",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "applicationSecurityGroups",
-                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                    "input": {
-                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                  },
+                                  "parameters": {
+                                    "appName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent site resource. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Hostname in the hostname binding."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Kind of resource."
+                                      }
+                                    },
+                                    "azureResourceName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Azure resource name."
+                                      }
+                                    },
+                                    "azureResourceType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Website",
+                                        "TrafficManager"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Azure resource type. Possible values are Website and TrafficManager."
+                                      }
+                                    },
+                                    "customHostNameDnsRecordType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "CName",
+                                        "A"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Custom DNS record type. Possible values are CName and A."
+                                      }
+                                    },
+                                    "domainResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Fully qualified ARM domain resource URI."
+                                      }
+                                    },
+                                    "hostNameType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Verified",
+                                        "Managed"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Hostname type. Possible values are Verified and Managed."
+                                      }
+                                    },
+                                    "siteName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. App Service app name."
+                                      }
+                                    },
+                                    "sslState": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "SniEnabled",
+                                        "IpBasedEnabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. SSL type. Possible values are Disabled, SniEnabled, and IpBasedEnabled."
+                                      }
+                                    },
+                                    "thumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. SSL certificate thumbprint."
+                                      }
+                                    },
+                                    "certificate": {
+                                      "$ref": "#/definitions/certificateType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Certificate object with properties for certificate creation. The expected structure matches the certificateType defined in host-name-binding-type.bicep."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Resource location."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "app": {
+                                      "existing": true,
+                                      "type": "Microsoft.Web/sites",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('appName')]"
+                                    },
+                                    "hostNameBinding": {
+                                      "type": "Microsoft.Web/sites/hostNameBindings",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
+                                      "kind": "[parameters('kind')]",
+                                      "properties": {
+                                        "azureResourceName": "[parameters('azureResourceName')]",
+                                        "azureResourceType": "[parameters('azureResourceType')]",
+                                        "customHostNameDnsRecordType": "[parameters('customHostNameDnsRecordType')]",
+                                        "domainId": "[parameters('domainResourceId')]",
+                                        "hostNameType": "[parameters('hostNameType')]",
+                                        "siteName": "[parameters('siteName')]",
+                                        "sslState": "[coalesce(parameters('sslState'), if(or(not(empty(parameters('thumbprint'))), not(empty(parameters('certificate')))), 'SniEnabled', null()))]",
+                                        "thumbprint": "[coalesce(parameters('thumbprint'), tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value'))]"
+                                      },
+                                      "dependsOn": [
+                                        "sslCertificate"
+                                      ]
+                                    },
+                                    "sslCertificate": {
+                                      "condition": "[not(empty(parameters('certificate')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-Cert', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', replace(parameters('name'), '.', '-')))]"
+                                          },
+                                          "location": {
+                                            "value": "[parameters('location')]"
+                                          },
+                                          "kind": {
+                                            "value": "[parameters('kind')]"
+                                          },
+                                          "hostNames": {
+                                            "value": "[coalesce(tryGet(parameters('certificate'), 'hostNames'), createArray(parameters('name')))]"
+                                          },
+                                          "password": {
+                                            "value": "[tryGet(parameters('certificate'), 'password')]"
+                                          },
+                                          "pfxBlob": {
+                                            "value": "[tryGet(parameters('certificate'), 'pfxBlob')]"
+                                          },
+                                          "serverFarmResourceId": {
+                                            "value": "[tryGet(parameters('certificate'), 'serverFarmResourceId')]"
+                                          },
+                                          "keyVaultResourceId": {
+                                            "value": "[tryGet(parameters('certificate'), 'keyVaultResourceId')]"
+                                          },
+                                          "keyVaultSecretName": {
+                                            "value": "[tryGet(parameters('certificate'), 'keyVaultSecretName')]"
+                                          },
+                                          "canonicalName": {
+                                            "value": "[tryGet(parameters('certificate'), 'canonicalName')]"
+                                          },
+                                          "domainValidationMethod": {
+                                            "value": "[tryGet(parameters('certificate'), 'domainValidationMethod')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.43.8.12551",
+                                              "templateHash": "5581960621773069173"
+                                            },
+                                            "name": "Web/Function Apps Certificates",
+                                            "description": "This module deploys a Web/Function App Certificate."
+                                          },
+                                          "definitions": {
+                                            "certificateType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. Certificate name."
+                                                  }
+                                                },
+                                                "location": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource location."
+                                                  }
+                                                },
+                                                "hostNames": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate host names."
+                                                  }
+                                                },
+                                                "tags": {
+                                                  "type": "object",
+                                                  "metadata": {
+                                                    "__bicep_resource_derived_type!": {
+                                                      "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                    },
+                                                    "description": "Optional. Tags of the resource."
+                                                  },
+                                                  "nullable": true
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Kind of resource."
+                                                  }
+                                                },
+                                                "keyVaultResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault resource ID."
+                                                  }
+                                                },
+                                                "keyVaultSecretName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Key Vault secret name."
+                                                  }
+                                                },
+                                                "serverFarmResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Server farm resource ID."
+                                                  }
+                                                },
+                                                "canonicalName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                                  }
+                                                },
+                                                "password": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate password."
+                                                  }
+                                                },
+                                                "pfxBlob": {
+                                                  "type": "securestring",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Certificate data in PFX format."
+                                                  }
+                                                },
+                                                "domainValidationMethod": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Method of domain validation for free certificate."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a certificate."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Certificate name."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Resource location."
+                                              }
+                                            },
+                                            "hostNames": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate host names."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Web/certificates@2024-11-01#properties/tags"
+                                                },
+                                                "description": "Optional. Tags of the resource."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "kind": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Kind of resource."
+                                              }
+                                            },
+                                            "keyVaultResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key Vault resource ID."
+                                              }
+                                            },
+                                            "keyVaultSecretName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key Vault secret name."
+                                              }
+                                            },
+                                            "serverFarmResourceId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Server farm resource ID."
+                                              }
+                                            },
+                                            "canonicalName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. CNAME of the certificate to be issued via free certificate."
+                                              }
+                                            },
+                                            "password": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate password."
+                                              }
+                                            },
+                                            "pfxBlob": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Certificate data in PFX format."
+                                              }
+                                            },
+                                            "domainValidationMethod": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Method of domain validation for free certificate."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "certificate": {
+                                              "type": "Microsoft.Web/certificates",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "kind": "[parameters('kind')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "hostNames": "[parameters('hostNames')]",
+                                                "password": "[parameters('password')]",
+                                                "pfxBlob": "[parameters('pfxBlob')]",
+                                                "serverFarmId": "[parameters('serverFarmResourceId')]",
+                                                "keyVaultId": "[parameters('keyVaultResourceId')]",
+                                                "keyVaultSecretName": "[parameters('keyVaultSecretName')]",
+                                                "canonicalName": "[parameters('canonicalName')]",
+                                                "domainValidationMethod": "[parameters('domainValidationMethod')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the certificate."
+                                              },
+                                              "value": "[resourceId('Microsoft.Web/certificates', parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the certificate was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the certificate."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "thumbprint": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The thumbprint of the certificate."
+                                              },
+                                              "value": "[reference('certificate').thumbprint]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('certificate', '2024-11-01', 'full').location]"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the host name binding."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the host name binding."
+                                      },
+                                      "value": "[resourceId('Microsoft.Web/sites/hostNameBindings', parameters('appName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the resource was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "certificateThumbprint": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The thumbprint of the certificate."
+                                      },
+                                      "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'thumbprint'), 'value')]"
+                                    },
+                                    "certificateResourceId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The resource ID of the certificate."
+                                      },
+                                      "value": "[tryGet(tryGet(tryGet(if(not(empty(parameters('certificate'))), reference('sslCertificate'), null()), 'outputs'), 'resourceId'), 'value')]"
                                     }
                                   }
-                                ],
-                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                "subnet": {
-                                  "id": "[parameters('subnetResourceId')]"
                                 }
-                              }
-                            },
-                            "privateEndpoint_lock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                              "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
                               },
                               "dependsOn": [
-                                "privateEndpoint"
+                                "app"
                               ]
                             },
-                            "privateEndpoint_roleAssignments": {
+                            "app_privateEndpoints": {
                               "copy": {
-                                "name": "privateEndpoint_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                              "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                "name": "app_privateEndpoints",
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
                               },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_privateDnsZoneGroup": {
-                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
                               "type": "Microsoft.Resources/deployments",
                               "apiVersion": "2025-04-01",
-                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "name": "[format('{0}-app-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                              "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                              "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
                               "properties": {
                                 "expressionEvaluationOptions": {
                                   "scope": "inner"
@@ -4722,13 +90009,42 @@
                                 "mode": "Incremental",
                                 "parameters": {
                                   "name": {
-                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex()))]"
                                   },
-                                  "privateEndpointName": {
-                                    "value": "[parameters('name')]"
+                                  "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')))))), createObject('value', null()))]",
+                                  "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Web/sites', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Web/sites', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'sites')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                  "subnetResourceId": {
+                                    "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
                                   },
-                                  "privateDnsZoneConfigs": {
-                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  },
+                                  "location": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                  },
+                                  "lock": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                  },
+                                  "privateDnsZoneGroup": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                  },
+                                  "customDnsConfigs": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                  },
+                                  "ipConfigurations": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                  },
+                                  "applicationSecurityGroupResourceIds": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                  },
+                                  "customNetworkInterfaceName": {
+                                    "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
                                   }
                                 },
                                 "template": {
@@ -4738,599 +90054,1938 @@
                                   "metadata": {
                                     "_generator": {
                                       "name": "bicep",
-                                      "version": "0.38.5.1644",
-                                      "templateHash": "24141742673128945"
+                                      "version": "0.41.2.15936",
+                                      "templateHash": "18436885663402767850"
+                                    },
+                                    "name": "Private Endpoints",
+                                    "description": "This module deploys a Private Endpoint."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a private dns zone group."
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
+                                      }
+                                    },
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a private DNS zone group configuration.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                        }
+                                      }
                                     },
-                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                  },
-                                  "definitions": {
-                                    "privateDnsZoneGroupConfigType": {
+                                    "roleAssignmentType": {
                                       "type": "object",
                                       "properties": {
                                         "name": {
                                           "type": "string",
                                           "nullable": true,
                                           "metadata": {
-                                            "description": "Optional. The name of the private DNS zone group config."
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
                                           }
                                         },
-                                        "privateDnsZoneResourceId": {
+                                        "roleDefinitionIdOrName": {
                                           "type": "string",
                                           "metadata": {
-                                            "description": "Required. The resource id of the private DNS zone."
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
                                           }
                                         }
                                       },
                                       "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type of a private DNS zone group configuration."
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.7.0"
+                                        }
                                       }
                                     }
                                   },
                                   "parameters": {
-                                    "privateEndpointName": {
+                                    "name": {
                                       "type": "string",
                                       "metadata": {
-                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                        "description": "Required. Name of the private endpoint resource to create."
                                       }
                                     },
-                                    "privateDnsZoneConfigs": {
+                                    "subnetResourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                      }
+                                    },
+                                    "applicationSecurityGroupResourceIds": {
                                       "type": "array",
                                       "items": {
-                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                        "type": "string"
                                       },
-                                      "minLength": 1,
-                                      "maxLength": 5,
+                                      "nullable": true,
                                       "metadata": {
-                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                        "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
                                       }
                                     },
-                                    "name": {
+                                    "customNetworkInterfaceName": {
                                       "type": "string",
-                                      "defaultValue": "default",
+                                      "nullable": true,
                                       "metadata": {
-                                        "description": "Optional. The name of the private DNS zone group."
+                                        "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                      }
+                                    },
+                                    "ipConfigurations": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipConfigurations"
+                                        },
+                                        "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "ipVersionType": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/ipVersionType"
+                                        },
+                                        "description": "Optional. Specifies the IP version type for the private IPs of the private endpoint. If not defined, this defaults to IPv4."
+                                      },
+                                      "defaultValue": "IPv4"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "$ref": "#/definitions/privateDnsZoneGroupType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs"
+                                        },
+                                        "description": "Optional. Custom DNS configurations."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "manualPrivateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/manualPrivateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "privateLinkServiceConnections": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/privateLinkServiceConnections"
+                                        },
+                                        "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
                                       }
                                     }
                                   },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                      "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                      "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                      "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                      "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                    }
+                                  },
                                   "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
                                     "privateEndpoint": {
-                                      "existing": true,
                                       "type": "Microsoft.Network/privateEndpoints",
-                                      "apiVersion": "2024-10-01",
-                                      "name": "[parameters('privateEndpointName')]"
-                                    },
-                                    "privateDnsZoneGroup": {
-                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                      "apiVersion": "2024-10-01",
-                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "apiVersion": "2025-05-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
                                       "properties": {
                                         "copy": [
                                           {
-                                            "name": "privateDnsZoneConfigs",
-                                            "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                            "name": "applicationSecurityGroups",
+                                            "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
                                             "input": {
-                                              "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                              "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                            }
+                                          }
+                                        ],
+                                        "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                        "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                        "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                        "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                        "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                        "subnet": {
+                                          "id": "[parameters('subnetResourceId')]"
+                                        },
+                                        "ipVersionType": "[parameters('ipVersionType')]"
+                                      }
+                                    },
+                                    "privateEndpoint_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_roleAssignments": {
+                                      "copy": {
+                                        "name": "privateEndpoint_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    },
+                                    "privateEndpoint_privateDnsZoneGroup": {
+                                      "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2025-04-01",
+                                      "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                          },
+                                          "privateEndpointName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateDnsZoneConfigs": {
+                                            "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.41.2.15936",
+                                              "templateHash": "9935179114830442414"
+                                            },
+                                            "name": "Private Endpoint Private DNS Zone Groups",
+                                            "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
                                               "properties": {
-                                                "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a private DNS zone group configuration."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "privateEndpointName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
                                               }
+                                            },
+                                            "privateDnsZoneConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                              },
+                                              "minLength": 1,
+                                              "maxLength": 5,
+                                              "metadata": {
+                                                "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the private DNS zone group."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "privateEndpoint": {
+                                              "existing": true,
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[parameters('privateEndpointName')]"
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                              "apiVersion": "2025-05-01",
+                                              "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "privateDnsZoneConfigs",
+                                                    "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                    "input": {
+                                                      "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId, '/')))]",
+                                                      "properties": {
+                                                        "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigs')].privateDnsZoneResourceId]"
+                                                      }
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint DNS zone group."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
                                             }
                                           }
-                                        ]
-                                      }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "privateEndpoint"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('privateEndpoint', '2025-05-01', 'full').location]"
+                                    },
+                                    "customDnsConfigs": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Network/privateEndpoints@2025-05-01#properties/properties/properties/customDnsConfigs",
+                                          "output": true
+                                        },
+                                        "description": "The custom DNS configurations of the private endpoint."
+                                      },
+                                      "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                    },
+                                    "networkInterfaceResourceIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                      },
+                                      "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                    },
+                                    "groupId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The group Id for the private endpoint Group."
+                                      },
+                                      "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "app"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the site."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the site."
+                              },
+                              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the site was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('app', '2025-03-01', 'full'), 'identity'), 'principalId')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('app', '2025-03-01', 'full').location]"
+                            },
+                            "defaultHostname": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Default hostname of the app."
+                              },
+                              "value": "[reference('app').defaultHostName]"
+                            },
+                            "customDomainVerificationId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Unique identifier that verifies the custom domains assigned to the app. Customer will add this ID to a txt record for verification."
+                              },
+                              "value": "[reference('app').customDomainVerificationId]"
+                            },
+                            "outboundIpAddresses": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The outbound IP addresses of the app."
+                              },
+                              "value": "[reference('app').outboundIpAddresses]"
+                            },
+                            "privateEndpoints": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateEndpointOutputType"
+                              },
+                              "metadata": {
+                                "description": "The private endpoints of the site."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "groupId": "[tryGet(tryGet(reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                  "customDnsConfigs": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                  "networkInterfaceResourceIds": "[reference(format('app_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                }
+                              }
+                            },
+                            "slots": {
+                              "type": "array",
+                              "items": {
+                                "type": "object",
+                                "properties": {
+                                  "name": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "The name of the slot."
                                     }
                                   },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[parameters('name')]"
+                                  "resourceId": {
+                                    "type": "string",
+                                    "metadata": {
+                                      "description": "The resource ID of the slot."
+                                    }
+                                  },
+                                  "systemAssignedMIPrincipalId": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "The principal ID of the system assigned identity of the slot."
+                                    }
+                                  },
+                                  "privateEndpoints": {
+                                    "type": "array",
+                                    "items": {
+                                      "$ref": "#/definitions/privateEndpointOutputType"
                                     },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    "metadata": {
+                                      "description": "The private endpoints of the slot."
+                                    }
+                                  },
+                                  "hostNameBindings": {
+                                    "type": "array",
+                                    "items": {
+                                      "$ref": "#/definitions/hostNameBindingsOutputType"
                                     },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                      },
-                                      "value": "[resourceGroup().name]"
+                                    "metadata": {
+                                      "description": "The host name bindings of the slot."
                                     }
                                   }
                                 }
                               },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
+                              "metadata": {
+                                "description": "The slots of the site."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('slots'), createArray()))]",
+                                "input": {
+                                  "name": "[format('{0}-Slot-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('slots'), createArray())[copyIndex()].name)]",
+                                  "resourceId": "[reference(format('app_slots[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "systemAssignedMIPrincipalId": "[coalesce(tryGet(tryGet(reference(format('app_slots[{0}]', copyIndex())).outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]",
+                                  "privateEndpoints": "[reference(format('app_slots[{0}]', copyIndex())).outputs.privateEndpoints.value]",
+                                  "hostNameBindings": "[reference(format('app_slots[{0}]', copyIndex())).outputs.hostNameBindings.value]"
+                                }
+                              }
+                            },
+                            "hostNameBindings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/hostNameBindingsOutputType"
+                              },
+                              "metadata": {
+                                "description": "The host name bindings of the site."
+                              },
+                              "copy": {
+                                "count": "[length(coalesce(parameters('hostNameBindings'), createArray()))]",
+                                "input": {
+                                  "name": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.name.value]",
+                                  "resourceId": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.resourceId.value]",
+                                  "resourceGroupName": "[reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs.resourceGroupName.value]",
+                                  "certificateThumbprint": "[tryGet(tryGet(reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateThumbprint'), 'value')]",
+                                  "certificateResourceId": "[tryGet(tryGet(reference(format('app_hostNameBindings[{0}]', copyIndex())).outputs, 'certificateResourceId'), 'value')]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      }
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the App Service."
+                      },
+                      "value": "[reference('appService').outputs.resourceId.value]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the App Service."
+                      },
+                      "value": "[reference('appService').outputs.name.value]"
+                    },
+                    "defaultHostname": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Default hostname of the App Service."
+                      },
+                      "value": "[reference('appService').outputs.defaultHostname.value]"
+                    },
+                    "appUrl": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "URL of the App Service."
+                      },
+                      "value": "[format('https://{0}', reference('appService').outputs.defaultHostname.value)]"
+                    },
+                    "identityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID."
+                      },
+                      "value": "[coalesce(tryGet(tryGet(reference('appService').outputs, 'systemAssignedMIPrincipalId'), 'value'), '')]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "app_insights",
+                "hostingplan",
+                "log_analytics",
+                "virtualNetwork"
+              ]
+            },
+            "role_assignments": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.role-assignments.{0}', parameters('solutionName')), 64)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "useExistingAIProject": {
+                    "value": "[variables('useExistingAIProject')]"
+                  },
+                  "existingFoundryProjectResourceId": {
+                    "value": "[parameters('existingFoundryProjectResourceId')]"
+                  },
+                  "aiFoundryResourceId": "[if(not(variables('useExistingAIProject')), if(variables('useExistingAIProject'), createObject('value', reference('existing_project_setup').outputs.resourceId.value), createObject('value', reference('ai_foundry_project').outputs.resourceId.value)), createObject('value', ''))]",
+                  "aiSearchResourceId": {
+                    "value": "[reference('ai_search').outputs.resourceId.value]"
+                  },
+                  "storageAccountResourceId": {
+                    "value": "[reference('storage_account').outputs.resourceId.value]"
+                  },
+                  "aiProjectPrincipalId": "[if(variables('useExistingAIProject'), createObject('value', reference('existing_project_setup').outputs.projectIdentityPrincipalId.value), createObject('value', reference('ai_foundry_project').outputs.projectIdentityPrincipalId.value))]",
+                  "aiSearchPrincipalId": {
+                    "value": "[reference('ai_search').outputs.identityPrincipalId.value]"
+                  },
+                  "backendAppServicePrincipalId": {
+                    "value": "[reference('backend_docker').outputs.identityPrincipalId.value]"
+                  },
+                  "cosmosDbAccountName": "[if(parameters('deployCosmos'), createObject('value', reference('cosmosDBModule').outputs.name.value), createObject('value', ''))]",
+                  "containerRegistryResourceId": {
+                    "value": "[reference('container_registry').outputs.resourceId.value]"
+                  },
+                  "acrPullPrincipals": {
+                    "value": [
+                      {
+                        "principalId": "[reference('backend_docker').outputs.identityPrincipalId.value]",
+                        "principalType": "ServicePrincipal"
+                      },
+                      {
+                        "principalId": "[reference('frontend_docker').outputs.identityPrincipalId.value]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "8510214222504051328"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Solution name suffix for generating unique role assignment GUIDs."
+                      }
+                    },
+                    "useExistingAIProject": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Whether to use an existing AI project (true) or create new (false)."
+                      }
+                    },
+                    "existingFoundryProjectResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the existing AI project (for deriving AI Services name/sub/RG)."
+                      }
+                    },
+                    "aiProjectPrincipalId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Principal ID of the AI project identity (works for both new and existing projects)."
+                      }
+                    },
+                    "aiSearchPrincipalId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Principal ID of the AI Search identity."
+                      }
+                    },
+                    "backendAppServicePrincipalId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Principal ID of the backend App Service system-assigned identity (empty if not deployed)."
+                      }
+                    },
+                    "aiFoundryResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the AI Foundry account (empty if not deployed — new project path)."
+                      }
+                    },
+                    "aiSearchResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the AI Search service (empty if not deployed)."
+                      }
+                    },
+                    "storageAccountResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the Storage Account (empty if not deployed)."
+                      }
+                    },
+                    "cosmosDbAccountName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the Cosmos DB account (empty if not deployed)."
+                      }
+                    },
+                    "useExistingContainerRegistry": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Whether to use an existing container registry (true) or the one created in this deployment (false)."
+                      }
+                    },
+                    "containerRegistryResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the container registry to grant AcrPull on (for deriving name/sub/RG; empty = skip ACR role assignments)."
+                      }
+                    },
+                    "acrPullPrincipals": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Principals to grant AcrPull on the container registry (array of objects with principalId and principalType)."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "existingAIFoundryName": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[8], '')]",
+                    "existingAIFoundrySubscription": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], subscription().subscriptionId)]",
+                    "existingAIFoundryResourceGroup": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], resourceGroup().name)]",
+                    "containerRegistryName": "[if(empty(parameters('containerRegistryResourceId')), '', split(parameters('containerRegistryResourceId'), '/')[8])]",
+                    "containerRegistrySubscription": "[if(empty(parameters('containerRegistryResourceId')), subscription().subscriptionId, split(parameters('containerRegistryResourceId'), '/')[2])]",
+                    "containerRegistryResourceGroup": "[if(empty(parameters('containerRegistryResourceId')), resourceGroup().name, split(parameters('containerRegistryResourceId'), '/')[4])]",
+                    "roleDefinitions": {
+                      "azureAiUser": "53ca6127-db72-4b80-b1b0-d745d6d5456d",
+                      "cognitiveServicesUser": "a97b65f3-24c7-4388-baec-2e87135dc908",
+                      "cognitiveServicesOpenAIUser": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",
+                      "searchIndexDataReader": "1407120a-92aa-4202-b7e9-c0e197c71c8f",
+                      "searchIndexDataContributor": "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
+                      "searchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
+                      "storageBlobDataContributor": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
+                      "storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
+                      "storageQueueDataContributor": "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
+                      "acrPull": "7f951dda-4ed3-4680-a7ca-43fe172d538d"
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiSearchPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('aiSearchPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                      "properties": {
+                        "principalId": "[parameters('aiSearchPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiFoundryResourceId')))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').azureAiUser)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiFoundryResourceId')))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').searchIndexDataReader)]",
+                      "properties": {
+                        "principalId": "[parameters('aiProjectPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataReader)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('aiProjectPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').searchIndexDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('aiProjectPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').storageBlobDataReader)]",
+                      "properties": {
+                        "principalId": "[parameters('aiProjectPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataReader)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiSearchPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiSearchPrincipalId'), variables('roleDefinitions').storageBlobDataReader)]",
+                      "properties": {
+                        "principalId": "[parameters('aiSearchPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataReader)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                      "apiVersion": "2025-10-15",
+                      "name": "[format('{0}/{1}', parameters('cosmosDbAccountName'), guid(parameters('solutionName'), resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbAccountName'), '00000000-0000-0000-0000-000000000002'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbAccountName')), parameters('backendAppServicePrincipalId')))]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbAccountName'), '00000000-0000-0000-0000-000000000002')]",
+                        "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbAccountName'))]"
+                      }
+                    },
+                    {
+                      "copy": {
+                        "name": "acrPullAssignments",
+                        "count": "[length(parameters('acrPullPrincipals'))]"
+                      },
+                      "condition": "[and(not(parameters('useExistingContainerRegistry')), not(empty(parameters('acrPullPrincipals')[copyIndex()].principalId)))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', variables('containerRegistryName'))]",
+                      "name": "[guid(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId, variables('roleDefinitions').acrPull)]",
+                      "properties": {
+                        "principalId": "[parameters('acrPullPrincipals')[copyIndex()].principalId]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').acrPull)]",
+                        "principalType": "[parameters('acrPullPrincipals')[copyIndex()].principalType]"
+                      }
+                    },
+                    {
+                      "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('aiSearchPrincipalId'))))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "assignOpenAIRoleToAISearchExisting",
+                      "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+                      "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "principalId": {
+                            "value": "[parameters('aiSearchPrincipalId')]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                          },
+                          "roleAssignmentName": {
+                            "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('aiSearchPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                          },
+                          "aiFoundryName": {
+                            "value": "[variables('existingAIFoundryName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.46.1.21595",
+                              "templateHash": "1934953964159824877"
                             }
                           },
-                          "outputs": {
-                            "resourceGroupName": {
+                          "parameters": {
+                            "principalId": {
                               "type": "string",
                               "metadata": {
-                                "description": "The resource group the private endpoint was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
+                                "description": "The principal ID to assign the role to."
+                              }
                             },
-                            "resourceId": {
+                            "roleDefinitionId": {
                               "type": "string",
                               "metadata": {
-                                "description": "The resource ID of the private endpoint."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                "description": "The resource ID of the role definition to assign."
+                              }
                             },
-                            "name": {
+                            "roleAssignmentName": {
                               "type": "string",
                               "metadata": {
-                                "description": "The name of the private endpoint."
-                              },
-                              "value": "[parameters('name')]"
+                                "description": "A unique name for the role assignment."
+                              }
                             },
-                            "location": {
+                            "principalType": {
                               "type": "string",
+                              "defaultValue": "ServicePrincipal",
+                              "allowedValues": [
+                                "ServicePrincipal",
+                                "User",
+                                "Group"
+                              ],
                               "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('privateEndpoint', '2024-10-01', 'full').location]"
+                                "description": "The principal type of the identity being assigned."
+                              }
                             },
-                            "customDnsConfigs": {
-                              "type": "array",
+                            "targetResourceType": {
+                              "type": "string",
+                              "defaultValue": "AIServices",
+                              "allowedValues": [
+                                "AIServices",
+                                "ContainerRegistry"
+                              ],
                               "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Network/privateEndpoints@2024-01-01#properties/properties/properties/customDnsConfigs",
-                                  "output": true
-                                },
-                                "description": "The custom DNS configurations of the private endpoint."
-                              },
-                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                "description": "The type of target resource to scope the role assignment to."
+                              }
                             },
-                            "networkInterfaceResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
+                            "aiFoundryName": {
+                              "type": "string",
+                              "defaultValue": "",
                               "metadata": {
-                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                              },
-                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices."
+                              }
                             },
-                            "groupId": {
+                            "containerRegistryName": {
                               "type": "string",
-                              "nullable": true,
+                              "defaultValue": "",
                               "metadata": {
-                                "description": "The group Id for the private endpoint Group."
-                              },
-                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                              }
                             }
-                          }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            },
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            }
+                          ]
                         }
-                      },
-                      "dependsOn": [
-                        "cognitiveService_deployments"
-                      ]
+                      }
                     },
-                    "aiProject": {
-                      "condition": "[or(not(empty(parameters('projectName'))), not(empty(parameters('existingFoundryProjectResourceId'))))]",
+                    {
+                      "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('backendAppServicePrincipalId'))))]",
                       "type": "Microsoft.Resources/deployments",
                       "apiVersion": "2025-04-01",
-                      "name": "[take(format('{0}-ai-project-{1}-deployment', parameters('name'), parameters('projectName')), 64)]",
+                      "name": "assignAiUserRoleToBackendExisting",
+                      "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+                      "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
                       "properties": {
                         "expressionEvaluationOptions": {
                           "scope": "inner"
                         },
                         "mode": "Incremental",
                         "parameters": {
-                          "name": {
-                            "value": "[parameters('projectName')]"
-                          },
-                          "desc": {
-                            "value": "[parameters('projectDescription')]"
-                          },
-                          "aiServicesName": {
-                            "value": "[parameters('name')]"
+                          "principalId": {
+                            "value": "[parameters('backendAppServicePrincipalId')]"
                           },
-                          "location": {
-                            "value": "[parameters('location')]"
+                          "roleDefinitionId": {
+                            "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]"
                           },
-                          "tags": {
-                            "value": "[parameters('tags')]"
+                          "roleAssignmentName": {
+                            "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').azureAiUser)]"
                           },
-                          "existingFoundryProjectResourceId": {
-                            "value": "[parameters('existingFoundryProjectResourceId')]"
+                          "aiFoundryName": {
+                            "value": "[variables('existingAIFoundryName')]"
                           }
                         },
                         "template": {
                           "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
                           "contentVersion": "1.0.0.0",
                           "metadata": {
                             "_generator": {
                               "name": "bicep",
-                              "version": "0.44.1.10279",
-                              "templateHash": "436403693822643644"
+                              "version": "0.46.1.21595",
+                              "templateHash": "1934953964159824877"
                             }
                           },
-                          "definitions": {
-                            "aiProjectOutputType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. Name of the AI project."
-                                  }
-                                },
-                                "resourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. Resource ID of the AI project."
-                                  }
-                                },
-                                "apiEndpoint": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. API endpoint for the AI project."
-                                  }
-                                },
-                                "aiprojectSystemAssignedMIPrincipalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. System Assigned Managed Identity Principal Id of the AI project."
-                                  }
-                                }
-                              },
+                          "parameters": {
+                            "principalId": {
+                              "type": "string",
                               "metadata": {
-                                "__bicep_export!": true,
-                                "description": "Output type representing AI project information."
+                                "description": "The principal ID to assign the role to."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the role definition to assign."
+                              }
+                            },
+                            "roleAssignmentName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "A unique name for the role assignment."
+                              }
+                            },
+                            "principalType": {
+                              "type": "string",
+                              "defaultValue": "ServicePrincipal",
+                              "allowedValues": [
+                                "ServicePrincipal",
+                                "User",
+                                "Group"
+                              ],
+                              "metadata": {
+                                "description": "The principal type of the identity being assigned."
+                              }
+                            },
+                            "targetResourceType": {
+                              "type": "string",
+                              "defaultValue": "AIServices",
+                              "allowedValues": [
+                                "AIServices",
+                                "ContainerRegistry"
+                              ],
+                              "metadata": {
+                                "description": "The type of target resource to scope the role assignment to."
+                              }
+                            },
+                            "aiFoundryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices."
+                              }
+                            },
+                            "containerRegistryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            },
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
                               }
                             }
+                          ]
+                        }
+                      }
+                    },
+                    {
+                      "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "assignOpenAIUserRoleToBackendExisting",
+                      "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+                      "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "principalId": {
+                            "value": "[parameters('backendAppServicePrincipalId')]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                          },
+                          "roleAssignmentName": {
+                            "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                          },
+                          "aiFoundryName": {
+                            "value": "[variables('existingAIFoundryName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.46.1.21595",
+                              "templateHash": "1934953964159824877"
+                            }
                           },
                           "parameters": {
-                            "name": {
+                            "principalId": {
                               "type": "string",
                               "metadata": {
-                                "description": "Required. Name of the AI Services project."
+                                "description": "The principal ID to assign the role to."
                               }
                             },
-                            "location": {
+                            "roleDefinitionId": {
                               "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
                               "metadata": {
-                                "description": "Required. The location of the Project resource."
+                                "description": "The resource ID of the role definition to assign."
                               }
                             },
-                            "desc": {
+                            "roleAssignmentName": {
                               "type": "string",
-                              "defaultValue": "[parameters('name')]",
                               "metadata": {
-                                "description": "Optional. The description of the AI Foundry project to create. Defaults to the project name."
+                                "description": "A unique name for the role assignment."
                               }
                             },
-                            "aiServicesName": {
+                            "principalType": {
                               "type": "string",
+                              "defaultValue": "ServicePrincipal",
+                              "allowedValues": [
+                                "ServicePrincipal",
+                                "User",
+                                "Group"
+                              ],
                               "metadata": {
-                                "description": "Required. Name of the existing Cognitive Services resource to create the AI Foundry project in."
+                                "description": "The principal type of the identity being assigned."
                               }
                             },
-                            "tags": {
-                              "type": "object",
-                              "defaultValue": {},
+                            "targetResourceType": {
+                              "type": "string",
+                              "defaultValue": "AIServices",
+                              "allowedValues": [
+                                "AIServices",
+                                "ContainerRegistry"
+                              ],
+                              "metadata": {
+                                "description": "The type of target resource to scope the role assignment to."
+                              }
+                            },
+                            "aiFoundryName": {
+                              "type": "string",
+                              "defaultValue": "",
                               "metadata": {
-                                "description": "Optional. Tags to be applied to the resources."
+                                "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices."
                               }
                             },
-                            "existingFoundryProjectResourceId": {
+                            "containerRegistryName": {
                               "type": "string",
                               "defaultValue": "",
                               "metadata": {
-                                "description": "Optional. Use this parameter to use an existing AI project resource ID from different resource group"
+                                "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
                               }
                             }
                           },
-                          "variables": {
-                            "useExistingProject": "[not(empty(parameters('existingFoundryProjectResourceId')))]",
-                            "existingProjName": "[if(variables('useExistingProject'), last(split(parameters('existingFoundryProjectResourceId'), '/')), '')]",
-                            "existingAiFoundryAiServicesSubscriptionId": "[if(variables('useExistingProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], '')]",
-                            "existingAiFoundryAiServicesResourceGroupName": "[if(variables('useExistingProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], '')]",
-                            "existingAiFoundryAiServicesServiceName": "[if(variables('useExistingProject'), split(parameters('existingFoundryProjectResourceId'), '/')[8], '')]",
-                            "existingProjEndpoint": "[if(variables('useExistingProject'), format('https://{0}.services.ai.azure.com/api/projects/{1}', variables('existingAiFoundryAiServicesServiceName'), variables('existingProjName')), '')]"
-                          },
-                          "resources": {
-                            "cogServiceReference": {
-                              "existing": true,
-                              "type": "Microsoft.CognitiveServices/accounts",
-                              "apiVersion": "2025-06-01",
-                              "name": "[parameters('aiServicesName')]"
+                          "resources": [
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
                             },
-                            "aiProject": {
-                              "condition": "[not(variables('useExistingProject'))]",
-                              "type": "Microsoft.CognitiveServices/accounts/projects",
-                              "apiVersion": "2025-06-01",
-                              "name": "[format('{0}/{1}', parameters('aiServicesName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "location": "[parameters('location')]",
-                              "identity": {
-                                "type": "SystemAssigned"
-                              },
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
                               "properties": {
-                                "description": "[parameters('desc')]",
-                                "displayName": "[parameters('name')]"
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            }
+                          ]
+                        }
+                      }
+                    },
+                    {
+                      "copy": {
+                        "name": "acrPullAssignmentsExisting",
+                        "count": "[length(parameters('acrPullPrincipals'))]"
+                      },
+                      "condition": "[and(parameters('useExistingContainerRegistry'), not(empty(parameters('acrPullPrincipals')[copyIndex()].principalId)))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('acrPull-{0}', uniqueString(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId)), 64)]",
+                      "subscriptionId": "[variables('containerRegistrySubscription')]",
+                      "resourceGroup": "[variables('containerRegistryResourceGroup')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "targetResourceType": {
+                            "value": "ContainerRegistry"
+                          },
+                          "containerRegistryName": {
+                            "value": "[variables('containerRegistryName')]"
+                          },
+                          "principalId": {
+                            "value": "[parameters('acrPullPrincipals')[copyIndex()].principalId]"
+                          },
+                          "principalType": {
+                            "value": "[parameters('acrPullPrincipals')[copyIndex()].principalType]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').acrPull)]"
+                          },
+                          "roleAssignmentName": {
+                            "value": "[guid(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId, variables('roleDefinitions').acrPull)]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.46.1.21595",
+                              "templateHash": "1934953964159824877"
+                            }
+                          },
+                          "parameters": {
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID to assign the role to."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the role definition to assign."
+                              }
+                            },
+                            "roleAssignmentName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "A unique name for the role assignment."
+                              }
+                            },
+                            "principalType": {
+                              "type": "string",
+                              "defaultValue": "ServicePrincipal",
+                              "allowedValues": [
+                                "ServicePrincipal",
+                                "User",
+                                "Group"
+                              ],
+                              "metadata": {
+                                "description": "The principal type of the identity being assigned."
+                              }
+                            },
+                            "targetResourceType": {
+                              "type": "string",
+                              "defaultValue": "AIServices",
+                              "allowedValues": [
+                                "AIServices",
+                                "ContainerRegistry"
+                              ],
+                              "metadata": {
+                                "description": "The type of target resource to scope the role assignment to."
+                              }
+                            },
+                            "aiFoundryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices."
                               }
                             },
-                            "existingAiProject": {
-                              "condition": "[variables('useExistingProject')]",
-                              "existing": true,
-                              "type": "Microsoft.CognitiveServices/accounts/projects",
-                              "apiVersion": "2025-06-01",
-                              "subscriptionId": "[variables('existingAiFoundryAiServicesSubscriptionId')]",
-                              "resourceGroup": "[variables('existingAiFoundryAiServicesResourceGroupName')]",
-                              "name": "[format('{0}/{1}', variables('existingAiFoundryAiServicesServiceName'), variables('existingProjName'))]"
+                            "containerRegistryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                              }
                             }
                           },
-                          "outputs": {
-                            "aiProjectInfo": {
-                              "$ref": "#/definitions/aiProjectOutputType",
-                              "metadata": {
-                                "description": "AI Project metadata including name, resource ID, and API endpoint."
-                              },
-                              "value": {
-                                "name": "[if(variables('useExistingProject'), variables('existingProjName'), parameters('name'))]",
-                                "resourceId": "[if(variables('useExistingProject'), parameters('existingFoundryProjectResourceId'), resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('aiServicesName'), parameters('name')))]",
-                                "apiEndpoint": "[if(variables('useExistingProject'), variables('existingProjEndpoint'), reference('aiProject').endpoints['AI Foundry API'])]",
-                                "aiprojectSystemAssignedMIPrincipalId": "[if(variables('useExistingProject'), reference('existingAiProject', '2025-06-01', 'full').identity.principalId, reference('aiProject', '2025-06-01', 'full').identity.principalId)]"
+                          "resources": [
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            },
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
                               }
                             }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "cognitiveService_deployments"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointOutputType"
-                      },
-                      "metadata": {
-                        "description": "The private endpoints of the congitive services account."
-                      },
-                      "copy": {
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                        "input": {
-                          "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                          "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                          "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                          "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                          "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                          ]
                         }
                       }
-                    },
-                    "aiProjectInfo": {
-                      "$ref": "#/definitions/aiProjectOutputType",
-                      "value": "[reference('aiProject').outputs.aiProjectInfo.value]"
                     }
-                  }
+                  ]
                 }
-              }
+              },
+              "dependsOn": [
+                "ai_foundry_project",
+                "ai_search",
+                "backend_docker",
+                "container_registry",
+                "cosmosDBModule",
+                "existing_project_setup",
+                "frontend_docker",
+                "storage_account"
+              ]
             }
           },
           "outputs": {
-            "name": {
+            "AZURE_OPENAI_ENDPOINT": {
               "type": "string",
               "metadata": {
-                "description": "The name of the cognitive services account."
+                "description": "Azure OpenAI endpoint URL."
               },
-              "value": "[if(variables('useExistingService'), variables('existingCognitiveServiceDetails')[8], parameters('name'))]"
+              "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.endpoint.value, reference('ai_foundry_project').outputs.endpoint.value)]"
             },
-            "resourceId": {
+            "AZURE_SEARCH_ENDPOINT": {
               "type": "string",
               "metadata": {
-                "description": "The resource ID of the cognitive services account."
+                "description": "Azure AI Search endpoint URL."
               },
-              "value": "[if(variables('useExistingService'), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingCognitiveServiceDetails')[2], variables('existingCognitiveServiceDetails')[4]), 'Microsoft.CognitiveServices/accounts', variables('existingCognitiveServiceDetails')[8]), resourceId('Microsoft.CognitiveServices/accounts', parameters('name')))]"
+              "value": "[reference('ai_search').outputs.endpoint.value]"
             },
-            "subscriptionId": {
+            "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": {
               "type": "string",
               "metadata": {
-                "description": "The resource group the cognitive services account was deployed into."
+                "description": "Azure Content Understanding endpoint URL."
               },
-              "value": "[if(variables('useExistingService'), variables('existingCognitiveServiceDetails')[2], subscription().subscriptionId)]"
+              "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.azureOpenAiCuEndpoint.value, reference('ai_foundry_project').outputs.azureOpenAiCuEndpoint.value)]"
             },
-            "resourceGroupName": {
+            "AZURE_STORAGE_ACCOUNT": {
               "type": "string",
               "metadata": {
-                "description": "The resource group the cognitive services account was deployed into."
+                "description": "Azure Storage account name."
               },
-              "value": "[if(variables('useExistingService'), variables('existingCognitiveServiceDetails')[4], resourceGroup().name)]"
+              "value": "[reference('storage_account').outputs.name.value]"
             },
-            "endpoint": {
+            "AZURE_SQL_SERVER": {
               "type": "string",
               "metadata": {
-                "description": "The service endpoint of the cognitive services account."
+                "description": "Azure SQL Server FQDN."
               },
-              "value": "[if(variables('useExistingService'), reference('cognitiveServiceExisting').endpoint, if(variables('useExistingService'), reference('cognitiveServiceExisting', '2025-06-01', 'full'), reference('cognitiveServiceNew', '2025-06-01', 'full')).properties.endpoint)]"
+              "value": "[reference('sqlDBModule').outputs.serverFqdn.value]"
             },
-            "endpoints": {
-              "$ref": "#/definitions/endpointType",
+            "AZURE_SQL_DATABASE": {
+              "type": "string",
               "metadata": {
-                "description": "All endpoints available for the cognitive services account, types depends on the cognitive service kind."
+                "description": "Azure SQL Database name."
               },
-              "value": "[if(variables('useExistingService'), reference('cognitiveServiceExisting').endpoints, if(variables('useExistingService'), reference('cognitiveServiceExisting', '2025-06-01', 'full'), reference('cognitiveServiceNew', '2025-06-01', 'full')).properties.endpoints)]"
+              "value": "[reference('sqlDBModule').outputs.databaseName.value]"
             },
-            "systemAssignedMIPrincipalId": {
+            "API_APP_NAME": {
               "type": "string",
-              "nullable": true,
               "metadata": {
-                "description": "The principal ID of the system assigned identity."
+                "description": "Backend API application (and SQL contained user) name."
               },
-              "value": "[if(variables('useExistingService'), reference('cognitiveServiceExisting', '2025-06-01', 'full').identity.principalId, tryGet(tryGet(if(variables('useExistingService'), reference('cognitiveServiceExisting', '2025-06-01', 'full'), reference('cognitiveServiceNew', '2025-06-01', 'full')), 'identity'), 'principalId'))]"
+              "value": "[reference('backend_docker').outputs.name.value]"
             },
-            "location": {
+            "AZURE_API_PRINCIPAL_ID": {
               "type": "string",
               "metadata": {
-                "description": "The location the resource was deployed into."
+                "description": "Backend API system-assigned managed identity principal ID."
               },
-              "value": "[if(variables('useExistingService'), reference('cognitiveServiceExisting', '2025-06-01', 'full').location, if(variables('useExistingService'), reference('cognitiveServiceExisting', '2025-06-01', 'full'), reference('cognitiveServiceNew', '2025-06-01', 'full')).location)]"
+              "value": "[reference('backend_docker').outputs.identityPrincipalId.value]"
             },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointOutputType"
+            "AZURE_COSMOS_ENDPOINT": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure Cosmos DB endpoint."
               },
+              "value": "[if(parameters('deployCosmos'), reference('cosmosDBModule').outputs.endpoint.value, '')]"
+            },
+            "AZURE_AI_AGENT_ENDPOINT": {
+              "type": "string",
               "metadata": {
-                "description": "The private endpoints of the congitive services account."
+                "description": "Azure AI Agent endpoint URL."
               },
-              "value": "[if(not(empty(parameters('projectName'))), if(variables('useExistingService'), reference('existing_cognitive_service_dependencies').outputs.privateEndpoints.value, reference('cognitive_service_dependencies').outputs.privateEndpoints.value), createArray())]"
+              "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.projectEndpoint.value, reference('ai_foundry_project').outputs.projectEndpoint.value)]"
             },
-            "aiProjectInfo": {
-              "$ref": "#/definitions/aiProjectOutputType",
-              "value": "[if(not(empty(parameters('projectName'))), if(variables('useExistingService'), reference('existing_cognitive_service_dependencies').outputs.aiProjectInfo.value, reference('cognitive_service_dependencies').outputs.aiProjectInfo.value), createObject('name', '', 'resourceId', '', 'apiEndpoint', '', 'aiprojectSystemAssignedMIPrincipalId', ''))]"
-            }
-          }
-        }
-      }
-    },
-    {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "search",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('aiSearchName')]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "5951534751226960928"
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string"
+            "API_APP_URL": {
+              "type": "string",
+              "metadata": {
+                "description": "Backend API application URL."
+              },
+              "value": "[reference('backend_docker').outputs.appUrl.value]"
             },
-            "location": {
-              "type": "string"
+            "WEB_APP_URL": {
+              "type": "string",
+              "metadata": {
+                "description": "Frontend web application URL."
+              },
+              "value": "[reference('frontend_docker').outputs.appUrl.value]"
             },
-            "tags": {
-              "type": "object"
+            "SERVICE_BACKEND_URI": {
+              "type": "string",
+              "metadata": {
+                "description": "Backend service URI (used by azd)."
+              },
+              "value": "[reference('backend_docker').outputs.appUrl.value]"
             },
-            "skuName": {
+            "SERVICE_FRONTEND_URI": {
               "type": "string",
-              "defaultValue": "basic",
-              "allowedValues": [
-                "free",
-                "basic",
-                "standard",
-                "standard2",
-                "standard3"
-              ],
               "metadata": {
-                "description": "SKU for the search service"
-              }
-            }
-          },
-          "resources": [
-            {
-              "type": "Microsoft.Search/searchServices",
-              "apiVersion": "2024-06-01-preview",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "identity": {
-                "type": "SystemAssigned"
+                "description": "Frontend service URI (used by azd)."
               },
-              "sku": {
-                "name": "[parameters('skuName')]"
+              "value": "[reference('frontend_docker').outputs.appUrl.value]"
+            },
+            "AZURE_AI_SEARCH_CONNECTION_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "AI Search connection name in AI Foundry."
               },
-              "properties": {
-                "replicaCount": 1,
-                "partitionCount": 1,
-                "hostingMode": "default",
-                "publicNetworkAccess": "enabled",
-                "semanticSearch": "free",
-                "authOptions": {
-                  "aadOrApiKey": {
-                    "aadAuthFailureMode": "http401WithBearerChallenge"
-                  }
-                }
-              }
-            }
-          ],
-          "outputs": {
-            "endpoint": {
+              "value": "[reference('foundry_search_connection').outputs.connectionName.value]"
+            },
+            "ACR_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure Container Registry name."
+              },
+              "value": "[reference('container_registry').outputs.name.value]"
+            },
+            "ACR_LOGIN_SERVER": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure Container Registry login server URL."
+              },
+              "value": "[reference('container_registry').outputs.loginServer.value]"
+            },
+            "BACKEND_CONTAINER_IMAGE_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "Backend container image repository name to build and push to ACR."
+              },
+              "value": "[parameters('backendContainerImageName')]"
+            },
+            "BACKEND_CONTAINER_IMAGE_TAG": {
+              "type": "string",
+              "metadata": {
+                "description": "Backend container image tag to build and push to ACR."
+              },
+              "value": "[parameters('backendContainerImageTag')]"
+            },
+            "FRONTEND_CONTAINER_IMAGE_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "Frontend container image repository name to build and push to ACR."
+              },
+              "value": "[parameters('frontendContainerImageName')]"
+            },
+            "FRONTEND_CONTAINER_IMAGE_TAG": {
               "type": "string",
-              "value": "[format('https://{0}.search.windows.net', parameters('name'))]"
+              "metadata": {
+                "description": "Frontend container image tag to build and push to ACR."
+              },
+              "value": "[parameters('frontendContainerImageTag')]"
             },
-            "name": {
+            "FRONTEND_APP_NAME": {
               "type": "string",
-              "value": "[parameters('name')]"
+              "metadata": {
+                "description": "Frontend web application (App Service) name."
+              },
+              "value": "[reference('frontend_docker').outputs.name.value]"
             },
-            "id": {
+            "RESOURCE_GROUP_NAME": {
               "type": "string",
-              "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+              "metadata": {
+                "description": "Resource group name."
+              },
+              "value": "[resourceGroup().name]"
             },
-            "principalId": {
+            "SOLUTION_SUFFIX": {
               "type": "string",
-              "value": "[reference(resourceId('Microsoft.Search/searchServices', parameters('name')), '2024-06-01-preview', 'full').identity.principalId]"
+              "metadata": {
+                "description": "Solution resource token suffix used in resource names."
+              },
+              "value": "[variables('solutionSuffix')]"
             }
           }
         }
       }
     },
-    {
-      "condition": "[not(parameters('useExistingAiProject'))]",
+    "bicepDeployment": {
+      "condition": "[variables('isBicep')]",
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2025-04-01",
-      "name": "ai-search-connection",
+      "name": "[take(format('module.bicep.{0}', parameters('solutionName')), 64)]",
       "properties": {
         "expressionEvaluationOptions": {
           "scope": "inner"
         },
         "mode": "Incremental",
         "parameters": {
-          "existingAIProjectName": {
-            "value": "[format('{0}{1}', variables('abbrs').ai.aiFoundryProject, variables('resourceToken'))]"
+          "solutionName": {
+            "value": "[parameters('solutionName')]"
           },
-          "existingAIFoundryName": {
-            "value": "[format('{0}{1}', variables('abbrs').ai.aiFoundry, variables('resourceToken'))]"
+          "solutionUniqueText": {
+            "value": "[parameters('solutionUniqueText')]"
           },
-          "aiSearchName": {
-            "value": "[variables('aiSearchName')]"
+          "location": {
+            "value": "[parameters('location')]"
           },
-          "aiSearchResourceId": {
-            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'search'), '2025-04-01').outputs.id.value]"
+          "azureAiServiceLocation": {
+            "value": "[parameters('azureAiServiceLocation')]"
           },
-          "aiSearchLocation": {
-            "value": "[parameters('location')]"
+          "tags": {
+            "value": "[parameters('tags')]"
+          },
+          "deployCosmos": {
+            "value": "[parameters('deployCosmos')]"
+          },
+          "deploymentType": {
+            "value": "[parameters('deploymentType')]"
+          },
+          "gptModelName": {
+            "value": "[parameters('gptModelName')]"
+          },
+          "gptModelVersion": {
+            "value": "[parameters('gptModelVersion')]"
+          },
+          "gptDeploymentCapacity": {
+            "value": "[parameters('gptDeploymentCapacity')]"
+          },
+          "embeddingModel": {
+            "value": "[parameters('embeddingModel')]"
+          },
+          "embeddingDeploymentCapacity": {
+            "value": "[parameters('embeddingDeploymentCapacity')]"
+          },
+          "kind": {
+            "value": "[parameters('kind')]"
+          },
+          "containerRegistryName": {
+            "value": "[parameters('containerRegistryName')]"
+          },
+          "appServicePlanSku": {
+            "value": "[parameters('appServicePlanSku')]"
+          },
+          "backendContainerImageName": {
+            "value": "[parameters('backendContainerImageName')]"
+          },
+          "backendContainerImageTag": {
+            "value": "[parameters('backendContainerImageTag')]"
+          },
+          "frontendContainerImageName": {
+            "value": "[parameters('frontendContainerImageName')]"
+          },
+          "frontendContainerImageTag": {
+            "value": "[parameters('frontendContainerImageTag')]"
+          },
+          "azureAdTenantId": {
+            "value": "[parameters('azureAdTenantId')]"
+          },
+          "azureAdClientId": {
+            "value": "[parameters('azureAdClientId')]"
+          },
+          "adminApiKey": {
+            "value": "[parameters('adminApiKey')]"
+          },
+          "existingLogAnalyticsWorkspaceId": {
+            "value": "[parameters('existingLogAnalyticsWorkspaceId')]"
           },
-          "aiSearchConnectionName": {
-            "value": "[variables('aiSearchConnectionName')]"
+          "existingFoundryProjectResourceId": {
+            "value": "[parameters('existingFoundryProjectResourceId')]"
+          },
+          "deployingUserPrincipalType": {
+            "value": "[parameters('deployingUserPrincipalType')]"
           }
         },
         "template": {
@@ -5339,3283 +91994,4571 @@
           "metadata": {
             "_generator": {
               "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "14315919518583109368"
+              "version": "0.46.1.21595",
+              "templateHash": "7213137512787294477"
             }
           },
           "parameters": {
-            "existingAIProjectName": {
+            "solutionName": {
               "type": "string",
+              "defaultValue": "kmgen",
+              "minLength": 3,
+              "maxLength": 16,
               "metadata": {
-                "description": "Required. Existing AI Project Name"
+                "description": "Optional. A unique application/solution name used as base for all resource naming."
               }
             },
-            "existingAIFoundryName": {
+            "solutionUniqueText": {
               "type": "string",
+              "defaultValue": "[substring(uniqueString(subscription().id, resourceGroup().name, parameters('solutionName')), 0, 5)]",
+              "maxLength": 5,
               "metadata": {
-                "description": "Required. Existing AI Foundry Name"
+                "description": "Optional. A unique text suffix appended to resource names for uniqueness."
               }
             },
-            "aiSearchName": {
+            "location": {
               "type": "string",
+              "defaultValue": "[resourceGroup().location]",
               "metadata": {
-                "description": "Required. AI Search Name"
+                "azd": {
+                  "type": "location"
+                },
+                "description": "Optional. Primary Azure region for resource deployment."
               }
             },
-            "aiSearchResourceId": {
+            "azureAiServiceLocation": {
               "type": "string",
+              "allowedValues": [
+                "australiaeast",
+                "swedencentral",
+                "southeastasia"
+              ],
+              "metadata": {
+                "azd": {
+                  "type": "location",
+                  "usageName": [
+                    "OpenAI.GlobalStandard.gpt-5.2,150",
+                    "OpenAI.GlobalStandard.text-embedding-3-small,80"
+                  ]
+                },
+                "description": "Required. Location for AI Foundry and model deployments."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional. Tags to apply to all resources."
+              }
+            },
+            "deployCosmos": {
+              "type": "bool",
+              "defaultValue": false,
               "metadata": {
-                "description": "Required. AI Search Resource ID"
+                "description": "Optional. Set to true to also deploy Cosmos DB (not required — SQL is the primary database)."
               }
             },
-            "aiSearchLocation": {
+            "deploymentType": {
               "type": "string",
+              "defaultValue": "GlobalStandard",
+              "allowedValues": [
+                "Standard",
+                "GlobalStandard"
+              ],
               "metadata": {
-                "description": "Required. AI Search Location"
+                "description": "Optional. GPT model deployment type."
               }
             },
-            "aiSearchConnectionName": {
+            "gptModelName": {
               "type": "string",
+              "defaultValue": "gpt-5.2",
               "metadata": {
-                "description": "Required. AI Search Connection Name"
+                "description": "Optional. Name of the GPT model to deploy."
               }
-            }
-          },
-          "resources": [
-            {
-              "type": "Microsoft.CognitiveServices/accounts/projects/connections",
-              "apiVersion": "2025-10-01-preview",
-              "name": "[format('{0}/{1}/{2}', parameters('existingAIFoundryName'), parameters('existingAIProjectName'), parameters('aiSearchConnectionName'))]",
-              "properties": {
-                "category": "CognitiveSearch",
-                "target": "[format('https://{0}.search.windows.net', parameters('aiSearchName'))]",
-                "authType": "AAD",
-                "isSharedToAll": true,
-                "metadata": {
-                  "ApiType": "Azure",
-                  "ResourceId": "[parameters('aiSearchResourceId')]",
-                  "location": "[parameters('aiSearchLocation')]"
-                }
+            },
+            "gptModelVersion": {
+              "type": "string",
+              "defaultValue": "2025-12-11",
+              "metadata": {
+                "description": "Optional. Version of the GPT model to deploy."
               }
-            }
-          ]
-        }
-      },
-      "dependsOn": [
-        "[resourceId('Microsoft.Resources/deployments', 'ai-services')]",
-        "[resourceId('Microsoft.Resources/deployments', 'search')]"
-      ]
-    },
-    {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "storage",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[format('{0}{1}', variables('abbrs').storage.storageAccount, variables('resourceToken'))]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "10930058450619816495"
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string"
             },
-            "location": {
-              "type": "string"
+            "gptDeploymentCapacity": {
+              "type": "int",
+              "defaultValue": 150,
+              "minValue": 10,
+              "metadata": {
+                "description": "Optional. Capacity of the GPT deployment (TPM in thousands)."
+              }
             },
-            "tags": {
-              "type": "object"
-            }
-          },
-          "resources": [
-            {
-              "type": "Microsoft.Storage/storageAccounts",
-              "apiVersion": "2023-05-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "kind": "StorageV2",
-              "sku": {
-                "name": "Standard_LRS"
-              },
-              "properties": {
-                "minimumTlsVersion": "TLS1_2",
-                "allowBlobPublicAccess": false,
-                "supportsHttpsTrafficOnly": true,
-                "accessTier": "Hot"
+            "embeddingModel": {
+              "type": "string",
+              "defaultValue": "text-embedding-3-small",
+              "allowedValues": [
+                "text-embedding-3-small"
+              ],
+              "metadata": {
+                "description": "Optional. Name of the Text Embedding model to deploy."
               }
             },
-            {
-              "type": "Microsoft.Storage/storageAccounts/blobServices",
-              "apiVersion": "2023-05-01",
-              "name": "[format('{0}/{1}', parameters('name'), 'default')]",
-              "dependsOn": [
-                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
-              ]
+            "embeddingDeploymentCapacity": {
+              "type": "int",
+              "defaultValue": 80,
+              "minValue": 10,
+              "metadata": {
+                "description": "Optional. Capacity of the Embedding Model deployment."
+              }
+            },
+            "containerRegistryName": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Name of the Azure Container Registry. Leave empty to auto-generate a globally unique name (cr<suffix>)."
+              }
+            },
+            "backendContainerImageName": {
+              "type": "string",
+              "defaultValue": "km-api",
+              "metadata": {
+                "description": "Optional. Backend container image name."
+              }
+            },
+            "backendContainerImageTag": {
+              "type": "string",
+              "defaultValue": "latest",
+              "metadata": {
+                "description": "Optional. Backend container image tag."
+              }
+            },
+            "frontendContainerImageName": {
+              "type": "string",
+              "defaultValue": "km-app",
+              "metadata": {
+                "description": "Optional. Frontend container image name."
+              }
             },
-            {
-              "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
-              "apiVersion": "2023-05-01",
-              "name": "[format('{0}/{1}/{2}', parameters('name'), 'default', 'documents')]",
-              "properties": {
-                "publicAccess": "None"
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('name'), 'default')]"
-              ]
+            "frontendContainerImageTag": {
+              "type": "string",
+              "defaultValue": "latest",
+              "metadata": {
+                "description": "Optional. Frontend container image tag."
+              }
             },
-            {
-              "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
-              "apiVersion": "2023-05-01",
-              "name": "[format('{0}/{1}/{2}', parameters('name'), 'default', 'cu-temp')]",
-              "properties": {
-                "publicAccess": "None"
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('name'), 'default')]"
-              ]
-            }
-          ],
-          "outputs": {
-            "accountName": {
+            "appServicePlanSku": {
               "type": "string",
-              "value": "[parameters('name')]"
+              "defaultValue": "B3",
+              "allowedValues": [
+                "F1",
+                "D1",
+                "B1",
+                "B2",
+                "B3",
+                "S1",
+                "S2",
+                "S3",
+                "P1",
+                "P2",
+                "P3",
+                "P1v3",
+                "P1v4"
+              ],
+              "metadata": {
+                "description": "Optional. App Service Plan SKU (used by AVM flavors)."
+              }
             },
-            "id": {
+            "kind": {
               "type": "string",
-              "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+              "defaultValue": "app,linux,container",
+              "metadata": {
+                "description": "Kind of web app."
+              }
             },
-            "primaryEndpoint": {
+            "azureAdTenantId": {
               "type": "string",
-              "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2023-05-01').primaryEndpoints.blob]"
-            }
-          }
-        }
-      }
-    },
-    {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "sql",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "serverName": {
-            "value": "[format('{0}{1}', variables('abbrs').databases.sqlDatabaseServer, variables('resourceToken'))]"
-          },
-          "databaseName": {
-            "value": "[format('{0}{1}', variables('abbrs').databases.sqlDatabase, variables('resourceToken'))]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          },
-          "adminObjectId": {
-            "value": "[deployer().objectId]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "15692687428048033274"
-            }
-          },
-          "parameters": {
-            "serverName": {
-              "type": "string"
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Azure AD tenant ID for authentication."
+              }
             },
-            "databaseName": {
-              "type": "string"
+            "azureAdClientId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Azure AD client ID for authentication."
+              }
             },
-            "location": {
-              "type": "string"
+            "adminApiKey": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Admin API key for script-based authentication (setup-data, post-deploy scripts). Leave empty to disable."
+              }
             },
-            "tags": {
-              "type": "object"
+            "existingLogAnalyticsWorkspaceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional. Resource ID of an existing Log Analytics workspace. Empty creates a new one."
+              }
             },
-            "adminObjectId": {
+            "existingFoundryProjectResourceId": {
               "type": "string",
               "defaultValue": "",
               "metadata": {
-                "description": "Object ID of the Azure AD admin for the SQL server"
+                "description": "Optional. Resource ID of an existing AI Foundry project. Empty creates a new one."
+              }
+            },
+            "deployingUserPrincipalType": {
+              "type": "string",
+              "defaultValue": "User",
+              "allowedValues": [
+                "User",
+                "ServicePrincipal"
+              ],
+              "metadata": {
+                "description": "Optional. Principal type of the deploying user. Use ServicePrincipal for CI/CD pipelines with OIDC."
               }
             },
-            "adminLogin": {
+            "createdBy": {
               "type": "string",
-              "defaultValue": "azd-admin",
+              "defaultValue": "[if(contains(deployer(), 'userPrincipalName'), split(deployer().userPrincipalName, '@')[0], deployer().objectId)]",
               "metadata": {
-                "description": "Display name of the Azure AD admin"
+                "description": "Optional. Created by user name for resource tagging."
               }
             }
           },
+          "variables": {
+            "solutionSuffix": "[toLower(trim(replace(replace(replace(replace(replace(replace(format('{0}{1}', parameters('solutionName'), parameters('solutionUniqueText')), '-', ''), '_', ''), '.', ''), '/', ''), ' ', ''), '*', '')))]",
+            "containerRegistryResourceName": "[if(not(empty(parameters('containerRegistryName'))), parameters('containerRegistryName'), format('acrkm{0}', variables('solutionSuffix')))]",
+            "deployerInfo": "[deployer()]",
+            "deployingUserPrincipalId": "[variables('deployerInfo').objectId]",
+            "deployingUserPrincipalName": "[coalesce(tryGet(variables('deployerInfo'), 'userPrincipalName'), variables('deployerInfo').objectId)]",
+            "existingTags": "[coalesce(resourceGroup().tags, createObject())]",
+            "resourceTags": "[union(variables('existingTags'), parameters('tags'), createObject('TemplateName', 'KM-Generic', 'CreatedBy', parameters('createdBy'), 'DeploymentName', deployment().name, 'Type', 'Non-WAF'))]",
+            "useExistingLogAnalytics": "[not(empty(parameters('existingLogAnalyticsWorkspaceId')))]",
+            "aiModelDeployments": [
+              {
+                "name": "[parameters('gptModelName')]",
+                "model": "[parameters('gptModelName')]",
+                "sku": {
+                  "name": "[parameters('deploymentType')]",
+                  "capacity": "[parameters('gptDeploymentCapacity')]"
+                },
+                "version": "[parameters('gptModelVersion')]",
+                "raiPolicyName": "Microsoft.Default"
+              },
+              {
+                "name": "[parameters('embeddingModel')]",
+                "model": "[parameters('embeddingModel')]",
+                "sku": {
+                  "name": "GlobalStandard",
+                  "capacity": "[parameters('embeddingDeploymentCapacity')]"
+                },
+                "version": "1",
+                "raiPolicyName": "Microsoft.Default"
+              }
+            ],
+            "useExistingAIProject": "[not(empty(parameters('existingFoundryProjectResourceId')))]",
+            "aiFoundrySubscriptionId": "[if(variables('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], subscription().subscriptionId)]",
+            "aiFoundryResourceGroupName": "[if(variables('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], resourceGroup().name)]",
+            "placeholderImageName": "DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest"
+          },
           "resources": [
             {
-              "type": "Microsoft.Sql/servers",
-              "apiVersion": "2023-08-01-preview",
-              "name": "[parameters('serverName')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
+              "type": "Microsoft.Resources/tags",
+              "apiVersion": "2024-11-01",
+              "name": "default",
+              "properties": {
+                "tags": "[variables('resourceTags')]"
+              }
+            },
+            {
+              "condition": "[not(variables('useExistingLogAnalytics'))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.log-analytics.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "3561501102733674034"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('log-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the Log Analytics workspace. Defaults to log-{solutionName}."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "retentionInDays": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "metadata": {
+                        "description": "Retention period in days."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "PerGB2018",
+                      "metadata": {
+                        "description": "SKU name for the workspace."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resource."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2023-09-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[parameters('identity')]",
+                      "properties": {
+                        "retentionInDays": "[parameters('retentionInDays')]",
+                        "sku": {
+                          "name": "[parameters('skuName')]"
+                        }
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Log Analytics workspace."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the Log Analytics workspace."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Location of the workspace."
+                      },
+                      "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), '2023-09-01', 'full').location]"
+                    },
+                    "logAnalyticsWorkspaceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Log Analytics workspace customer ID."
+                      },
+                      "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), '2023-09-01').customerId]"
+                    }
+                  }
+                }
+              }
+            },
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.app-insights.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
               "properties": {
-                "minimalTlsVersion": "1.2",
-                "publicNetworkAccess": "Enabled",
-                "administrators": {
-                  "azureADOnlyAuthentication": true,
-                  "administratorType": "ActiveDirectory",
-                  "login": "[parameters('adminLogin')]",
-                  "sid": "[parameters('adminObjectId')]",
-                  "tenantId": "[subscription().tenantId]"
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "workspaceResourceId": "[if(variables('useExistingLogAnalytics'), createObject('value', parameters('existingLogAnalyticsWorkspaceId')), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.log-analytics.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "2461614014827306322"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('appi-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the Application Insights instance. Defaults to appi-{solutionName}."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "workspaceResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Log Analytics workspace to link to."
+                      }
+                    },
+                    "applicationType": {
+                      "type": "string",
+                      "defaultValue": "web",
+                      "metadata": {
+                        "description": "Application type."
+                      }
+                    },
+                    "retentionInDays": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "metadata": {
+                        "description": "Retention period in days."
+                      }
+                    },
+                    "disableIpMasking": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Disable IP masking for security."
+                      }
+                    },
+                    "flowType": {
+                      "type": "string",
+                      "defaultValue": "Bluefield",
+                      "metadata": {
+                        "description": "Flow type for Application Insights."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "web",
+                      "metadata": {
+                        "description": "Kind of Application Insights resource."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Insights/components",
+                      "apiVersion": "2020-02-02",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "properties": {
+                        "Application_Type": "[parameters('applicationType')]",
+                        "Flow_Type": "[parameters('flowType')]",
+                        "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
+                        "RetentionInDays": "[parameters('retentionInDays')]",
+                        "DisableIpMasking": "[parameters('disableIpMasking')]",
+                        "publicNetworkAccessForIngestion": "Enabled",
+                        "publicNetworkAccessForQuery": "Enabled"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Application Insights instance."
+                      },
+                      "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the Application Insights instance."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "instrumentationKey": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Instrumentation key for the Application Insights instance."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Insights/components', parameters('name')), '2020-02-02').InstrumentationKey]"
+                    },
+                    "connectionString": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Connection string for the Application Insights instance."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Insights/components', parameters('name')), '2020-02-02').ConnectionString]"
+                    },
+                    "applicationId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Application ID of the Application Insights instance."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Insights/components', parameters('name')), '2020-02-02').AppId]"
+                    }
+                  }
                 }
-              }
-            },
-            {
-              "type": "Microsoft.Sql/servers/databases",
-              "apiVersion": "2023-08-01-preview",
-              "name": "[format('{0}/{1}', parameters('serverName'), parameters('databaseName'))]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "sku": {
-                "name": "Basic",
-                "tier": "Basic",
-                "capacity": 5
-              },
-              "properties": {
-                "collation": "SQL_Latin1_General_CP1_CI_AS",
-                "maxSizeBytes": 2147483648
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
-              ]
-            },
-            {
-              "type": "Microsoft.Sql/servers/firewallRules",
-              "apiVersion": "2025-01-01",
-              "name": "[format('{0}/{1}', parameters('serverName'), 'AllowSpecificRange')]",
-              "properties": {
-                "startIpAddress": "0.0.0.0",
-                "endIpAddress": "255.255.255.255"
               },
               "dependsOn": [
-                "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.log-analytics.{0}', parameters('solutionName')), 64))]"
               ]
             },
             {
-              "type": "Microsoft.Sql/servers/firewallRules",
-              "apiVersion": "2025-01-01",
-              "name": "[format('{0}/{1}', parameters('serverName'), 'AllowAllWindowsAzureIps')]",
+              "condition": "[empty(parameters('existingFoundryProjectResourceId'))]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
               "properties": {
-                "startIpAddress": "0.0.0.0",
-                "endIpAddress": "0.0.0.0"
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.Sql/servers', parameters('serverName'))]"
-              ]
-            }
-          ],
-          "outputs": {
-            "serverFqdn": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.Sql/servers', parameters('serverName')), '2023-08-01-preview').fullyQualifiedDomainName]"
-            },
-            "serverName": {
-              "type": "string",
-              "value": "[parameters('serverName')]"
-            },
-            "databaseName": {
-              "type": "string",
-              "value": "[parameters('databaseName')]"
-            }
-          }
-        }
-      }
-    },
-    {
-      "condition": "[parameters('deployCosmos')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "cosmos",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[format('{0}{1}', variables('abbrs').databases.cosmosDBDatabase, variables('resourceToken'))]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          },
-          "databaseName": {
-            "value": "km-db"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "2316365966357801553"
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string"
-            },
-            "location": {
-              "type": "string"
-            },
-            "tags": {
-              "type": "object"
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('azureAiServiceLocation')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "7677890268465434115"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Solution name suffix used to generate resource names."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('aif-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the AI Services account. Defaults to aif-{solutionName}."
+                      }
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "defaultValue": "[format('proj-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Azure region for the resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Tags to apply to resources."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "S0",
+                      "metadata": {
+                        "description": "Optional. SKU name for the AI Services account."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether to disable local (key-based) authentication."
+                      }
+                    },
+                    "allowProjectManagement": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether to allow project management (AI Foundry hub)."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Optional. Public network access setting."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resources."
+                      }
+                    },
+                    "networkAclsDefaultAction": {
+                      "type": "string",
+                      "defaultValue": "Allow",
+                      "allowedValues": [
+                        "Allow",
+                        "Deny"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Network ACLs default action."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.CognitiveServices/accounts",
+                      "apiVersion": "2025-12-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]"
+                      },
+                      "kind": "AIServices",
+                      "identity": "[parameters('identity')]",
+                      "properties": {
+                        "allowProjectManagement": "[parameters('allowProjectManagement')]",
+                        "customSubDomainName": "[parameters('name')]",
+                        "networkAcls": {
+                          "defaultAction": "[parameters('networkAclsDefaultAction')]",
+                          "virtualNetworkRules": [],
+                          "ipRules": []
+                        },
+                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                        "disableLocalAuth": "[parameters('disableLocalAuth')]"
+                      }
+                    },
+                    {
+                      "type": "Microsoft.CognitiveServices/accounts/projects",
+                      "apiVersion": "2025-12-01",
+                      "name": "[format('{0}/{1}', parameters('name'), parameters('projectName'))]",
+                      "location": "[parameters('location')]",
+                      "kind": "AIServices",
+                      "identity": "[parameters('identity')]",
+                      "properties": {},
+                      "dependsOn": [
+                        "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Services account."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Services account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the AI Services account (OpenAI Language Model Instance API)."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['OpenAI Language Model Instance API']]"
+                    },
+                    "cognitiveServicesEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the AI Services account (Cognitive Services)."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoint]"
+                    },
+                    "azureOpenAiCuEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure OpenAI Content Understanding endpoint URL."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]"
+                    },
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID of the AI Services account."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full').identity.principalId]"
+                    },
+                    "projectResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Foundry project."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]"
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Foundry project."
+                      },
+                      "value": "[parameters('projectName')]"
+                    },
+                    "projectEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "AI Foundry project endpoint."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]"
+                    },
+                    "projectIdentityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID of the project."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full').identity.principalId]"
+                    }
+                  }
+                }
+              }
             },
-            "databaseName": {
-              "type": "string"
-            }
-          },
-          "resources": [
             {
-              "type": "Microsoft.DocumentDB/databaseAccounts",
-              "apiVersion": "2024-05-15",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "kind": "GlobalDocumentDB",
+              "condition": "[variables('useExistingAIProject')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)]",
+              "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+              "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
               "properties": {
-                "databaseAccountOfferType": "Standard",
-                "consistencyPolicy": {
-                  "defaultConsistencyLevel": "Session"
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
                 },
-                "locations": [
-                  {
-                    "locationName": "[parameters('location')]",
-                    "failoverPriority": 0,
-                    "isZoneRedundant": false
-                  }
-                ],
-                "capabilities": [
-                  {
-                    "name": "EnableServerless"
+                "mode": "Incremental",
+                "parameters": {
+                  "name": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value))]",
+                  "projectName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[10]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectName.value))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "8348022486141626008"
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the existing Cognitive Services account."
+                      }
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the existing AI project."
+                      }
+                    }
+                  },
+                  "resources": [],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Services account."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Services account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the AI Services account (OpenAI Language Model Instance API)."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['OpenAI Language Model Instance API']]"
+                    },
+                    "cognitiveServicesEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the AI Services account (Cognitive Services)."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoint]"
+                    },
+                    "azureOpenAiCuEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure OpenAI Content Understanding endpoint URL."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]"
+                    },
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID of the AI Services account (empty if none)."
+                      },
+                      "value": "[if(and(contains(reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full'), 'identity'), contains(reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full').identity, 'principalId')), reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01', 'full').identity.principalId, '')]"
+                    },
+                    "projectResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Foundry project."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]"
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Foundry project."
+                      },
+                      "value": "[parameters('projectName')]"
+                    },
+                    "projectEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "AI Foundry project endpoint."
+                      },
+                      "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]"
+                    },
+                    "projectIdentityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID of the project (empty if none)."
+                      },
+                      "value": "[if(and(contains(reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full'), 'identity'), contains(reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full').identity, 'principalId')), reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01', 'full').identity.principalId, '')]"
+                    }
                   }
-                ],
-                "publicNetworkAccess": "Enabled"
-              }
-            },
-            {
-              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
-              "apiVersion": "2024-05-15",
-              "name": "[format('{0}/{1}', parameters('name'), parameters('databaseName'))]",
-              "properties": {
-                "resource": {
-                  "id": "[parameters('databaseName')]"
                 }
               },
               "dependsOn": [
-                "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]"
               ]
             },
             {
-              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
-              "apiVersion": "2024-05-15",
-              "name": "[format('{0}/{1}/{2}', parameters('name'), parameters('databaseName'), 'chat_sessions')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64)]",
+              "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+              "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
               "properties": {
-                "resource": {
-                  "id": "chat_sessions",
-                  "partitionKey": {
-                    "paths": [
-                      "/user_id"
-                    ],
-                    "kind": "Hash"
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "aiServicesAccountName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value))]",
+                  "projectName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[10]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectName.value))]",
+                  "category": {
+                    "value": "CognitiveSearch"
+                  },
+                  "target": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value]"
+                  },
+                  "authType": {
+                    "value": "AAD"
+                  },
+                  "metadata": {
+                    "value": {
+                      "ApiType": "Azure",
+                      "ResourceId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+                    }
                   }
-                }
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('name'), parameters('databaseName'))]"
-              ]
-            },
-            {
-              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
-              "apiVersion": "2024-05-15",
-              "name": "[format('{0}/{1}/{2}', parameters('name'), parameters('databaseName'), 'chat_messages')]",
-              "properties": {
-                "resource": {
-                  "id": "chat_messages",
-                  "partitionKey": {
-                    "paths": [
-                      "/session_id"
-                    ],
-                    "kind": "Hash"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "14116608463414189185"
+                    }
+                  },
+                  "parameters": {
+                    "aiServicesAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the parent AI Services account."
+                      }
+                    },
+                    "projectName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the AI Foundry project."
+                      }
+                    },
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Solution name suffix used to generate the connection name."
+                      }
+                    },
+                    "connectionName": {
+                      "type": "string",
+                      "defaultValue": "[toLower(format('{0}-connection-{1}', parameters('category'), parameters('solutionName')))]",
+                      "metadata": {
+                        "description": "Optional. Connection name. Defaults to lowercase category with solution suffix."
+                      }
+                    },
+                    "category": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Connection category (e.g., CognitiveSearch, AzureBlob, AppInsights, RemoteTool)."
+                      }
+                    },
+                    "target": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Connection target (URL or resource ID)."
+                      }
+                    },
+                    "authType": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Authentication type (e.g., AAD, ApiKey, ProjectManagedIdentity)."
+                      }
+                    },
+                    "isSharedToAll": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether the connection is shared to all project users."
+                      }
+                    },
+                    "isDefault": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether this is the default connection for its category."
+                      }
+                    },
+                    "metadata": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Connection metadata object."
+                      }
+                    },
+                    "useWorkspaceManagedIdentity": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to use workspace-managed identity for authentication."
+                      }
+                    },
+                    "credentialsKey": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Credentials key (for ApiKey auth type)."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "baseProperties": {
+                      "category": "[parameters('category')]",
+                      "target": "[parameters('target')]",
+                      "authType": "[parameters('authType')]",
+                      "isSharedToAll": "[parameters('isSharedToAll')]",
+                      "metadata": "[parameters('metadata')]",
+                      "useWorkspaceManagedIdentity": "[parameters('useWorkspaceManagedIdentity')]"
+                    },
+                    "optionalDefault": "[if(parameters('isDefault'), createObject('isDefault', true()), createObject())]",
+                    "optionalCredentials": "[if(not(empty(parameters('credentialsKey'))), createObject('credentials', createObject('key', parameters('credentialsKey'))), createObject())]"
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.CognitiveServices/accounts/projects/connections",
+                      "apiVersion": "2025-12-01",
+                      "name": "[format('{0}/{1}/{2}', parameters('aiServicesAccountName'), parameters('projectName'), parameters('connectionName'))]",
+                      "properties": "[union(variables('baseProperties'), variables('optionalDefault'), variables('optionalCredentials'))]"
+                    }
+                  ],
+                  "outputs": {
+                    "connectionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Connection name."
+                      },
+                      "value": "[parameters('connectionName')]"
+                    },
+                    "connectionId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Connection resource ID."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects/connections', parameters('aiServicesAccountName'), parameters('projectName'), parameters('connectionName'))]"
+                    }
                   }
                 }
               },
               "dependsOn": [
-                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('name'), parameters('databaseName'))]"
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64))]"
               ]
             },
             {
-              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
-              "apiVersion": "2024-05-15",
-              "name": "[format('{0}/{1}/{2}', parameters('name'), parameters('databaseName'), 'document_insights')]",
-              "properties": {
-                "resource": {
-                  "id": "document_insights",
-                  "partitionKey": {
-                    "paths": [
-                      "/dataset_id"
-                    ],
-                    "kind": "Hash"
-                  }
-                }
+              "copy": {
+                "name": "model_deployments",
+                "count": "[length(variables('aiModelDeployments'))]",
+                "mode": "serial",
+                "batchSize": 1
               },
-              "dependsOn": [
-                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('name'), parameters('databaseName'))]"
-              ]
-            },
-            {
-              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
-              "apiVersion": "2024-05-15",
-              "name": "[format('{0}/{1}/{2}', parameters('name'), parameters('databaseName'), 'enrichment_cache')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.model-deployment-{0}.{1}', copyIndex(), parameters('solutionName')), 64)]",
+              "subscriptionId": "[variables('aiFoundrySubscriptionId')]",
+              "resourceGroup": "[variables('aiFoundryResourceGroupName')]",
               "properties": {
-                "resource": {
-                  "id": "enrichment_cache",
-                  "partitionKey": {
-                    "paths": [
-                      "/doc_hash"
-                    ],
-                    "kind": "Hash"
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "aiServicesAccountName": "[if(variables('useExistingAIProject'), createObject('value', split(parameters('existingFoundryProjectResourceId'), '/')[8]), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value))]",
+                  "deploymentName": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].name]"
+                  },
+                  "modelName": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].model]"
+                  },
+                  "modelVersion": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].version]"
+                  },
+                  "raiPolicyName": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].raiPolicyName]"
+                  },
+                  "skuName": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].sku.name]"
+                  },
+                  "skuCapacity": {
+                    "value": "[variables('aiModelDeployments')[copyIndex()].sku.capacity]"
                   }
-                }
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('name'), parameters('databaseName'))]"
-              ]
-            }
-          ],
-          "outputs": {
-            "endpoint": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '2024-05-15').documentEndpoint]"
-            },
-            "name": {
-              "type": "string",
-              "value": "[parameters('name')]"
-            },
-            "id": {
-              "type": "string",
-              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
-            }
-          }
-        }
-      }
-    },
-    {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "container-registry",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('acrName')]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "5043171277548522585"
-            },
-            "description": "Creates a dedicated Azure Container Registry for the application container images."
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the container registry (alphanumeric, 5-50 chars, globally unique)."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for the registry."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional. Tags for the registry."
-              }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "5315493943580072668"
+                    }
+                  },
+                  "parameters": {
+                    "aiServicesAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the parent AI Services account."
+                      }
+                    },
+                    "deploymentName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name for this model deployment."
+                      }
+                    },
+                    "modelFormat": {
+                      "type": "string",
+                      "defaultValue": "OpenAI",
+                      "metadata": {
+                        "description": "Optional. Model format (e.g., OpenAI)."
+                      }
+                    },
+                    "modelName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Model name (e.g., gpt-4o, text-embedding-ada-002)."
+                      }
+                    },
+                    "modelVersion": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Model version. Empty string means latest."
+                      }
+                    },
+                    "raiPolicyName": {
+                      "type": "string",
+                      "defaultValue": "Microsoft.Default",
+                      "metadata": {
+                        "description": "Optional. RAI policy name."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. SKU name (e.g., Standard, GlobalStandard)."
+                      }
+                    },
+                    "skuCapacity": {
+                      "type": "int",
+                      "metadata": {
+                        "description": "Required. SKU capacity (tokens per minute in thousands)."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.CognitiveServices/accounts/deployments",
+                      "apiVersion": "2025-12-01",
+                      "name": "[format('{0}/{1}', parameters('aiServicesAccountName'), parameters('deploymentName'))]",
+                      "properties": {
+                        "model": {
+                          "format": "[parameters('modelFormat')]",
+                          "name": "[parameters('modelName')]",
+                          "version": "[if(not(empty(parameters('modelVersion'))), parameters('modelVersion'), null())]"
+                        },
+                        "raiPolicyName": "[parameters('raiPolicyName')]"
+                      },
+                      "sku": {
+                        "name": "[parameters('skuName')]",
+                        "capacity": "[parameters('skuCapacity')]"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the deployed model."
+                      },
+                      "value": "[parameters('deploymentName')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the model deployment."
+                      },
+                      "value": "[resourceId('Microsoft.CognitiveServices/accounts/deployments', parameters('aiServicesAccountName'), parameters('deploymentName'))]"
+                    }
+                  }
+                }
+              },
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]"
+              ]
             },
-            "sku": {
-              "type": "string",
-              "defaultValue": "Standard",
-              "allowedValues": [
-                "Basic",
-                "Standard",
-                "Premium"
-              ],
-              "metadata": {
-                "description": "Optional. SKU for the registry."
-              }
-            }
-          },
-          "resources": [
             {
-              "type": "Microsoft.ContainerRegistry/registries",
-              "apiVersion": "2023-07-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "sku": {
-                "name": "[parameters('sku')]"
-              },
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.ai-search.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
               "properties": {
-                "adminUserEnabled": false,
-                "publicNetworkAccess": "Enabled"
-              }
-            }
-          ],
-          "outputs": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the container registry."
-              },
-              "value": "[parameters('name')]"
-            },
-            "loginServer": {
-              "type": "string",
-              "metadata": {
-                "description": "The login server of the container registry."
-              },
-              "value": "[reference(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '2023-07-01').loginServer]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the container registry."
-              },
-              "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
-            }
-          }
-        }
-      }
-    },
-    {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "deploy_app_service_plan_serverfarm",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('webServerFarmResourceName')]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "tags": {
-            "value": "[parameters('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "1114801488881544535"
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Name of the App Service Plan"
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Location for the resource"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags for the resource"
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "skuName": {
+                    "value": "standard"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "10009140357497945010"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "minLength": 3,
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('srch-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Optional. Override name for the search service. Defaults to srch-{solutionName}."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "basic",
+                      "allowedValues": [
+                        "free",
+                        "basic",
+                        "standard",
+                        "standard2",
+                        "standard3",
+                        "storage_optimized_l1",
+                        "storage_optimized_l2"
+                      ],
+                      "metadata": {
+                        "description": "SKU name for the search service."
+                      }
+                    },
+                    "replicaCount": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Number of replicas."
+                      }
+                    },
+                    "partitionCount": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Number of partitions."
+                      }
+                    },
+                    "hostingMode": {
+                      "type": "string",
+                      "defaultValue": "Default",
+                      "allowedValues": [
+                        "Default",
+                        "HighDensity"
+                      ],
+                      "metadata": {
+                        "description": "Hosting mode."
+                      }
+                    },
+                    "semanticSearch": {
+                      "type": "string",
+                      "defaultValue": "free",
+                      "allowedValues": [
+                        "disabled",
+                        "free",
+                        "standard"
+                      ],
+                      "metadata": {
+                        "description": "Semantic search tier."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Whether to disable local authentication."
+                      }
+                    },
+                    "authOptions": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Authentication options for the search service."
+                      }
+                    },
+                    "networkRuleSet": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Network rule set for the search service."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resource."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Search/searchServices",
+                      "apiVersion": "2025-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]"
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "searchServiceUpdate",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "skuName": {
+                            "value": "[parameters('skuName')]"
+                          },
+                          "replicaCount": {
+                            "value": "[parameters('replicaCount')]"
+                          },
+                          "partitionCount": {
+                            "value": "[parameters('partitionCount')]"
+                          },
+                          "hostingMode": {
+                            "value": "[parameters('hostingMode')]"
+                          },
+                          "semanticSearch": {
+                            "value": "[parameters('semanticSearch')]"
+                          },
+                          "disableLocalAuth": {
+                            "value": "[parameters('disableLocalAuth')]"
+                          },
+                          "authOptions": {
+                            "value": "[parameters('authOptions')]"
+                          },
+                          "networkRuleSet": {
+                            "value": "[parameters('networkRuleSet')]"
+                          },
+                          "identity": {
+                            "value": "[parameters('identity')]"
+                          },
+                          "publicNetworkAccess": {
+                            "value": "[parameters('publicNetworkAccess')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.46.1.21595",
+                              "templateHash": "490514611876211300"
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the existing AI Search service."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The Azure region of the search service."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Tags to apply to the resource."
+                              }
+                            },
+                            "skuName": {
+                              "type": "string",
+                              "defaultValue": "basic",
+                              "metadata": {
+                                "description": "SKU name for the search service."
+                              }
+                            },
+                            "replicaCount": {
+                              "type": "int",
+                              "defaultValue": 1,
+                              "metadata": {
+                                "description": "Number of replicas."
+                              }
+                            },
+                            "partitionCount": {
+                              "type": "int",
+                              "defaultValue": 1,
+                              "metadata": {
+                                "description": "Number of partitions."
+                              }
+                            },
+                            "hostingMode": {
+                              "type": "string",
+                              "defaultValue": "Default",
+                              "allowedValues": [
+                                "Default",
+                                "HighDensity"
+                              ],
+                              "metadata": {
+                                "description": "Hosting mode."
+                              }
+                            },
+                            "semanticSearch": {
+                              "type": "string",
+                              "defaultValue": "free",
+                              "metadata": {
+                                "description": "Semantic search tier."
+                              }
+                            },
+                            "disableLocalAuth": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Whether to disable local authentication."
+                              }
+                            },
+                            "authOptions": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Authentication options for the search service."
+                              }
+                            },
+                            "networkRuleSet": {
+                              "type": "object",
+                              "defaultValue": {},
+                              "metadata": {
+                                "description": "Optional. Network rule set for the search service."
+                              }
+                            },
+                            "identity": {
+                              "type": "object",
+                              "defaultValue": {
+                                "type": "SystemAssigned"
+                              },
+                              "metadata": {
+                                "description": "Optional. Managed identity configuration for the resource."
+                              }
+                            },
+                            "publicNetworkAccess": {
+                              "type": "string",
+                              "defaultValue": "Enabled",
+                              "metadata": {
+                                "description": "Public network access setting."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Search/searchServices",
+                              "apiVersion": "2025-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "sku": {
+                                "name": "[parameters('skuName')]"
+                              },
+                              "identity": "[parameters('identity')]",
+                              "properties": {
+                                "replicaCount": "[parameters('replicaCount')]",
+                                "partitionCount": "[parameters('partitionCount')]",
+                                "hostingMode": "[parameters('hostingMode')]",
+                                "semanticSearch": "[parameters('semanticSearch')]",
+                                "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                                "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                                "authOptions": "[if(not(empty(parameters('authOptions'))), parameters('authOptions'), null())]",
+                                "networkRuleSet": "[if(not(empty(parameters('networkRuleSet'))), parameters('networkRuleSet'), null())]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID of the AI Search system-assigned managed identity."
+                              },
+                              "value": "[reference(resourceId('Microsoft.Search/searchServices', parameters('name')), '2025-05-01', 'full').identity.principalId]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the AI Search service."
+                      },
+                      "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the AI Search service."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint URL of the AI Search service."
+                      },
+                      "value": "[format('https://{0}.search.windows.net', parameters('name'))]"
+                    },
+                    "identityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'searchServiceUpdate'), '2025-04-01').outputs.systemAssignedMIPrincipalId.value]"
+                    }
+                  }
+                }
               }
             },
-            "skuName": {
-              "type": "string",
-              "defaultValue": "B1",
-              "allowedValues": [
-                "B1",
-                "B2",
-                "B3",
-                "S1",
-                "S2",
-                "S3",
-                "P1v3",
-                "P2v3",
-                "P3v3"
-              ],
-              "metadata": {
-                "description": "SKU name for the App Service Plan"
-              }
-            }
-          },
-          "resources": [
             {
-              "type": "Microsoft.Web/serverfarms",
-              "apiVersion": "2024-04-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "tags": "[parameters('tags')]",
-              "kind": "linux",
-              "properties": {
-                "reserved": true
-              },
-              "sku": {
-                "name": "[parameters('skuName')]"
-              }
-            }
-          ],
-          "outputs": {
-            "id": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the App Service Plan"
-              },
-              "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]"
-            },
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the App Service Plan"
-              },
-              "value": "[parameters('name')]"
-            }
-          }
-        }
-      }
-    },
-    {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[take(format('module.web-sites.{0}', variables('backendWebSiteResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('backendWebSiteResourceName')]"
-          },
-          "tags": {
-            "value": "[union(parameters('tags'), createObject('azd-service-name', 'backend'))]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "kind": {
-            "value": "app,linux"
-          },
-          "serverFarmResourceId": {
-            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'deploy_app_service_plan_serverfarm'), '2025-04-01').outputs.id.value]"
-          },
-          "managedIdentities": {
-            "value": {
-              "systemAssigned": true
-            }
-          },
-          "siteConfig": {
-            "value": {
-              "linuxFxVersion": "DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest",
-              "acrUseManagedIdentityCreds": true,
-              "appCommandLine": "",
-              "minTlsVersion": "1.2"
-            }
-          },
-          "configs": {
-            "value": [
-              {
-                "name": "appsettings",
-                "properties": {
-                  "DOCKER_REGISTRY_SERVER_URL": "[format('https://{0}', reference(resourceId('Microsoft.Resources/deployments', 'container-registry'), '2025-04-01').outputs.loginServer.value)]",
-                  "WEBSITES_PORT": "8000",
-                  "AZURE_OPENAI_ENDPOINT": "[if(parameters('useExistingAiProject'), parameters('existingAiFoundryEndpoint'), reference(resourceId('Microsoft.Resources/deployments', 'ai-services'), '2025-04-01').outputs.endpoint.value)]",
-                  "AZURE_OPENAI_CHAT_DEPLOYMENT": "[parameters('chatDeploymentName')]",
-                  "AZURE_OPENAI_EMBEDDING_DEPLOYMENT": "[parameters('embeddingDeploymentName')]",
-                  "AZURE_SEARCH_ENDPOINT": "[reference(resourceId('Microsoft.Resources/deployments', 'search'), '2025-04-01').outputs.endpoint.value]",
-                  "AZURE_SEARCH_INDEX_NAME": "knowledge-mining-index",
-                  "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": "[reference(resourceId('Microsoft.Resources/deployments', 'ai-services'), '2025-04-01').outputs.endpoints.value['Content Understanding']]",
-                  "AZURE_STORAGE_ACCOUNT": "[reference(resourceId('Microsoft.Resources/deployments', 'storage'), '2025-04-01').outputs.accountName.value]",
-                  "AZURE_SQL_SERVER": "[reference(resourceId('Microsoft.Resources/deployments', 'sql'), '2025-04-01').outputs.serverFqdn.value]",
-                  "AZURE_SQL_DATABASE": "[format('{0}{1}', variables('abbrs').databases.sqlDatabase, variables('resourceToken'))]",
-                  "AZURE_COSMOS_ENDPOINT": "[if(parameters('deployCosmos'), reference(resourceId('Microsoft.Resources/deployments', 'cosmos'), '2025-04-01').outputs.endpoint.value, '')]",
-                  "AZURE_COSMOS_DATABASE": "[if(parameters('deployCosmos'), 'km-db', '')]",
-                  "AZURE_AD_TENANT_ID": "[parameters('azureAdTenantId')]",
-                  "AZURE_AD_CLIENT_ID": "[parameters('azureAdClientId')]",
-                  "AZURE_AI_AGENT_ENDPOINT": "[if(parameters('useExistingAiProject'), parameters('existingAiFoundryEndpoint'), reference(resourceId('Microsoft.Resources/deployments', 'ai-services'), '2025-04-01').outputs.aiProjectInfo.value.apiEndpoint)]",
-                  "AZURE_AI_SEARCH_CONNECTION_NAME": "[if(parameters('useExistingAiProject'), parameters('existingAiSearchConnectionName'), variables('aiSearchConnectionName'))]",
-                  "API_APP_NAME": "[variables('backendWebSiteResourceName')]",
-                  "APP_FRONTEND_HOSTNAME": "[format('https://{0}.azurewebsites.net', variables('frontendWebSiteResourceName'))]",
-                  "APP_ENV": "Prod",
-                  "ADMIN_API_KEY": "[parameters('adminApiKey')]",
-                  "SOLUTION_SUFFIX": "[variables('resourceToken')]"
-                }
-              }
-            ]
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "6418154775494914049"
-            }
-          },
-          "definitions": {
-            "appSettingsConfigType": {
-              "type": "object",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.storage-account.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
               "properties": {
-                "name": {
-                  "type": "string",
-                  "allowedValues": [
-                    "appsettings"
-                  ],
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": {}
+                  },
+                  "containers": {
+                    "value": [
+                      {
+                        "name": "data",
+                        "publicAccess": "None"
+                      }
+                    ]
+                  },
+                  "enableHierarchicalNamespace": {
+                    "value": true
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
                   "metadata": {
-                    "description": "Required. The type of config."
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "4421785903472529399"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[take(format('st{0}', toLower(replace(parameters('solutionName'), '-', ''))), 24)]",
+                      "metadata": {
+                        "description": "Name of the storage account."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "Standard_LRS",
+                      "metadata": {
+                        "description": "Storage account SKU."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "StorageV2",
+                      "metadata": {
+                        "description": "Storage account kind."
+                      }
+                    },
+                    "accessTier": {
+                      "type": "string",
+                      "defaultValue": "Hot",
+                      "allowedValues": [
+                        "Hot",
+                        "Cool"
+                      ],
+                      "metadata": {
+                        "description": "Access tier."
+                      }
+                    },
+                    "allowBlobPublicAccess": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Allow blob public access."
+                      }
+                    },
+                    "allowSharedKeyAccess": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Allow shared key access."
+                      }
+                    },
+                    "enableHierarchicalNamespace": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable hierarchical namespace (Data Lake Storage Gen2)."
+                      }
+                    },
+                    "containers": {
+                      "type": "array",
+                      "defaultValue": [
+                        {
+                          "name": "default",
+                          "publicAccess": "None"
+                        }
+                      ],
+                      "metadata": {
+                        "description": "Blob containers to create."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resource."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2025-08-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]"
+                      },
+                      "identity": "[parameters('identity')]",
+                      "properties": {
+                        "accessTier": "[parameters('accessTier')]",
+                        "allowBlobPublicAccess": "[parameters('allowBlobPublicAccess')]",
+                        "allowSharedKeyAccess": "[parameters('allowSharedKeyAccess')]",
+                        "minimumTlsVersion": "TLS1_2",
+                        "supportsHttpsTrafficOnly": true,
+                        "isHnsEnabled": "[parameters('enableHierarchicalNamespace')]",
+                        "encryption": {
+                          "services": {
+                            "blob": {
+                              "enabled": true
+                            },
+                            "file": {
+                              "enabled": true
+                            }
+                          },
+                          "keySource": "Microsoft.Storage",
+                          "requireInfrastructureEncryption": true
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Storage/storageAccounts/blobServices",
+                      "apiVersion": "2025-08-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'default')]",
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+                      ]
+                    },
+                    {
+                      "copy": {
+                        "name": "blobContainers",
+                        "count": "[length(parameters('containers'))]"
+                      },
+                      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+                      "apiVersion": "2025-08-01",
+                      "name": "[format('{0}/{1}/{2}', parameters('name'), 'default', parameters('containers')[copyIndex()].name)]",
+                      "properties": {
+                        "publicAccess": "[parameters('containers')[copyIndex()].publicAccess]"
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('name'), 'default')]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Storage Account."
+                      },
+                      "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the Storage Account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "blobEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Primary blob endpoint."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2025-08-01').primaryEndpoints.blob]"
+                    },
+                    "serviceEndpoints": {
+                      "type": "object",
+                      "metadata": {
+                        "description": "All service endpoints."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2025-08-01').primaryEndpoints]"
+                    }
                   }
+                }
+              }
+            },
+            {
+              "condition": "[parameters('deployCosmos')]",
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
                 },
-                "applicationInsightResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "name": {
+                    "value": "[format('cosmos-{0}', variables('solutionSuffix'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "databaseName": {
+                    "value": "km-db"
+                  },
+                  "containers": {
+                    "value": [
+                      {
+                        "name": "chat_sessions",
+                        "partitionKeyPath": "/user_id"
+                      },
+                      {
+                        "name": "chat_messages",
+                        "partitionKeyPath": "/session_id"
+                      },
+                      {
+                        "name": "document_insights",
+                        "partitionKeyPath": "/dataset_id"
+                      },
+                      {
+                        "name": "enrichment_cache",
+                        "partitionKeyPath": "/doc_hash"
+                      }
+                    ]
                   }
                 },
-                "retainCurrentAppSettings": {
-                  "type": "bool",
-                  "nullable": true,
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
                   "metadata": {
-                    "description": "Optional. The retain the current app settings. Defaults to true."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {},
-                  "additionalProperties": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. An app settings key-value pair."
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "7776062422456459323"
                     }
                   },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The app settings key-value pairs."
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('cosmos-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the Cosmos DB account."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "databaseName": {
+                      "type": "string",
+                      "defaultValue": "db_conversation_history",
+                      "metadata": {
+                        "description": "Database name."
+                      }
+                    },
+                    "containers": {
+                      "type": "array",
+                      "defaultValue": [
+                        {
+                          "name": "conversations",
+                          "partitionKeyPath": "/userId"
+                        }
+                      ],
+                      "metadata": {
+                        "description": "Container definitions."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resource."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                      "apiVersion": "2025-10-15",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "GlobalDocumentDB",
+                      "identity": "[parameters('identity')]",
+                      "properties": {
+                        "consistencyPolicy": {
+                          "defaultConsistencyLevel": "Session"
+                        },
+                        "locations": [
+                          {
+                            "locationName": "[parameters('location')]",
+                            "failoverPriority": 0,
+                            "isZoneRedundant": false
+                          }
+                        ],
+                        "databaseAccountOfferType": "Standard",
+                        "enableAutomaticFailover": false,
+                        "enableMultipleWriteLocations": false,
+                        "disableLocalAuth": true,
+                        "capabilities": [
+                          {
+                            "name": "EnableServerless"
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                      "apiVersion": "2025-10-15",
+                      "name": "[format('{0}/{1}', parameters('name'), parameters('databaseName'))]",
+                      "properties": {
+                        "resource": {
+                          "id": "[parameters('databaseName')]"
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+                      ]
+                    },
+                    {
+                      "copy": {
+                        "name": "containersRes",
+                        "count": "[length(parameters('containers'))]"
+                      },
+                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
+                      "apiVersion": "2025-10-15",
+                      "name": "[format('{0}/{1}/{2}', parameters('name'), parameters('databaseName'), parameters('containers')[copyIndex()].name)]",
+                      "properties": {
+                        "resource": {
+                          "id": "[parameters('containers')[copyIndex()].name]",
+                          "partitionKey": {
+                            "paths": [
+                              "[parameters('containers')[copyIndex()].partitionKeyPath]"
+                            ],
+                            "kind": "Hash"
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('name'), parameters('databaseName'))]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the Cosmos DB account."
+                      },
+                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the Cosmos DB account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Endpoint of the Cosmos DB account."
+                      },
+                      "value": "[format('https://{0}.documents.azure.com:443/', parameters('name'))]"
+                    },
+                    "databaseName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Database name."
+                      },
+                      "value": "[parameters('databaseName')]"
+                    },
+                    "containerName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Container name (first container)."
+                      },
+                      "value": "[parameters('containers')[0].name]"
+                    }
                   }
                 }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type of an app settings configuration."
               }
             },
-            "_1.lockType": {
-              "type": "object",
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.sql-db.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
               "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
+                  },
+                  "name": {
+                    "value": "[format('sql-{0}', variables('solutionSuffix'))]"
+                  },
+                  "databaseName": {
+                    "value": "[format('sqldb-{0}', variables('solutionSuffix'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[variables('resourceTags')]"
+                  },
+                  "deployerPrincipalId": {
+                    "value": "[variables('deployingUserPrincipalId')]"
+                  },
+                  "deployerPrincipalName": {
+                    "value": "[variables('deployingUserPrincipalName')]"
                   }
                 },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
                   "metadata": {
-                    "description": "Optional. Specify the type of lock."
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "1308147711399284018"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[format('sql-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the SQL Server."
+                      }
+                    },
+                    "databaseName": {
+                      "type": "string",
+                      "defaultValue": "[format('sqldb-{0}', parameters('solutionName'))]",
+                      "metadata": {
+                        "description": "Name of the SQL Database."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "deployerPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Principal ID of the deployer for admin access."
+                      }
+                    },
+                    "deployerPrincipalName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Principal name of the deployer for admin access."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "GP_S_Gen5",
+                      "metadata": {
+                        "description": "SKU name for the database."
+                      }
+                    },
+                    "skuTier": {
+                      "type": "string",
+                      "defaultValue": "GeneralPurpose",
+                      "metadata": {
+                        "description": "SKU tier for the database."
+                      }
+                    },
+                    "skuFamily": {
+                      "type": "string",
+                      "defaultValue": "Gen5",
+                      "metadata": {
+                        "description": "SKU family."
+                      }
+                    },
+                    "skuCapacity": {
+                      "type": "int",
+                      "defaultValue": 2,
+                      "metadata": {
+                        "description": "vCore capacity."
+                      }
+                    },
+                    "autoPauseDelay": {
+                      "type": "int",
+                      "defaultValue": 60,
+                      "metadata": {
+                        "description": "Auto-pause delay in minutes."
+                      }
+                    },
+                    "minCapacity": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Minimum capacity (vCores)."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resource."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Sql/servers",
+                      "apiVersion": "2025-01-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[parameters('identity')]",
+                      "properties": {
+                        "publicNetworkAccess": "Enabled",
+                        "version": "12.0",
+                        "restrictOutboundNetworkAccess": "Disabled",
+                        "minimalTlsVersion": "1.2",
+                        "administrators": {
+                          "login": "[parameters('deployerPrincipalName')]",
+                          "sid": "[parameters('deployerPrincipalId')]",
+                          "tenantId": "[subscription().tenantId]",
+                          "administratorType": "ActiveDirectory",
+                          "azureADOnlyAuthentication": true
+                        }
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Sql/servers/firewallRules",
+                      "apiVersion": "2025-01-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'AllowSpecificRange')]",
+                      "properties": {
+                        "startIpAddress": "0.0.0.0",
+                        "endIpAddress": "255.255.255.255"
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+                      ]
+                    },
+                    {
+                      "type": "Microsoft.Sql/servers/firewallRules",
+                      "apiVersion": "2025-01-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'AllowAllAzureServicesAndResourcesWithinAzureIps')]",
+                      "properties": {
+                        "startIpAddress": "0.0.0.0",
+                        "endIpAddress": "0.0.0.0"
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+                      ]
+                    },
+                    {
+                      "type": "Microsoft.Sql/servers/databases",
+                      "apiVersion": "2025-01-01",
+                      "name": "[format('{0}/{1}', parameters('name'), parameters('databaseName'))]",
+                      "location": "[parameters('location')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]",
+                        "tier": "[parameters('skuTier')]",
+                        "family": "[parameters('skuFamily')]",
+                        "capacity": "[parameters('skuCapacity')]"
+                      },
+                      "properties": {
+                        "collation": "SQL_Latin1_General_CP1_CI_AS",
+                        "autoPauseDelay": "[parameters('autoPauseDelay')]",
+                        "minCapacity": "[parameters('minCapacity')]",
+                        "readScale": "Disabled",
+                        "zoneRedundant": false
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "serverFqdn": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Fully qualified domain name of the SQL Server."
+                      },
+                      "value": "[format('{0}.database.windows.net', parameters('name'))]"
+                    },
+                    "databaseName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the SQL Database."
+                      },
+                      "value": "[parameters('databaseName')]"
+                    },
+                    "serverResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the SQL Server."
+                      },
+                      "value": "[resourceId('Microsoft.Sql/servers', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the SQL Server."
+                      },
+                      "value": "[parameters('name')]"
+                    }
                   }
                 }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
               }
             },
-            "_1.privateEndpointCustomDnsConfigType": {
-              "type": "object",
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.app-service-plan.{0}', parameters('solutionName')), 64)]",
               "properties": {
-                "fqdn": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                  }
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
                 },
-                "ipAddresses": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
                   },
-                  "metadata": {
-                    "description": "Required. A list of private IP addresses of the private endpoint."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointIpConfigurationType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the resource that is unique within a resource group."
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "skuName": {
+                    "value": "[parameters('appServicePlanSku')]"
                   }
                 },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "groupId": {
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "17503458259299065073"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                        "description": "Solution name suffix used to derive the resource name."
                       }
                     },
-                    "memberName": {
+                    "name": {
                       "type": "string",
+                      "defaultValue": "[format('asp-{0}', parameters('solutionName'))]",
                       "metadata": {
-                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                        "description": "Name of the App Service Plan."
                       }
                     },
-                    "privateIPAddress": {
+                    "location": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                        "description": "Azure region for the resource."
                       }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. Properties of private endpoint IP configurations."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointPrivateDnsZoneGroupType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private DNS Zone Group."
-                  }
-                },
-                "privateDnsZoneGroupConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "name": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The name of the private DNS Zone Group config."
-                        }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "B2",
+                      "allowedValues": [
+                        "F1",
+                        "D1",
+                        "B1",
+                        "B2",
+                        "B3",
+                        "S1",
+                        "S2",
+                        "S3",
+                        "P1",
+                        "P2",
+                        "P3",
+                        "P4",
+                        "P0v3",
+                        "P0v4",
+                        "P1v3",
+                        "P1v4",
+                        "P2v3",
+                        "P3v3"
+                      ],
+                      "metadata": {
+                        "description": "SKU name for the App Service Plan."
+                      }
+                    },
+                    "reserved": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Whether the plan is Linux-based."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "linux",
+                      "metadata": {
+                        "description": "Kind of the App Service Plan."
+                      }
+                    },
+                    "skuCapacity": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "metadata": {
+                        "description": "Number of instances (workers)."
+                      }
+                    },
+                    "zoneRedundant": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Enable zone redundancy. Requires Premium SKU (P1v3+)."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
                       },
-                      "privateDnsZoneResourceId": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The resource id of the private DNS zone."
-                        }
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resource."
                       }
                     }
                   },
-                  "metadata": {
-                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "diagnosticSettingFullType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
+                  "resources": [
+                    {
+                      "type": "Microsoft.Web/serverfarms",
+                      "apiVersion": "2025-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]",
+                        "capacity": "[parameters('skuCapacity')]"
                       },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
+                      "properties": {
+                        "reserved": "[parameters('reserved')]",
+                        "zoneRedundant": "[parameters('zoneRedundant')]"
                       },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
+                      "identity": "[parameters('identity')]"
                     }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the App Service Plan."
                       },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
+                      "value": "[resourceId('Microsoft.Web/serverfarms', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the App Service Plan."
+                      },
+                      "value": "[parameters('name')]"
                     }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "managedIdentityAllType": {
-              "type": "object",
-              "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
-                },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
                   }
                 }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
               }
             },
-            "privateEndpointSingleServiceType": {
-              "type": "object",
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.container-registry.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
               "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private Endpoint."
-                  }
-                },
-                "location": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The location to deploy the Private Endpoint to."
-                  }
-                },
-                "privateLinkServiceConnectionName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the private link connection to create."
-                  }
-                },
-                "service": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                  }
-                },
-                "subnetResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                  }
-                },
-                "resourceGroupResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                  }
-                },
-                "privateDnsZoneGroup": {
-                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                  }
-                },
-                "isManualConnection": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If Manual Private Link Connection is required."
-                  }
-                },
-                "manualConnectionRequestMessage": {
-                  "type": "string",
-                  "nullable": true,
-                  "maxLength": 140,
-                  "metadata": {
-                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Custom DNS configurations."
-                  }
-                },
-                "ipConfigurations": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                  }
-                },
-                "applicationSecurityGroupResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                  }
-                },
-                "customNetworkInterfaceName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                  }
-                },
-                "lock": {
-                  "$ref": "#/definitions/_1.lockType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
                 },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.roleAssignmentType"
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
                   },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "tags": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  "name": {
+                    "value": "[variables('containerRegistryResourceName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[variables('resourceTags')]"
                   }
                 },
-                "enableTelemetry": {
-                  "type": "bool",
-                  "nullable": true,
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
                   "metadata": {
-                    "description": "Optional. Enable/Disable usage telemetry for module."
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "4857117904279025114"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name used for naming convention."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[replace(format('cr{0}', parameters('solutionName')), '-', '')]",
+                      "metadata": {
+                        "description": "Name of the container registry."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for deployment."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Resource tags."
+                      }
+                    },
+                    "sku": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "allowedValues": [
+                        "Basic",
+                        "Standard",
+                        "Premium"
+                      ],
+                      "metadata": {
+                        "description": "SKU for the container registry."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    },
+                    "exportPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "enabled",
+                      "metadata": {
+                        "description": "Export policy status."
+                      }
+                    },
+                    "retentionPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "metadata": {
+                        "description": "Retention policy status."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resource."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2025-04-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('sku')]"
+                      },
+                      "identity": "[parameters('identity')]",
+                      "properties": {
+                        "adminUserEnabled": false,
+                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                        "dataEndpointEnabled": false,
+                        "networkRuleBypassOptions": "AzureServices",
+                        "policies": {
+                          "azureADAuthenticationAsArmPolicy": {
+                            "status": "enabled"
+                          },
+                          "exportPolicy": {
+                            "status": "[parameters('exportPolicyStatus')]"
+                          },
+                          "retentionPolicy": {
+                            "status": "[parameters('retentionPolicyStatus')]",
+                            "days": 7
+                          },
+                          "trustPolicy": {
+                            "status": "disabled",
+                            "type": "Notary"
+                          }
+                        },
+                        "zoneRedundancy": "Disabled"
+                      }
+                    }
+                  ],
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the container registry."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "loginServer": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The login server URL."
+                      },
+                      "value": "[reference(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '2025-04-01').loginServer]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the container registry."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
+                    }
                   }
                 }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the site."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all Resources."
-              }
-            },
-            "kind": {
-              "type": "string",
-              "allowedValues": [
-                "functionapp",
-                "functionapp,linux",
-                "app,linux",
-                "app",
-                "app,linux,container",
-                "app,container,windows"
-              ],
-              "metadata": {
-                "description": "Required. Type of site to deploy."
-              }
-            },
-            "serverFarmResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The resource ID of the app service plan to use for the site."
-              }
-            },
-            "httpsOnly": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Configures a site to accept only HTTPS requests."
-              }
-            },
-            "clientAffinityEnabled": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. If client affinity is enabled."
-              }
-            },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentityAllType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
-              }
-            },
-            "siteConfig": {
-              "type": "object",
-              "metadata": {
-                "__bicep_resource_derived_type!": {
-                  "source": "Microsoft.Web/sites@2024-04-01#properties/properties/properties/siteConfig"
-                },
-                "description": "Optional. The site config object."
-              },
-              "defaultValue": {
-                "alwaysOn": true,
-                "minTlsVersion": "1.2",
-                "ftpsState": "FtpsOnly"
-              }
-            },
-            "configs": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/appSettingsConfigType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The web site config."
-              }
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointSingleServiceType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Configuration details for private endpoints."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingFullType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "nullable": true,
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. Whether or not public network access is allowed."
-              }
-            },
-            "vnetRouteAllEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Virtual Network Route All enabled."
-              }
-            },
-            "vnetImagePullEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. To enable pulling image over Virtual Network."
-              }
-            },
-            "virtualNetworkSubnetId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined."
-              }
-            }
-          },
-          "variables": {
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
-          },
-          "resources": {
-            "app": {
-              "type": "Microsoft.Web/sites",
-              "apiVersion": "2024-04-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "kind": "[parameters('kind')]",
-              "tags": "[parameters('tags')]",
-              "identity": "[variables('identity')]",
-              "properties": {
-                "serverFarmId": "[parameters('serverFarmResourceId')]",
-                "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
-                "httpsOnly": "[parameters('httpsOnly')]",
-                "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetId')]",
-                "siteConfig": "[parameters('siteConfig')]",
-                "vnetImagePullEnabled": "[parameters('vnetImagePullEnabled')]",
-                "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]",
-                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled'))]"
               }
             },
-            "app_diagnosticSettings": {
-              "copy": {
-                "name": "app_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                    }
-                  }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-              },
-              "dependsOn": [
-                "app"
-              ]
-            },
-            "app_config": {
-              "copy": {
-                "name": "app_config",
-                "count": "[length(coalesce(parameters('configs'), createArray()))]"
-              },
+            {
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2025-04-01",
-              "name": "[format('{0}-Site-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "name": "[take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "appName": {
-                    "value": "[parameters('name')]"
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
                   },
                   "name": {
-                    "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                    "value": "[format('api-{0}', variables('solutionSuffix'))]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[union(parameters('tags'), createObject('azd-service-name', 'api'))]"
+                  },
+                  "serverFarmResourceId": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.app-service-plan.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
                   },
-                  "applicationInsightResourceId": {
-                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                  "kind": {
+                    "value": "[parameters('kind')]"
                   },
-                  "properties": {
-                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                  "linuxFxVersion": {
+                    "value": "[variables('placeholderImageName')]"
                   },
-                  "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites', parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]"
+                  "acrUseManagedIdentityCreds": {
+                    "value": true
+                  },
+                  "appSettings": {
+                    "value": {
+                      "DOCKER_REGISTRY_SERVER_URL": "[format('https://{0}', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.loginServer.value)]",
+                      "WEBSITES_PORT": "8000",
+                      "AZURE_OPENAI_ENDPOINT": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value)]",
+                      "AZURE_OPENAI_CHAT_DEPLOYMENT": "[parameters('gptModelName')]",
+                      "AZURE_OPENAI_EMBEDDING_DEPLOYMENT": "[parameters('embeddingModel')]",
+                      "AZURE_SEARCH_ENDPOINT": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value]",
+                      "AZURE_SEARCH_INDEX_NAME": "knowledge-mining-index",
+                      "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.azureOpenAiCuEndpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.azureOpenAiCuEndpoint.value)]",
+                      "AZURE_STORAGE_ACCOUNT": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]",
+                      "AZURE_SQL_SERVER": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.serverFqdn.value]",
+                      "AZURE_SQL_DATABASE": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.databaseName.value]",
+                      "AZURE_COSMOS_ENDPOINT": "[if(parameters('deployCosmos'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value, '')]",
+                      "AZURE_COSMOS_DATABASE": "[if(parameters('deployCosmos'), 'km-db', '')]",
+                      "AZURE_AD_TENANT_ID": "[parameters('azureAdTenantId')]",
+                      "AZURE_AD_CLIENT_ID": "[parameters('azureAdClientId')]",
+                      "AZURE_AI_AGENT_ENDPOINT": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectEndpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectEndpoint.value)]",
+                      "AZURE_AI_SEARCH_CONNECTION_NAME": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.connectionName.value]",
+                      "API_APP_NAME": "[format('api-{0}', variables('solutionSuffix'))]",
+                      "APP_FRONTEND_HOSTNAME": "[format('https://app-{0}.azurewebsites.net', variables('solutionSuffix'))]",
+                      "APP_ENV": "Prod",
+                      "ADMIN_API_KEY": "[parameters('adminApiKey')]",
+                      "SOLUTION_SUFFIX": "[variables('solutionSuffix')]"
+                    }
+                  }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.44.1.10279",
-                      "templateHash": "10270735850099556125"
-                    },
-                    "name": "Site App Settings",
-                    "description": "This module deploys a Site App Setting."
+                      "version": "0.46.1.21595",
+                      "templateHash": "15416323965013625336"
+                    }
                   },
                   "parameters": {
-                    "appName": {
+                    "solutionName": {
                       "type": "string",
                       "metadata": {
-                        "description": "Conditional. The name of the parent site resource."
+                        "description": "Solution name suffix used to derive the resource name."
                       }
                     },
                     "name": {
                       "type": "string",
-                      "allowedValues": [
-                        "appsettings",
-                        "authsettings",
-                        "authsettingsV2",
-                        "azurestorageaccounts",
-                        "backup",
-                        "connectionstrings",
-                        "logs",
-                        "metadata",
-                        "pushsettings",
-                        "slotConfigNames",
-                        "web"
-                      ],
+                      "defaultValue": "[parameters('solutionName')]",
+                      "metadata": {
+                        "description": "Name of the App Service."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "serverFarmResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the App Service Plan."
+                      }
+                    },
+                    "linuxFxVersion": {
+                      "type": "string",
                       "metadata": {
-                        "description": "Required. The name of the config."
+                        "description": "Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag)."
                       }
                     },
-                    "properties": {
+                    "appSettings": {
                       "type": "object",
                       "defaultValue": {},
                       "metadata": {
-                        "description": "Optional. The properties of the config."
+                        "description": "Application settings key-value pairs."
+                      }
+                    },
+                    "alwaysOn": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Whether to enable Always On."
+                      }
+                    },
+                    "healthCheckPath": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Health check path for the app."
+                      }
+                    },
+                    "webSocketsEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to enable WebSockets."
+                      }
+                    },
+                    "appCommandLine": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Command line for the application."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "app,linux",
+                      "allowedValues": [
+                        "functionapp",
+                        "functionapp,linux",
+                        "functionapp,workflowapp",
+                        "functionapp,workflowapp,linux",
+                        "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
+                        "app,linux",
+                        "app",
+                        "linux,api",
+                        "api",
+                        "app,linux,container",
+                        "app,container,windows"
+                      ],
+                      "metadata": {
+                        "description": "Required. Type of site to deploy."
                       }
                     },
-                    "applicationInsightResourceId": {
+                    "publicNetworkAccess": {
                       "type": "string",
-                      "nullable": true,
+                      "defaultValue": "Enabled",
                       "metadata": {
-                        "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                        "description": "Public network access setting."
                       }
                     },
-                    "currentAppSettings": {
+                    "identity": {
                       "type": "object",
-                      "properties": {},
-                      "additionalProperties": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The key-values pairs of the current app settings."
-                        }
+                      "defaultValue": {
+                        "type": "SystemAssigned"
                       },
-                      "defaultValue": {},
                       "metadata": {
-                        "description": "Optional. The current app settings."
+                        "description": "Optional. Managed identity configuration for the resource."
+                      }
+                    },
+                    "acrUseManagedIdentityCreds": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to use managed identity credentials for ACR authentication."
                       }
                     }
                   },
-                  "resources": {
-                    "applicationInsights": {
-                      "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.Insights/components",
-                      "apiVersion": "2020-02-02",
-                      "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
-                      "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
+                  "resources": [
+                    {
+                      "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+                      "apiVersion": "2025-05-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'ftp')]",
+                      "properties": {
+                        "allow": false
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                      ]
                     },
-                    "app": {
-                      "existing": true,
+                    {
+                      "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+                      "apiVersion": "2025-05-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'scm')]",
+                      "properties": {
+                        "allow": false
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                      ]
+                    },
+                    {
                       "type": "Microsoft.Web/sites",
-                      "apiVersion": "2023-12-01",
-                      "name": "[parameters('appName')]"
+                      "apiVersion": "2025-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "identity": "[parameters('identity')]",
+                      "properties": {
+                        "serverFarmId": "[parameters('serverFarmResourceId')]",
+                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                        "siteConfig": {
+                          "alwaysOn": "[parameters('alwaysOn')]",
+                          "ftpsState": "Disabled",
+                          "linuxFxVersion": "[parameters('linuxFxVersion')]",
+                          "minTlsVersion": "1.2",
+                          "healthCheckPath": "[if(not(empty(parameters('healthCheckPath'))), parameters('healthCheckPath'), null())]",
+                          "webSocketsEnabled": "[parameters('webSocketsEnabled')]",
+                          "appCommandLine": "[parameters('appCommandLine')]",
+                          "acrUseManagedIdentityCreds": "[parameters('acrUseManagedIdentityCreds')]"
+                        },
+                        "endToEndEncryptionEnabled": true
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2025-05-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'appsettings')]",
+                      "properties": "[parameters('appSettings')]",
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                      ]
                     },
-                    "config": {
+                    {
                       "type": "Microsoft.Web/sites/config",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
-                      "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(not(empty(parameters('applicationInsightResourceId'))), createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), createObject()))]",
+                      "apiVersion": "2025-05-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+                      "properties": {
+                        "applicationLogs": {
+                          "fileSystem": {
+                            "level": "Verbose"
+                          }
+                        },
+                        "detailedErrorMessages": {
+                          "enabled": true
+                        },
+                        "failedRequestsTracing": {
+                          "enabled": true
+                        },
+                        "httpLogs": {
+                          "fileSystem": {
+                            "enabled": true,
+                            "retentionInDays": 1,
+                            "retentionInMb": 35
+                          }
+                        }
+                      },
                       "dependsOn": [
-                        "applicationInsights"
+                        "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                        "[resourceId('Microsoft.Web/sites/config', parameters('name'), 'appsettings')]"
                       ]
                     }
-                  },
+                  ],
                   "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the site config."
-                      },
-                      "value": "[parameters('name')]"
-                    },
                     "resourceId": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource ID of the site config."
+                        "description": "Resource ID of the App Service."
                       },
-                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), parameters('name'))]"
+                      "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
                     },
-                    "resourceGroupName": {
+                    "name": {
                       "type": "string",
                       "metadata": {
-                        "description": "The resource group the site config was deployed into."
+                        "description": "Name of the App Service."
                       },
-                      "value": "[resourceGroup().name]"
-                    }
-                  }
-                }
-              },
-              "dependsOn": [
-                "app"
-              ]
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "The name of the site."
-              },
-              "value": "[parameters('name')]"
-            },
-            "resourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource ID of the site."
-              },
-              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "metadata": {
-                "description": "The resource group the site was deployed into."
-              },
-              "value": "[resourceGroup().name]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "The principal ID of the system assigned identity."
-              },
-              "value": "[tryGet(tryGet(reference('app', '2024-04-01', 'full'), 'identity'), 'principalId')]"
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "The location the resource was deployed into."
-              },
-              "value": "[reference('app', '2024-04-01', 'full').location]"
-            },
-            "defaultHostname": {
-              "type": "string",
-              "metadata": {
-                "description": "Default hostname of the app."
-              },
-              "value": "[reference('app').defaultHostName]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "[resourceId('Microsoft.Resources/deployments', 'ai-services')]",
-        "[resourceId('Microsoft.Resources/deployments', 'container-registry')]",
-        "[resourceId('Microsoft.Resources/deployments', 'cosmos')]",
-        "[resourceId('Microsoft.Resources/deployments', 'search')]",
-        "[resourceId('Microsoft.Resources/deployments', 'sql')]",
-        "[resourceId('Microsoft.Resources/deployments', 'storage')]",
-        "[resourceId('Microsoft.Resources/deployments', 'deploy_app_service_plan_serverfarm')]"
-      ]
-    },
-    {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[take(format('module.web-sites.{0}', variables('frontendWebSiteResourceName')), 64)]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('frontendWebSiteResourceName')]"
-          },
-          "tags": {
-            "value": "[union(parameters('tags'), createObject('azd-service-name', 'frontend'))]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "kind": {
-            "value": "app,linux"
-          },
-          "serverFarmResourceId": {
-            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'deploy_app_service_plan_serverfarm'), '2025-04-01').outputs.id.value]"
-          },
-          "managedIdentities": {
-            "value": {
-              "systemAssigned": true
-            }
-          },
-          "siteConfig": {
-            "value": {
-              "linuxFxVersion": "DOCKER|mcr.microsoft.com/azuredocs/containerapps-helloworld:latest",
-              "acrUseManagedIdentityCreds": true,
-              "appCommandLine": "",
-              "minTlsVersion": "1.2"
-            }
-          },
-          "configs": {
-            "value": [
-              {
-                "name": "appsettings",
-                "properties": {
-                  "DOCKER_REGISTRY_SERVER_URL": "[format('https://{0}', reference(resourceId('Microsoft.Resources/deployments', 'container-registry'), '2025-04-01').outputs.loginServer.value)]",
-                  "APP_API_BASE_URL": "[format('https://{0}', reference(resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('backendWebSiteResourceName')), 64)), '2025-04-01').outputs.defaultHostname.value)]",
-                  "WEBSITES_PORT": "80"
-                }
-              }
-            ]
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "6418154775494914049"
-            }
-          },
-          "definitions": {
-            "appSettingsConfigType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "allowedValues": [
-                    "appsettings"
-                  ],
-                  "metadata": {
-                    "description": "Required. The type of config."
-                  }
-                },
-                "applicationInsightResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the application insight to leverage for this resource."
-                  }
-                },
-                "retainCurrentAppSettings": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The retain the current app settings. Defaults to true."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {},
-                  "additionalProperties": {
-                    "type": "string",
-                    "metadata": {
-                      "description": "Required. An app settings key-value pair."
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The app settings key-value pairs."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_export!": true,
-                "description": "The type of an app settings configuration."
-              }
-            },
-            "_1.lockType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the name of lock."
-                  }
-                },
-                "kind": {
-                  "type": "string",
-                  "allowedValues": [
-                    "CanNotDelete",
-                    "None",
-                    "ReadOnly"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a lock.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointCustomDnsConfigType": {
-              "type": "object",
-              "properties": {
-                "fqdn": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                  }
-                },
-                "ipAddresses": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
-                  },
-                  "metadata": {
-                    "description": "Required. A list of private IP addresses of the private endpoint."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointIpConfigurationType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The name of the resource that is unique within a resource group."
-                  }
-                },
-                "properties": {
-                  "type": "object",
-                  "properties": {
-                    "groupId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
-                    },
-                    "memberName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                      }
+                      "value": "[parameters('name')]"
                     },
-                    "privateIPAddress": {
+                    "defaultHostname": {
                       "type": "string",
                       "metadata": {
-                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. Properties of private endpoint IP configurations."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.privateEndpointPrivateDnsZoneGroupType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private DNS Zone Group."
-                  }
-                },
-                "privateDnsZoneGroupConfigs": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "name": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. The name of the private DNS Zone Group config."
-                        }
-                      },
-                      "privateDnsZoneResourceId": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The resource id of the private DNS zone."
-                        }
-                      }
-                    }
-                  },
-                  "metadata": {
-                    "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                  }
-                }
-              },
-              "metadata": {
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "_1.roleAssignmentType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                  }
-                },
-                "roleDefinitionIdOrName": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                  }
-                },
-                "principalId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                  }
-                },
-                "principalType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "Device",
-                    "ForeignGroup",
-                    "Group",
-                    "ServicePrincipal",
-                    "User"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The principal type of the assigned principal ID."
-                  }
-                },
-                "description": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The description of the role assignment."
-                  }
-                },
-                "condition": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                  }
-                },
-                "conditionVersion": {
-                  "type": "string",
-                  "allowedValues": [
-                    "2.0"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Version of the condition."
-                  }
-                },
-                "delegatedManagedIdentityResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a role assignment.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "diagnosticSettingFullType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the diagnostic setting."
-                  }
-                },
-                "logCategoriesAndGroups": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                        }
+                        "description": "Default hostname of the App Service."
                       },
-                      "categoryGroup": {
-                        "type": "string",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                        }
+                      "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01').defaultHostName]"
+                    },
+                    "appUrl": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "URL of the App Service."
                       },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
-                    }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                  }
-                },
-                "metricCategories": {
-                  "type": "array",
-                  "items": {
-                    "type": "object",
-                    "properties": {
-                      "category": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                        }
+                      "value": "[format('https://{0}', reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01').defaultHostName)]"
+                    },
+                    "identityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID."
                       },
-                      "enabled": {
-                        "type": "bool",
-                        "nullable": true,
-                        "metadata": {
-                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                        }
-                      }
+                      "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01', 'full').identity.principalId]"
                     }
-                  },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                  }
-                },
-                "logAnalyticsDestinationType": {
-                  "type": "string",
-                  "allowedValues": [
-                    "AzureDiagnostics",
-                    "Dedicated"
-                  ],
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                  }
-                },
-                "workspaceResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "storageAccountResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "eventHubAuthorizationRuleResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                  }
-                },
-                "eventHubName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                  }
-                },
-                "marketplacePartnerResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
                   }
                 }
               },
-              "metadata": {
-                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
+              "dependsOn": [
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64))]",
+                "[resourceId('Microsoft.Resources/deployments', take(format('module.app-service-plan.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64))]"
+              ]
             },
-            "managedIdentityAllType": {
-              "type": "object",
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
               "properties": {
-                "systemAssigned": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Enables system assigned managed identity on the resource."
-                  }
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
                 },
-                "userAssignedResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
+                "mode": "Incremental",
+                "parameters": {
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
                   },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            },
-            "privateEndpointSingleServiceType": {
-              "type": "object",
-              "properties": {
-                "name": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the Private Endpoint."
-                  }
-                },
-                "location": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The location to deploy the Private Endpoint to."
-                  }
-                },
-                "privateLinkServiceConnectionName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The name of the private link connection to create."
-                  }
-                },
-                "service": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                  }
-                },
-                "subnetResourceId": {
-                  "type": "string",
-                  "metadata": {
-                    "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                  }
-                },
-                "resourceGroupResourceId": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                  }
-                },
-                "privateDnsZoneGroup": {
-                  "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                  }
-                },
-                "isManualConnection": {
-                  "type": "bool",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. If Manual Private Link Connection is required."
-                  }
-                },
-                "manualConnectionRequestMessage": {
-                  "type": "string",
-                  "nullable": true,
-                  "maxLength": 140,
-                  "metadata": {
-                    "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                  }
-                },
-                "customDnsConfigs": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                  "name": {
+                    "value": "[format('app-{0}', variables('solutionSuffix'))]"
                   },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Custom DNS configurations."
-                  }
-                },
-                "ipConfigurations": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                  "location": {
+                    "value": "[parameters('location')]"
                   },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                  }
-                },
-                "applicationSecurityGroupResourceIds": {
-                  "type": "array",
-                  "items": {
-                    "type": "string"
+                  "tags": {
+                    "value": "[union(parameters('tags'), createObject('azd-service-name', 'webapp'))]"
                   },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                  }
-                },
-                "customNetworkInterfaceName": {
-                  "type": "string",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                  }
-                },
-                "lock": {
-                  "$ref": "#/definitions/_1.lockType",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Specify the type of lock."
-                  }
-                },
-                "roleAssignments": {
-                  "type": "array",
-                  "items": {
-                    "$ref": "#/definitions/_1.roleAssignmentType"
+                  "serverFarmResourceId": {
+                    "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.app-service-plan.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
                   },
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Array of role assignments to create."
-                  }
-                },
-                "tags": {
-                  "type": "object",
-                  "nullable": true,
-                  "metadata": {
-                    "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                  "kind": {
+                    "value": "[parameters('kind')]"
+                  },
+                  "linuxFxVersion": {
+                    "value": "[variables('placeholderImageName')]"
+                  },
+                  "acrUseManagedIdentityCreds": {
+                    "value": true
+                  },
+                  "appSettings": {
+                    "value": {
+                      "DOCKER_REGISTRY_SERVER_URL": "[format('https://{0}', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.loginServer.value)]",
+                      "APP_API_BASE_URL": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]",
+                      "WEBSITES_PORT": "80"
+                    }
                   }
                 },
-                "enableTelemetry": {
-                  "type": "bool",
-                  "nullable": true,
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "contentVersion": "1.0.0.0",
                   "metadata": {
-                    "description": "Optional. Enable/Disable usage telemetry for module."
-                  }
-                }
-              },
-              "metadata": {
-                "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                "__bicep_imported_from!": {
-                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                }
-              }
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. Name of the site."
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional. Location for all Resources."
-              }
-            },
-            "kind": {
-              "type": "string",
-              "allowedValues": [
-                "functionapp",
-                "functionapp,linux",
-                "app,linux",
-                "app",
-                "app,linux,container",
-                "app,container,windows"
-              ],
-              "metadata": {
-                "description": "Required. Type of site to deploy."
-              }
-            },
-            "serverFarmResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Required. The resource ID of the app service plan to use for the site."
-              }
-            },
-            "httpsOnly": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. Configures a site to accept only HTTPS requests."
-              }
-            },
-            "clientAffinityEnabled": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Optional. If client affinity is enabled."
-              }
-            },
-            "managedIdentities": {
-              "$ref": "#/definitions/managedIdentityAllType",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The managed identity definition for this resource."
-              }
-            },
-            "siteConfig": {
-              "type": "object",
-              "metadata": {
-                "__bicep_resource_derived_type!": {
-                  "source": "Microsoft.Web/sites@2024-04-01#properties/properties/properties/siteConfig"
-                },
-                "description": "Optional. The site config object."
-              },
-              "defaultValue": {
-                "alwaysOn": true,
-                "minTlsVersion": "1.2",
-                "ftpsState": "FtpsOnly"
-              }
-            },
-            "configs": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/appSettingsConfigType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The web site config."
-              }
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/privateEndpointSingleServiceType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Configuration details for private endpoints."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Tags of the resource."
-              }
-            },
-            "diagnosticSettings": {
-              "type": "array",
-              "items": {
-                "$ref": "#/definitions/diagnosticSettingFullType"
-              },
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. The diagnostic settings of the service."
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "nullable": true,
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional. Whether or not public network access is allowed."
-              }
-            },
-            "vnetRouteAllEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. Virtual Network Route All enabled."
-              }
-            },
-            "vnetImagePullEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional. To enable pulling image over Virtual Network."
-              }
-            },
-            "virtualNetworkSubnetId": {
-              "type": "string",
-              "nullable": true,
-              "metadata": {
-                "description": "Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined."
-              }
-            }
-          },
-          "variables": {
-            "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]"
-          },
-          "resources": {
-            "app": {
-              "type": "Microsoft.Web/sites",
-              "apiVersion": "2024-04-01",
-              "name": "[parameters('name')]",
-              "location": "[parameters('location')]",
-              "kind": "[parameters('kind')]",
-              "tags": "[parameters('tags')]",
-              "identity": "[variables('identity')]",
-              "properties": {
-                "serverFarmId": "[parameters('serverFarmResourceId')]",
-                "clientAffinityEnabled": "[parameters('clientAffinityEnabled')]",
-                "httpsOnly": "[parameters('httpsOnly')]",
-                "virtualNetworkSubnetId": "[parameters('virtualNetworkSubnetId')]",
-                "siteConfig": "[parameters('siteConfig')]",
-                "vnetImagePullEnabled": "[parameters('vnetImagePullEnabled')]",
-                "vnetRouteAllEnabled": "[parameters('vnetRouteAllEnabled')]",
-                "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled'))]"
-              }
-            },
-            "app_diagnosticSettings": {
-              "copy": {
-                "name": "app_diagnosticSettings",
-                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-              },
-              "type": "Microsoft.Insights/diagnosticSettings",
-              "apiVersion": "2021-05-01-preview",
-              "scope": "[resourceId('Microsoft.Web/sites', parameters('name'))]",
-              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-              "properties": {
-                "copy": [
-                  {
-                    "name": "metrics",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                    "input": {
-                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                      "timeGrain": null
-                    }
-                  },
-                  {
-                    "name": "logs",
-                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                    "input": {
-                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.46.1.21595",
+                      "templateHash": "15416323965013625336"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Solution name suffix used to derive the resource name."
+                      }
+                    },
+                    "name": {
+                      "type": "string",
+                      "defaultValue": "[parameters('solutionName')]",
+                      "metadata": {
+                        "description": "Name of the App Service."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Azure region for the resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Tags to apply to the resource."
+                      }
+                    },
+                    "serverFarmResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the App Service Plan."
+                      }
+                    },
+                    "linuxFxVersion": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Docker image name (e.g., DOCKER|registry.azurecr.io/image:tag)."
+                      }
+                    },
+                    "appSettings": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Application settings key-value pairs."
+                      }
+                    },
+                    "alwaysOn": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Whether to enable Always On."
+                      }
+                    },
+                    "healthCheckPath": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Health check path for the app."
+                      }
+                    },
+                    "webSocketsEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to enable WebSockets."
+                      }
+                    },
+                    "appCommandLine": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Command line for the application."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "app,linux",
+                      "allowedValues": [
+                        "functionapp",
+                        "functionapp,linux",
+                        "functionapp,workflowapp",
+                        "functionapp,workflowapp,linux",
+                        "functionapp,linux,container",
+                        "functionapp,linux,container,azurecontainerapps",
+                        "app,linux",
+                        "app",
+                        "linux,api",
+                        "api",
+                        "app,linux,container",
+                        "app,container,windows"
+                      ],
+                      "metadata": {
+                        "description": "Required. Type of site to deploy."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "metadata": {
+                        "description": "Public network access setting."
+                      }
+                    },
+                    "identity": {
+                      "type": "object",
+                      "defaultValue": {
+                        "type": "SystemAssigned"
+                      },
+                      "metadata": {
+                        "description": "Optional. Managed identity configuration for the resource."
+                      }
+                    },
+                    "acrUseManagedIdentityCreds": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to use managed identity credentials for ACR authentication."
+                      }
+                    }
+                  },
+                  "resources": [
+                    {
+                      "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+                      "apiVersion": "2025-05-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'ftp')]",
+                      "properties": {
+                        "allow": false
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                      ]
+                    },
+                    {
+                      "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
+                      "apiVersion": "2025-05-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'scm')]",
+                      "properties": {
+                        "allow": false
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                      ]
+                    },
+                    {
+                      "type": "Microsoft.Web/sites",
+                      "apiVersion": "2025-05-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "identity": "[parameters('identity')]",
+                      "properties": {
+                        "serverFarmId": "[parameters('serverFarmResourceId')]",
+                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                        "siteConfig": {
+                          "alwaysOn": "[parameters('alwaysOn')]",
+                          "ftpsState": "Disabled",
+                          "linuxFxVersion": "[parameters('linuxFxVersion')]",
+                          "minTlsVersion": "1.2",
+                          "healthCheckPath": "[if(not(empty(parameters('healthCheckPath'))), parameters('healthCheckPath'), null())]",
+                          "webSocketsEnabled": "[parameters('webSocketsEnabled')]",
+                          "appCommandLine": "[parameters('appCommandLine')]",
+                          "acrUseManagedIdentityCreds": "[parameters('acrUseManagedIdentityCreds')]"
+                        },
+                        "endToEndEncryptionEnabled": true
+                      }
+                    },
+                    {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2025-05-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'appsettings')]",
+                      "properties": "[parameters('appSettings')]",
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                      ]
+                    },
+                    {
+                      "type": "Microsoft.Web/sites/config",
+                      "apiVersion": "2025-05-01",
+                      "name": "[format('{0}/{1}', parameters('name'), 'logs')]",
+                      "properties": {
+                        "applicationLogs": {
+                          "fileSystem": {
+                            "level": "Verbose"
+                          }
+                        },
+                        "detailedErrorMessages": {
+                          "enabled": true
+                        },
+                        "failedRequestsTracing": {
+                          "enabled": true
+                        },
+                        "httpLogs": {
+                          "fileSystem": {
+                            "enabled": true,
+                            "retentionInDays": 1,
+                            "retentionInMb": 35
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "[resourceId('Microsoft.Web/sites', parameters('name'))]",
+                        "[resourceId('Microsoft.Web/sites/config', parameters('name'), 'appsettings')]"
+                      ]
+                    }
+                  ],
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Resource ID of the App Service."
+                      },
+                      "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the App Service."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "defaultHostname": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Default hostname of the App Service."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01').defaultHostName]"
+                    },
+                    "appUrl": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "URL of the App Service."
+                      },
+                      "value": "[format('https://{0}', reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01').defaultHostName)]"
+                    },
+                    "identityPrincipalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "System-assigned identity principal ID."
+                      },
+                      "value": "[reference(resourceId('Microsoft.Web/sites', parameters('name')), '2025-05-01', 'full').identity.principalId]"
                     }
                   }
-                ],
-                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                }
               },
               "dependsOn": [
-                "app"
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64))]",
+                "[resourceId('Microsoft.Resources/deployments', take(format('module.app-service-plan.{0}', parameters('solutionName')), 64))]"
               ]
             },
-            "app_config": {
-              "copy": {
-                "name": "app_config",
-                "count": "[length(coalesce(parameters('configs'), createArray()))]"
-              },
+            {
               "type": "Microsoft.Resources/deployments",
               "apiVersion": "2025-04-01",
-              "name": "[format('{0}-Site-Config-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+              "name": "[take(format('module.role-assignments.{0}', parameters('solutionName')), 64)]",
+              "resourceGroup": "[resourceGroup().name]",
               "properties": {
                 "expressionEvaluationOptions": {
                   "scope": "inner"
                 },
                 "mode": "Incremental",
                 "parameters": {
-                  "appName": {
-                    "value": "[parameters('name')]"
+                  "solutionName": {
+                    "value": "[variables('solutionSuffix')]"
                   },
-                  "name": {
-                    "value": "[coalesce(parameters('configs'), createArray())[copyIndex()].name]"
+                  "useExistingAIProject": {
+                    "value": "[variables('useExistingAIProject')]"
+                  },
+                  "existingFoundryProjectResourceId": {
+                    "value": "[parameters('existingFoundryProjectResourceId')]"
+                  },
+                  "aiFoundryResourceId": "[if(not(variables('useExistingAIProject')), if(variables('useExistingAIProject'), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value)), createObject('value', ''))]",
+                  "aiSearchResourceId": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+                  },
+                  "storageAccountResourceId": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+                  },
+                  "aiProjectPrincipalId": "[if(variables('useExistingAIProject'), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectIdentityPrincipalId.value), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectIdentityPrincipalId.value))]",
+                  "aiSearchPrincipalId": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]"
                   },
-                  "applicationInsightResourceId": {
-                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'applicationInsightResourceId')]"
+                  "deployerPrincipalId": {
+                    "value": "[variables('deployingUserPrincipalId')]"
                   },
-                  "properties": {
-                    "value": "[tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'properties')]"
+                  "deployerPrincipalType": {
+                    "value": "[parameters('deployingUserPrincipalType')]"
                   },
-                  "currentAppSettings": "[if(coalesce(tryGet(coalesce(parameters('configs'), createArray())[copyIndex()], 'retainCurrentAppSettings'), and(true(), equals(coalesce(parameters('configs'), createArray())[copyIndex()].name, 'appsettings'))), createObject('value', list(format('{0}/config/appsettings', resourceId('Microsoft.Web/sites', parameters('name'))), '2023-12-01').properties), createObject('value', createObject()))]"
+                  "backendAppServicePrincipalId": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]"
+                  },
+                  "cosmosDbAccountName": "[if(parameters('deployCosmos'), createObject('value', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value), createObject('value', ''))]",
+                  "containerRegistryResourceId": {
+                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.resourceId.value]"
+                  },
+                  "acrPullPrincipals": {
+                    "value": [
+                      {
+                        "principalId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]",
+                        "principalType": "ServicePrincipal"
+                      },
+                      {
+                        "principalId": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    ]
+                  }
                 },
                 "template": {
                   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
                   "contentVersion": "1.0.0.0",
                   "metadata": {
                     "_generator": {
                       "name": "bicep",
-                      "version": "0.44.1.10279",
-                      "templateHash": "10270735850099556125"
+                      "version": "0.46.1.21595",
+                      "templateHash": "16253024886724298901"
+                    }
+                  },
+                  "parameters": {
+                    "solutionName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Solution name suffix for generating unique role assignment GUIDs."
+                      }
+                    },
+                    "useExistingAIProject": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Whether to use an existing AI project (true) or create new (false)."
+                      }
+                    },
+                    "existingFoundryProjectResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the existing AI project (for deriving AI Services name/sub/RG)."
+                      }
+                    },
+                    "aiProjectPrincipalId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Principal ID of the AI project identity (works for both new and existing projects)."
+                      }
+                    },
+                    "aiSearchPrincipalId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Principal ID of the AI Search identity."
+                      }
+                    },
+                    "backendAppServicePrincipalId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Principal ID of the backend App Service system-assigned identity (empty if not deployed)."
+                      }
+                    },
+                    "deployerPrincipalId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Principal ID of the deploying user (for user access roles)."
+                      }
+                    },
+                    "deployerPrincipalType": {
+                      "type": "string",
+                      "defaultValue": "User",
+                      "allowedValues": [
+                        "User",
+                        "ServicePrincipal"
+                      ],
+                      "metadata": {
+                        "description": "Principal type of the deploying user."
+                      }
+                    },
+                    "aiFoundryResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the AI Foundry account (empty if not deployed — new project path)."
+                      }
+                    },
+                    "aiSearchResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the AI Search service (empty if not deployed)."
+                      }
+                    },
+                    "storageAccountResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the Storage Account (empty if not deployed)."
+                      }
+                    },
+                    "cosmosDbAccountName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Name of the Cosmos DB account (empty if not deployed)."
+                      }
+                    },
+                    "useExistingContainerRegistry": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Whether to use an existing container registry (true) or the one created in this deployment (false)."
+                      }
+                    },
+                    "containerRegistryResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Resource ID of the container registry to grant AcrPull on (for deriving name/sub/RG; empty = skip ACR role assignments)."
+                      }
+                    },
+                    "acrPullPrincipals": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Principals to grant AcrPull on the container registry (array of objects with principalId and principalType)."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "existingAIFoundryName": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[8], '')]",
+                    "existingAIFoundrySubscription": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[2], subscription().subscriptionId)]",
+                    "existingAIFoundryResourceGroup": "[if(parameters('useExistingAIProject'), split(parameters('existingFoundryProjectResourceId'), '/')[4], resourceGroup().name)]",
+                    "containerRegistryName": "[if(empty(parameters('containerRegistryResourceId')), '', split(parameters('containerRegistryResourceId'), '/')[8])]",
+                    "containerRegistrySubscription": "[if(empty(parameters('containerRegistryResourceId')), subscription().subscriptionId, split(parameters('containerRegistryResourceId'), '/')[2])]",
+                    "containerRegistryResourceGroup": "[if(empty(parameters('containerRegistryResourceId')), resourceGroup().name, split(parameters('containerRegistryResourceId'), '/')[4])]",
+                    "roleDefinitions": {
+                      "azureAiUser": "53ca6127-db72-4b80-b1b0-d745d6d5456d",
+                      "cognitiveServicesUser": "a97b65f3-24c7-4388-baec-2e87135dc908",
+                      "cognitiveServicesOpenAIUser": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd",
+                      "azureAIDeveloper": "64702f94-c441-49e6-a78b-ef80e0188fee",
+                      "searchIndexDataReader": "1407120a-92aa-4202-b7e9-c0e197c71c8f",
+                      "searchIndexDataContributor": "8ebe5a00-799e-43f5-93ac-243d3dce84a7",
+                      "searchServiceContributor": "7ca78c08-252a-4471-8644-bb5ff32d4ba0",
+                      "storageBlobDataContributor": "ba92f5b4-2d11-453d-a403-e96b0029c9fe",
+                      "storageBlobDataReader": "2a2b9908-6ea1-4ae2-8e65-a410df84e7d1",
+                      "storageQueueDataContributor": "974c5e8b-45b9-4653-ba55-5f855dd0fb88",
+                      "acrPull": "7f951dda-4ed3-4680-a7ca-43fe172d538d"
+                    }
+                  },
+                  "resources": [
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiSearchPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('aiSearchPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                      "properties": {
+                        "principalId": "[parameters('aiSearchPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiFoundryResourceId')))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').azureAiUser)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('aiFoundryResourceId')))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').searchIndexDataReader)]",
+                      "properties": {
+                        "principalId": "[parameters('aiProjectPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataReader)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('aiProjectPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').searchIndexDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('aiSearchResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('aiProjectPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiProjectPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiProjectPrincipalId'), variables('roleDefinitions').storageBlobDataReader)]",
+                      "properties": {
+                        "principalId": "[parameters('aiProjectPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataReader)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('aiSearchPrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('aiSearchPrincipalId'), variables('roleDefinitions').storageBlobDataReader)]",
+                      "properties": {
+                        "principalId": "[parameters('aiSearchPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataReader)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('storageAccountResourceId'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
+                        "principalType": "ServicePrincipal"
+                      }
+                    },
+                    {
+                      "condition": "[and(not(empty(parameters('cosmosDbAccountName'))), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                      "apiVersion": "2025-10-15",
+                      "name": "[format('{0}/{1}', parameters('cosmosDbAccountName'), guid(parameters('solutionName'), resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbAccountName'), '00000000-0000-0000-0000-000000000002'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbAccountName')), parameters('backendAppServicePrincipalId')))]",
+                      "properties": {
+                        "principalId": "[parameters('backendAppServicePrincipalId')]",
+                        "roleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbAccountName'), '00000000-0000-0000-0000-000000000002')]",
+                        "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbAccountName'))]"
+                      }
+                    },
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('deployerPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').cognitiveServicesUser)]",
+                      "properties": {
+                        "principalId": "[parameters('deployerPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesUser)]",
+                        "principalType": "[parameters('deployerPrincipalType')]"
+                      }
                     },
-                    "name": "Site App Settings",
-                    "description": "This module deploys a Site App Setting."
-                  },
-                  "parameters": {
-                    "appName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Conditional. The name of the parent site resource."
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('deployerPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').azureAiUser)]",
+                      "properties": {
+                        "principalId": "[parameters('deployerPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]",
+                        "principalType": "[parameters('deployerPrincipalType')]"
                       }
                     },
-                    "name": {
-                      "type": "string",
-                      "allowedValues": [
-                        "appsettings",
-                        "authsettings",
-                        "authsettingsV2",
-                        "azurestorageaccounts",
-                        "backup",
-                        "connectionstrings",
-                        "logs",
-                        "metadata",
-                        "pushsettings",
-                        "slotConfigNames",
-                        "web"
-                      ],
-                      "metadata": {
-                        "description": "Required. The name of the config."
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('deployerPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').azureAIDeveloper)]",
+                      "properties": {
+                        "principalId": "[parameters('deployerPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAIDeveloper)]",
+                        "principalType": "[parameters('deployerPrincipalType')]"
                       }
                     },
-                    "properties": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. The properties of the config."
+                    {
+                      "condition": "[and(and(not(parameters('useExistingAIProject')), not(empty(parameters('deployerPrincipalId')))), not(empty(parameters('aiFoundryResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('aiFoundryResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                      "properties": {
+                        "principalId": "[parameters('deployerPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]",
+                        "principalType": "[parameters('deployerPrincipalType')]"
                       }
                     },
-                    "applicationInsightResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Resource ID of the application insight to leverage for this resource."
+                    {
+                      "condition": "[and(not(empty(parameters('deployerPrincipalId'))), not(empty(parameters('aiSearchResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').searchIndexDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('deployerPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchIndexDataContributor)]",
+                        "principalType": "[parameters('deployerPrincipalType')]"
                       }
                     },
-                    "currentAppSettings": {
-                      "type": "object",
-                      "properties": {},
-                      "additionalProperties": {
-                        "type": "string",
-                        "metadata": {
-                          "description": "Required. The key-values pairs of the current app settings."
-                        }
-                      },
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. The current app settings."
+                    {
+                      "condition": "[and(not(empty(parameters('deployerPrincipalId'))), not(empty(parameters('aiSearchResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Search/searchServices', last(split(parameters('aiSearchResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').searchServiceContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('deployerPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').searchServiceContributor)]",
+                        "principalType": "[parameters('deployerPrincipalType')]"
                       }
-                    }
-                  },
-                  "resources": {
-                    "applicationInsights": {
-                      "condition": "[not(empty(parameters('applicationInsightResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.Insights/components",
-                      "apiVersion": "2020-02-02",
-                      "subscriptionId": "[split(parameters('applicationInsightResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(parameters('applicationInsightResourceId'), '/')[4]]",
-                      "name": "[last(split(parameters('applicationInsightResourceId'), '/'))]"
                     },
-                    "app": {
-                      "existing": true,
-                      "type": "Microsoft.Web/sites",
-                      "apiVersion": "2023-12-01",
-                      "name": "[parameters('appName')]"
+                    {
+                      "condition": "[and(not(empty(parameters('deployerPrincipalId'))), not(empty(parameters('storageAccountResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').storageBlobDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('deployerPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageBlobDataContributor)]",
+                        "principalType": "[parameters('deployerPrincipalType')]"
+                      }
                     },
-                    "config": {
-                      "type": "Microsoft.Web/sites/config",
-                      "apiVersion": "2024-04-01",
-                      "name": "[format('{0}/{1}', parameters('appName'), parameters('name'))]",
-                      "properties": "[union(parameters('currentAppSettings'), parameters('properties'), if(not(empty(parameters('applicationInsightResourceId'))), createObject('APPLICATIONINSIGHTS_CONNECTION_STRING', reference('applicationInsights').ConnectionString), createObject()))]",
-                      "dependsOn": [
-                        "applicationInsights"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the site config."
-                      },
-                      "value": "[parameters('name')]"
+                    {
+                      "condition": "[and(not(empty(parameters('deployerPrincipalId'))), not(empty(parameters('storageAccountResourceId'))))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/')))]",
+                      "name": "[guid(parameters('solutionName'), resourceId('Microsoft.Storage/storageAccounts', last(split(parameters('storageAccountResourceId'), '/'))), parameters('deployerPrincipalId'), variables('roleDefinitions').storageQueueDataContributor)]",
+                      "properties": {
+                        "principalId": "[parameters('deployerPrincipalId')]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').storageQueueDataContributor)]",
+                        "principalType": "[parameters('deployerPrincipalType')]"
+                      }
                     },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the site config."
+                    {
+                      "copy": {
+                        "name": "acrPullAssignments",
+                        "count": "[length(parameters('acrPullPrincipals'))]"
                       },
-                      "value": "[resourceId('Microsoft.Web/sites/config', parameters('appName'), parameters('name'))]"
+                      "condition": "[and(not(parameters('useExistingContainerRegistry')), not(empty(parameters('acrPullPrincipals')[copyIndex()].principalId)))]",
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[resourceId('Microsoft.ContainerRegistry/registries', variables('containerRegistryName'))]",
+                      "name": "[guid(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId, variables('roleDefinitions').acrPull)]",
+                      "properties": {
+                        "principalId": "[parameters('acrPullPrincipals')[copyIndex()].principalId]",
+                        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').acrPull)]",
+                        "principalType": "[parameters('acrPullPrincipals')[copyIndex()].principalType]"
+                      }
+                    },
+                    {
+                      "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('aiSearchPrincipalId'))))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "assignOpenAIRoleToAISearchExisting",
+                      "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+                      "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "principalId": {
+                            "value": "[parameters('aiSearchPrincipalId')]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                          },
+                          "roleAssignmentName": {
+                            "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('aiSearchPrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                          },
+                          "aiFoundryName": {
+                            "value": "[variables('existingAIFoundryName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.46.1.21595",
+                              "templateHash": "1001648557732946394"
+                            }
+                          },
+                          "parameters": {
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID to assign the role to."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the role definition to assign."
+                              }
+                            },
+                            "roleAssignmentName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "A unique name for the role assignment."
+                              }
+                            },
+                            "principalType": {
+                              "type": "string",
+                              "defaultValue": "ServicePrincipal",
+                              "allowedValues": [
+                                "ServicePrincipal",
+                                "User",
+                                "Group"
+                              ],
+                              "metadata": {
+                                "description": "The principal type of the identity being assigned."
+                              }
+                            },
+                            "targetResourceType": {
+                              "type": "string",
+                              "defaultValue": "AIServices",
+                              "allowedValues": [
+                                "AIServices",
+                                "ContainerRegistry"
+                              ],
+                              "metadata": {
+                                "description": "The type of target resource to scope the role assignment to."
+                              }
+                            },
+                            "aiFoundryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target AI Services (Cognitive Services) account. Required when targetResourceType is AIServices."
+                              }
+                            },
+                            "containerRegistryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            },
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            }
+                          ]
+                        }
+                      }
+                    },
+                    {
+                      "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "assignAiUserRoleToBackendExisting",
+                      "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+                      "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "principalId": {
+                            "value": "[parameters('backendAppServicePrincipalId')]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').azureAiUser)]"
+                          },
+                          "roleAssignmentName": {
+                            "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').azureAiUser)]"
+                          },
+                          "aiFoundryName": {
+                            "value": "[variables('existingAIFoundryName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.46.1.21595",
+                              "templateHash": "1001648557732946394"
+                            }
+                          },
+                          "parameters": {
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID to assign the role to."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the role definition to assign."
+                              }
+                            },
+                            "roleAssignmentName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "A unique name for the role assignment."
+                              }
+                            },
+                            "principalType": {
+                              "type": "string",
+                              "defaultValue": "ServicePrincipal",
+                              "allowedValues": [
+                                "ServicePrincipal",
+                                "User",
+                                "Group"
+                              ],
+                              "metadata": {
+                                "description": "The principal type of the identity being assigned."
+                              }
+                            },
+                            "targetResourceType": {
+                              "type": "string",
+                              "defaultValue": "AIServices",
+                              "allowedValues": [
+                                "AIServices",
+                                "ContainerRegistry"
+                              ],
+                              "metadata": {
+                                "description": "The type of target resource to scope the role assignment to."
+                              }
+                            },
+                            "aiFoundryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target AI Services (Cognitive Services) account. Required when targetResourceType is AIServices."
+                              }
+                            },
+                            "containerRegistryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            },
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            }
+                          ]
+                        }
+                      }
+                    },
+                    {
+                      "condition": "[and(parameters('useExistingAIProject'), not(empty(parameters('backendAppServicePrincipalId'))))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "assignOpenAIUserRoleToBackendExisting",
+                      "subscriptionId": "[variables('existingAIFoundrySubscription')]",
+                      "resourceGroup": "[variables('existingAIFoundryResourceGroup')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "principalId": {
+                            "value": "[parameters('backendAppServicePrincipalId')]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                          },
+                          "roleAssignmentName": {
+                            "value": "[guid(parameters('solutionName'), variables('existingAIFoundryName'), parameters('backendAppServicePrincipalId'), variables('roleDefinitions').cognitiveServicesOpenAIUser)]"
+                          },
+                          "aiFoundryName": {
+                            "value": "[variables('existingAIFoundryName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.46.1.21595",
+                              "templateHash": "1001648557732946394"
+                            }
+                          },
+                          "parameters": {
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID to assign the role to."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the role definition to assign."
+                              }
+                            },
+                            "roleAssignmentName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "A unique name for the role assignment."
+                              }
+                            },
+                            "principalType": {
+                              "type": "string",
+                              "defaultValue": "ServicePrincipal",
+                              "allowedValues": [
+                                "ServicePrincipal",
+                                "User",
+                                "Group"
+                              ],
+                              "metadata": {
+                                "description": "The principal type of the identity being assigned."
+                              }
+                            },
+                            "targetResourceType": {
+                              "type": "string",
+                              "defaultValue": "AIServices",
+                              "allowedValues": [
+                                "AIServices",
+                                "ContainerRegistry"
+                              ],
+                              "metadata": {
+                                "description": "The type of target resource to scope the role assignment to."
+                              }
+                            },
+                            "aiFoundryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target AI Services (Cognitive Services) account. Required when targetResourceType is AIServices."
+                              }
+                            },
+                            "containerRegistryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            },
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            }
+                          ]
+                        }
+                      }
                     },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the site config was deployed into."
+                    {
+                      "copy": {
+                        "name": "acrPullAssignmentsExisting",
+                        "count": "[length(parameters('acrPullPrincipals'))]"
                       },
-                      "value": "[resourceGroup().name]"
+                      "condition": "[and(parameters('useExistingContainerRegistry'), not(empty(parameters('acrPullPrincipals')[copyIndex()].principalId)))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('acrPull-{0}', uniqueString(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId)), 64)]",
+                      "subscriptionId": "[variables('containerRegistrySubscription')]",
+                      "resourceGroup": "[variables('containerRegistryResourceGroup')]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "targetResourceType": {
+                            "value": "ContainerRegistry"
+                          },
+                          "containerRegistryName": {
+                            "value": "[variables('containerRegistryName')]"
+                          },
+                          "principalId": {
+                            "value": "[parameters('acrPullPrincipals')[copyIndex()].principalId]"
+                          },
+                          "principalType": {
+                            "value": "[parameters('acrPullPrincipals')[copyIndex()].principalType]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitions').acrPull)]"
+                          },
+                          "roleAssignmentName": {
+                            "value": "[guid(parameters('solutionName'), variables('containerRegistryName'), parameters('acrPullPrincipals')[copyIndex()].principalId, variables('roleDefinitions').acrPull)]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.46.1.21595",
+                              "templateHash": "1001648557732946394"
+                            }
+                          },
+                          "parameters": {
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The principal ID to assign the role to."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the role definition to assign."
+                              }
+                            },
+                            "roleAssignmentName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "A unique name for the role assignment."
+                              }
+                            },
+                            "principalType": {
+                              "type": "string",
+                              "defaultValue": "ServicePrincipal",
+                              "allowedValues": [
+                                "ServicePrincipal",
+                                "User",
+                                "Group"
+                              ],
+                              "metadata": {
+                                "description": "The principal type of the identity being assigned."
+                              }
+                            },
+                            "targetResourceType": {
+                              "type": "string",
+                              "defaultValue": "AIServices",
+                              "allowedValues": [
+                                "AIServices",
+                                "ContainerRegistry"
+                              ],
+                              "metadata": {
+                                "description": "The type of target resource to scope the role assignment to."
+                              }
+                            },
+                            "aiFoundryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target AI Services (Cognitive Services) account. Required when targetResourceType is AIServices."
+                              }
+                            },
+                            "containerRegistryName": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'AIServices')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('aiFoundryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            },
+                            {
+                              "condition": "[equals(parameters('targetResourceType'), 'ContainerRegistry')]",
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('containerRegistryName'))]",
+                              "name": "[parameters('roleAssignmentName')]",
+                              "properties": {
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "principalId": "[parameters('principalId')]",
+                                "principalType": "[parameters('principalType')]"
+                              }
+                            }
+                          ]
+                        }
+                      }
                     }
-                  }
+                  ]
                 }
               },
               "dependsOn": [
-                "app"
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64))]",
+                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64))]"
               ]
             }
-          },
+          ],
           "outputs": {
-            "name": {
+            "AZURE_OPENAI_ENDPOINT": {
               "type": "string",
               "metadata": {
-                "description": "The name of the site."
+                "description": "Azure OpenAI endpoint URL."
               },
-              "value": "[parameters('name')]"
+              "value": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value)]"
             },
-            "resourceId": {
+            "AZURE_SEARCH_ENDPOINT": {
               "type": "string",
               "metadata": {
-                "description": "The resource ID of the site."
+                "description": "Azure AI Search endpoint URL."
               },
-              "value": "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-search.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value]"
             },
-            "resourceGroupName": {
+            "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": {
               "type": "string",
               "metadata": {
-                "description": "The resource group the site was deployed into."
+                "description": "Azure Content Understanding endpoint URL."
               },
-              "value": "[resourceGroup().name]"
+              "value": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.azureOpenAiCuEndpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.azureOpenAiCuEndpoint.value)]"
             },
-            "systemAssignedMIPrincipalId": {
+            "AZURE_STORAGE_ACCOUNT": {
               "type": "string",
-              "nullable": true,
               "metadata": {
-                "description": "The principal ID of the system assigned identity."
+                "description": "Azure Storage account name."
               },
-              "value": "[tryGet(tryGet(reference('app', '2024-04-01', 'full'), 'identity'), 'principalId')]"
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.storage-account.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]"
             },
-            "location": {
+            "AZURE_SQL_SERVER": {
               "type": "string",
               "metadata": {
-                "description": "The location the resource was deployed into."
+                "description": "Azure SQL Server FQDN."
               },
-              "value": "[reference('app', '2024-04-01', 'full').location]"
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.serverFqdn.value]"
             },
-            "defaultHostname": {
+            "AZURE_SQL_DATABASE": {
               "type": "string",
               "metadata": {
-                "description": "Default hostname of the app."
+                "description": "Azure SQL Database name."
               },
-              "value": "[reference('app').defaultHostName]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "[resourceId('Microsoft.Resources/deployments', 'container-registry')]",
-        "[resourceId('Microsoft.Resources/deployments', 'deploy_app_service_plan_serverfarm')]",
-        "[resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('backendWebSiteResourceName')), 64))]"
-      ]
-    },
-    {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "roles",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "openaiName": "[if(parameters('useExistingAiProject'), createObject('value', parameters('existingAiFoundryServiceName')), createObject('value', reference(resourceId('Microsoft.Resources/deployments', 'ai-services'), '2025-04-01').outputs.name.value))]",
-          "searchName": {
-            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'search'), '2025-04-01').outputs.name.value]"
-          },
-          "storageName": {
-            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'storage'), '2025-04-01').outputs.accountName.value]"
-          },
-          "cosmosName": "[if(parameters('deployCosmos'), createObject('value', reference(resourceId('Microsoft.Resources/deployments', 'cosmos'), '2025-04-01').outputs.name.value), createObject('value', ''))]",
-          "backendPrincipalId": {
-            "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('backendWebSiteResourceName')), 64)), '2025-04-01').outputs.systemAssignedMIPrincipalId.value]"
-          },
-          "frontendPrincipalId": {
-            "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('frontendWebSiteResourceName')), 64)), '2025-04-01').outputs.systemAssignedMIPrincipalId.value]"
-          },
-          "acrName": {
-            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'container-registry'), '2025-04-01').outputs.name.value]"
-          },
-          "deployerPrincipalId": {
-            "value": "[deployer().objectId]"
-          },
-          "aiProjectPrincipalId": "[if(parameters('useExistingAiProject'), createObject('value', ''), createObject('value', reference(resourceId('Microsoft.Resources/deployments', 'ai-services'), '2025-04-01').outputs.aiProjectInfo.value.aiprojectSystemAssignedMIPrincipalId))]"
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.44.1.10279",
-              "templateHash": "1600731836190547846"
-            }
-          },
-          "parameters": {
-            "openaiName": {
-              "type": "string"
-            },
-            "searchName": {
-              "type": "string"
-            },
-            "storageName": {
-              "type": "string"
-            },
-            "cosmosName": {
-              "type": "string"
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.sql-db.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.databaseName.value]"
             },
-            "backendPrincipalId": {
-              "type": "string"
-            },
-            "frontendPrincipalId": {
+            "API_APP_NAME": {
               "type": "string",
-              "defaultValue": "",
               "metadata": {
-                "description": "Principal ID of the frontend web app managed identity"
-              }
+                "description": "Backend API application (and SQL contained user) name."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]"
             },
-            "acrName": {
+            "AZURE_API_PRINCIPAL_ID": {
               "type": "string",
-              "defaultValue": "",
               "metadata": {
-                "description": "Name of the Azure Container Registry (empty if not using ACR)"
-              }
+                "description": "Backend API system-assigned managed identity principal ID."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.identityPrincipalId.value]"
             },
-            "deployerPrincipalId": {
+            "AZURE_COSMOS_ENDPOINT": {
               "type": "string",
-              "defaultValue": "",
               "metadata": {
-                "description": "Principal ID of the deploying user (for local script access)"
-              }
+                "description": "Azure Cosmos DB endpoint."
+              },
+              "value": "[if(parameters('deployCosmos'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value, '')]"
             },
-            "aiProjectPrincipalId": {
+            "AZURE_AI_AGENT_ENDPOINT": {
               "type": "string",
-              "defaultValue": "",
               "metadata": {
-                "description": "Principal ID of the AI Foundry project managed identity (for agent search access)"
-              }
-            }
-          },
-          "variables": {
-            "roles": {
-              "cognitiveServicesOpenAIUser": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
-              "cognitiveServicesUser": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
-              "azureAIDeveloper": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
-              "searchIndexDataContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]",
-              "searchServiceContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]",
-              "searchIndexDataReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1407120a-92aa-4202-b7e9-c0e197c71c8f')]",
-              "storageBlobDataContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
-              "storageQueueDataContributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
-              "cosmosDBDataContributor": "00000000-0000-0000-0000-000000000002",
-              "acrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
-              "foundryUser": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d')]"
-            }
-          },
-          "resources": [
-            {
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName'))]",
-              "name": "[guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName')), parameters('backendPrincipalId'), variables('roles').cognitiveServicesOpenAIUser)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').cognitiveServicesOpenAIUser]",
-                "principalId": "[parameters('backendPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
-            },
-            {
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName'))]",
-              "name": "[guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName')), parameters('backendPrincipalId'), variables('roles').foundryUser)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').foundryUser]",
-                "principalId": "[parameters('backendPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
-            },
-            {
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Search/searchServices', parameters('searchName'))]",
-              "name": "[guid(resourceId('Microsoft.Search/searchServices', parameters('searchName')), parameters('backendPrincipalId'), variables('roles').searchIndexDataContributor)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').searchIndexDataContributor]",
-                "principalId": "[parameters('backendPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
-            },
-            {
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Search/searchServices', parameters('searchName'))]",
-              "name": "[guid(resourceId('Microsoft.Search/searchServices', parameters('searchName')), parameters('backendPrincipalId'), variables('roles').searchServiceContributor)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').searchServiceContributor]",
-                "principalId": "[parameters('backendPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
-            },
-            {
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName'))]",
-              "name": "[guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName')), resourceId('Microsoft.Search/searchServices', parameters('searchName')), variables('roles').cognitiveServicesOpenAIUser)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').cognitiveServicesOpenAIUser]",
-                "principalId": "[reference(resourceId('Microsoft.Search/searchServices', parameters('searchName')), '2024-06-01-preview', 'full').identity.principalId]",
-                "principalType": "ServicePrincipal"
-              }
+                "description": "Azure AI Agent endpoint URL."
+              },
+              "value": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectEndpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.projectEndpoint.value)]"
             },
-            {
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageName'))]",
-              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageName')), parameters('backendPrincipalId'), variables('roles').storageBlobDataContributor)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').storageBlobDataContributor]",
-                "principalId": "[parameters('backendPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
+            "API_APP_URL": {
+              "type": "string",
+              "metadata": {
+                "description": "Backend API application URL."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]"
             },
-            {
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageName'))]",
-              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageName')), parameters('backendPrincipalId'), variables('roles').storageQueueDataContributor)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').storageQueueDataContributor]",
-                "principalId": "[parameters('backendPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
+            "WEB_APP_URL": {
+              "type": "string",
+              "metadata": {
+                "description": "Frontend web application URL."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]"
             },
-            {
-              "condition": "[not(equals(parameters('cosmosName'), ''))]",
-              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
-              "apiVersion": "2024-05-15",
-              "name": "[format('{0}/{1}', parameters('cosmosName'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosName')), parameters('backendPrincipalId'), variables('roles').cosmosDBDataContributor))]",
-              "properties": {
-                "roleDefinitionId": "[format('{0}/sqlRoleDefinitions/{1}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosName')), variables('roles').cosmosDBDataContributor)]",
-                "principalId": "[parameters('backendPrincipalId')]",
-                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosName'))]"
-              }
+            "SERVICE_BACKEND_URI": {
+              "type": "string",
+              "metadata": {
+                "description": "Backend service URI (used by azd)."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-backend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]"
             },
-            {
-              "condition": "[not(empty(parameters('deployerPrincipalId')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName'))]",
-              "name": "[guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName')), parameters('deployerPrincipalId'), variables('roles').azureAIDeveloper)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').azureAIDeveloper]",
-                "principalId": "[parameters('deployerPrincipalId')]",
-                "principalType": "User"
-              }
+            "SERVICE_FRONTEND_URI": {
+              "type": "string",
+              "metadata": {
+                "description": "Frontend service URI (used by azd)."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.appUrl.value]"
             },
-            {
-              "condition": "[not(empty(parameters('deployerPrincipalId')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName'))]",
-              "name": "[guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName')), parameters('deployerPrincipalId'), variables('roles').foundryUser)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').foundryUser]",
-                "principalId": "[parameters('deployerPrincipalId')]",
-                "principalType": "User"
-              }
+            "AZURE_AI_SEARCH_CONNECTION_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "AI Search connection name in AI Foundry."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.foundry-search-conn.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.connectionName.value]"
             },
-            {
-              "condition": "[not(empty(parameters('deployerPrincipalId')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName'))]",
-              "name": "[guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('openaiName')), parameters('deployerPrincipalId'), variables('roles').cognitiveServicesOpenAIUser)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').cognitiveServicesOpenAIUser]",
-                "principalId": "[parameters('deployerPrincipalId')]",
-                "principalType": "User"
-              }
+            "ACR_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure Container Registry name."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]"
             },
-            {
-              "condition": "[not(empty(parameters('deployerPrincipalId')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Search/searchServices', parameters('searchName'))]",
-              "name": "[guid(resourceId('Microsoft.Search/searchServices', parameters('searchName')), parameters('deployerPrincipalId'), variables('roles').searchIndexDataContributor)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').searchIndexDataContributor]",
-                "principalId": "[parameters('deployerPrincipalId')]",
-                "principalType": "User"
-              }
+            "ACR_LOGIN_SERVER": {
+              "type": "string",
+              "metadata": {
+                "description": "Azure Container Registry login server URL."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.container-registry.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.loginServer.value]"
             },
-            {
-              "condition": "[not(empty(parameters('deployerPrincipalId')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Search/searchServices', parameters('searchName'))]",
-              "name": "[guid(resourceId('Microsoft.Search/searchServices', parameters('searchName')), parameters('deployerPrincipalId'), variables('roles').searchServiceContributor)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').searchServiceContributor]",
-                "principalId": "[parameters('deployerPrincipalId')]",
-                "principalType": "User"
-              }
+            "BACKEND_CONTAINER_IMAGE_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "Backend container image repository name to build and push to ACR."
+              },
+              "value": "[parameters('backendContainerImageName')]"
             },
-            {
-              "condition": "[not(empty(parameters('deployerPrincipalId')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageName'))]",
-              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageName')), parameters('deployerPrincipalId'), variables('roles').storageBlobDataContributor)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').storageBlobDataContributor]",
-                "principalId": "[parameters('deployerPrincipalId')]",
-                "principalType": "User"
-              }
+            "BACKEND_CONTAINER_IMAGE_TAG": {
+              "type": "string",
+              "metadata": {
+                "description": "Backend container image tag to build and push to ACR."
+              },
+              "value": "[parameters('backendContainerImageTag')]"
             },
-            {
-              "condition": "[not(empty(parameters('deployerPrincipalId')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageName'))]",
-              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageName')), parameters('deployerPrincipalId'), variables('roles').storageQueueDataContributor)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').storageQueueDataContributor]",
-                "principalId": "[parameters('deployerPrincipalId')]",
-                "principalType": "User"
-              }
+            "FRONTEND_CONTAINER_IMAGE_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "Frontend container image repository name to build and push to ACR."
+              },
+              "value": "[parameters('frontendContainerImageName')]"
             },
-            {
-              "condition": "[not(empty(parameters('aiProjectPrincipalId')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Search/searchServices', parameters('searchName'))]",
-              "name": "[guid(resourceId('Microsoft.Search/searchServices', parameters('searchName')), parameters('aiProjectPrincipalId'), variables('roles').searchIndexDataReader)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').searchIndexDataReader]",
-                "principalId": "[parameters('aiProjectPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
+            "FRONTEND_CONTAINER_IMAGE_TAG": {
+              "type": "string",
+              "metadata": {
+                "description": "Frontend container image tag to build and push to ACR."
+              },
+              "value": "[parameters('frontendContainerImageTag')]"
             },
-            {
-              "condition": "[not(empty(parameters('aiProjectPrincipalId')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.Search/searchServices', parameters('searchName'))]",
-              "name": "[guid(resourceId('Microsoft.Search/searchServices', parameters('searchName')), parameters('aiProjectPrincipalId'), variables('roles').searchServiceContributor)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').searchServiceContributor]",
-                "principalId": "[parameters('aiProjectPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
+            "FRONTEND_APP_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "Frontend web application (App Service) name."
+              },
+              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.app-service-frontend.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]"
             },
-            {
-              "condition": "[not(empty(parameters('acrName')))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName'))]",
-              "name": "[guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName')), parameters('backendPrincipalId'), variables('roles').acrPull)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').acrPull]",
-                "principalId": "[parameters('backendPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
+            "RESOURCE_GROUP_NAME": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource group name."
+              },
+              "value": "[resourceGroup().name]"
             },
-            {
-              "condition": "[and(not(empty(parameters('acrName'))), not(empty(parameters('frontendPrincipalId'))))]",
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName'))]",
-              "name": "[guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('acrName')), parameters('frontendPrincipalId'), variables('roles').acrPull)]",
-              "properties": {
-                "roleDefinitionId": "[variables('roles').acrPull]",
-                "principalId": "[parameters('frontendPrincipalId')]",
-                "principalType": "ServicePrincipal"
-              }
+            "SOLUTION_SUFFIX": {
+              "type": "string",
+              "metadata": {
+                "description": "Solution resource token suffix used in resource names."
+              },
+              "value": "[variables('solutionSuffix')]"
             }
-          ]
+          }
         }
-      },
-      "dependsOn": [
-        "[resourceId('Microsoft.Resources/deployments', 'ai-services')]",
-        "[resourceId('Microsoft.Resources/deployments', 'container-registry')]",
-        "[resourceId('Microsoft.Resources/deployments', 'cosmos')]",
-        "[resourceId('Microsoft.Resources/deployments', 'search')]",
-        "[resourceId('Microsoft.Resources/deployments', 'storage')]",
-        "[resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('backendWebSiteResourceName')), 64))]",
-        "[resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('frontendWebSiteResourceName')), 64))]"
-      ]
+      }
     }
-  ],
+  },
   "outputs": {
     "AZURE_OPENAI_ENDPOINT": {
       "type": "string",
       "metadata": {
         "description": "Azure OpenAI endpoint URL."
       },
-      "value": "[if(parameters('useExistingAiProject'), parameters('existingAiFoundryEndpoint'), reference(resourceId('Microsoft.Resources/deployments', 'ai-services'), '2025-04-01').outputs.endpoint.value)]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_OPENAI_ENDPOINT.value, reference('bicepDeployment').outputs.AZURE_OPENAI_ENDPOINT.value)]"
     },
     "AZURE_SEARCH_ENDPOINT": {
       "type": "string",
       "metadata": {
         "description": "Azure AI Search endpoint URL."
       },
-      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'search'), '2025-04-01').outputs.endpoint.value]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_SEARCH_ENDPOINT.value, reference('bicepDeployment').outputs.AZURE_SEARCH_ENDPOINT.value)]"
     },
     "AZURE_CONTENT_UNDERSTANDING_ENDPOINT": {
       "type": "string",
       "metadata": {
         "description": "Azure Content Understanding endpoint URL."
       },
-      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'ai-services'), '2025-04-01').outputs.endpoints.value['Content Understanding']]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_CONTENT_UNDERSTANDING_ENDPOINT.value, reference('bicepDeployment').outputs.AZURE_CONTENT_UNDERSTANDING_ENDPOINT.value)]"
     },
     "AZURE_STORAGE_ACCOUNT": {
       "type": "string",
       "metadata": {
         "description": "Azure Storage account name."
       },
-      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'storage'), '2025-04-01').outputs.accountName.value]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_STORAGE_ACCOUNT.value, reference('bicepDeployment').outputs.AZURE_STORAGE_ACCOUNT.value)]"
     },
     "AZURE_SQL_SERVER": {
       "type": "string",
       "metadata": {
         "description": "Azure SQL Server FQDN."
       },
-      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'sql'), '2025-04-01').outputs.serverFqdn.value]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_SQL_SERVER.value, reference('bicepDeployment').outputs.AZURE_SQL_SERVER.value)]"
     },
     "AZURE_SQL_DATABASE": {
       "type": "string",
       "metadata": {
         "description": "Azure SQL Database name."
       },
-      "value": "[format('{0}{1}', variables('abbrs').databases.sqlDatabase, variables('resourceToken'))]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_SQL_DATABASE.value, reference('bicepDeployment').outputs.AZURE_SQL_DATABASE.value)]"
     },
     "API_APP_NAME": {
       "type": "string",
       "metadata": {
         "description": "Backend API application (and SQL contained user) name."
       },
-      "value": "[variables('backendWebSiteResourceName')]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.API_APP_NAME.value, reference('bicepDeployment').outputs.API_APP_NAME.value)]"
     },
     "AZURE_API_PRINCIPAL_ID": {
       "type": "string",
       "metadata": {
         "description": "Backend API system-assigned managed identity principal ID."
       },
-      "value": "[reference(resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('backendWebSiteResourceName')), 64)), '2025-04-01').outputs.systemAssignedMIPrincipalId.value]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_API_PRINCIPAL_ID.value, reference('bicepDeployment').outputs.AZURE_API_PRINCIPAL_ID.value)]"
     },
     "AZURE_COSMOS_ENDPOINT": {
       "type": "string",
       "metadata": {
-        "description": "Azure Cosmos DB endpoint (empty if not deployed)."
+        "description": "Azure Cosmos DB endpoint."
       },
-      "value": "[if(parameters('deployCosmos'), reference(resourceId('Microsoft.Resources/deployments', 'cosmos'), '2025-04-01').outputs.endpoint.value, '')]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_COSMOS_ENDPOINT.value, reference('bicepDeployment').outputs.AZURE_COSMOS_ENDPOINT.value)]"
     },
     "AZURE_AI_AGENT_ENDPOINT": {
       "type": "string",
       "metadata": {
         "description": "Azure AI Agent endpoint URL."
       },
-      "value": "[if(parameters('useExistingAiProject'), format('{0}/projects/{1}', parameters('existingAiFoundryEndpoint'), parameters('existingAiFoundryProjectName')), reference(resourceId('Microsoft.Resources/deployments', 'ai-services'), '2025-04-01').outputs.aiProjectInfo.value.apiEndpoint)]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_AI_AGENT_ENDPOINT.value, reference('bicepDeployment').outputs.AZURE_AI_AGENT_ENDPOINT.value)]"
     },
     "API_APP_URL": {
       "type": "string",
       "metadata": {
         "description": "Backend API application URL."
       },
-      "value": "[format('https://{0}', reference(resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('backendWebSiteResourceName')), 64)), '2025-04-01').outputs.defaultHostname.value)]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.API_APP_URL.value, reference('bicepDeployment').outputs.API_APP_URL.value)]"
     },
     "WEB_APP_URL": {
       "type": "string",
       "metadata": {
         "description": "Frontend web application URL."
       },
-      "value": "[format('https://{0}', reference(resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('frontendWebSiteResourceName')), 64)), '2025-04-01').outputs.defaultHostname.value)]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.WEB_APP_URL.value, reference('bicepDeployment').outputs.WEB_APP_URL.value)]"
     },
     "SERVICE_BACKEND_URI": {
       "type": "string",
       "metadata": {
         "description": "Backend service URI (used by azd)."
       },
-      "value": "[format('https://{0}', reference(resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('backendWebSiteResourceName')), 64)), '2025-04-01').outputs.defaultHostname.value)]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.SERVICE_BACKEND_URI.value, reference('bicepDeployment').outputs.SERVICE_BACKEND_URI.value)]"
     },
     "SERVICE_FRONTEND_URI": {
       "type": "string",
       "metadata": {
         "description": "Frontend service URI (used by azd)."
       },
-      "value": "[format('https://{0}', reference(resourceId('Microsoft.Resources/deployments', take(format('module.web-sites.{0}', variables('frontendWebSiteResourceName')), 64)), '2025-04-01').outputs.defaultHostname.value)]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.SERVICE_FRONTEND_URI.value, reference('bicepDeployment').outputs.SERVICE_FRONTEND_URI.value)]"
     },
     "AZURE_AI_SEARCH_CONNECTION_NAME": {
       "type": "string",
       "metadata": {
         "description": "AI Search connection name in AI Foundry."
       },
-      "value": "[if(parameters('useExistingAiProject'), parameters('existingAiSearchConnectionName'), variables('aiSearchConnectionName'))]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.AZURE_AI_SEARCH_CONNECTION_NAME.value, reference('bicepDeployment').outputs.AZURE_AI_SEARCH_CONNECTION_NAME.value)]"
     },
     "ACR_NAME": {
       "type": "string",
       "metadata": {
         "description": "Azure Container Registry name."
       },
-      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'container-registry'), '2025-04-01').outputs.name.value]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.ACR_NAME.value, reference('bicepDeployment').outputs.ACR_NAME.value)]"
     },
     "ACR_LOGIN_SERVER": {
       "type": "string",
       "metadata": {
         "description": "Azure Container Registry login server URL."
       },
-      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'container-registry'), '2025-04-01').outputs.loginServer.value]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.ACR_LOGIN_SERVER.value, reference('bicepDeployment').outputs.ACR_LOGIN_SERVER.value)]"
     },
     "BACKEND_CONTAINER_IMAGE_NAME": {
       "type": "string",
       "metadata": {
         "description": "Backend container image repository name to build and push to ACR."
       },
-      "value": "[parameters('backendContainerImageName')]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.BACKEND_CONTAINER_IMAGE_NAME.value, reference('bicepDeployment').outputs.BACKEND_CONTAINER_IMAGE_NAME.value)]"
     },
     "BACKEND_CONTAINER_IMAGE_TAG": {
       "type": "string",
       "metadata": {
         "description": "Backend container image tag to build and push to ACR."
       },
-      "value": "[parameters('backendContainerImageTag')]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.BACKEND_CONTAINER_IMAGE_TAG.value, reference('bicepDeployment').outputs.BACKEND_CONTAINER_IMAGE_TAG.value)]"
     },
     "FRONTEND_CONTAINER_IMAGE_NAME": {
       "type": "string",
       "metadata": {
         "description": "Frontend container image repository name to build and push to ACR."
       },
-      "value": "[parameters('frontendContainerImageName')]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.FRONTEND_CONTAINER_IMAGE_NAME.value, reference('bicepDeployment').outputs.FRONTEND_CONTAINER_IMAGE_NAME.value)]"
     },
     "FRONTEND_CONTAINER_IMAGE_TAG": {
       "type": "string",
       "metadata": {
         "description": "Frontend container image tag to build and push to ACR."
       },
-      "value": "[parameters('frontendContainerImageTag')]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.FRONTEND_CONTAINER_IMAGE_TAG.value, reference('bicepDeployment').outputs.FRONTEND_CONTAINER_IMAGE_TAG.value)]"
     },
     "FRONTEND_APP_NAME": {
       "type": "string",
       "metadata": {
         "description": "Frontend web application (App Service) name."
       },
-      "value": "[variables('frontendWebSiteResourceName')]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.FRONTEND_APP_NAME.value, reference('bicepDeployment').outputs.FRONTEND_APP_NAME.value)]"
     },
     "RESOURCE_GROUP_NAME": {
       "type": "string",
@@ -8629,7 +96572,14 @@
       "metadata": {
         "description": "Solution resource token suffix used in resource names."
       },
-      "value": "[variables('resourceToken')]"
+      "value": "[if(variables('isAvm'), reference('avmDeployment').outputs.SOLUTION_SUFFIX.value, reference('bicepDeployment').outputs.SOLUTION_SUFFIX.value)]"
+    },
+    "ENABLE_PRIVATE_NETWORKING": {
+      "type": "bool",
+      "metadata": {
+        "description": "Whether the deployment uses private endpoints. Post-provision scripts gate ACR admin-credential image pull on this."
+      },
+      "value": "[parameters('enablePrivateNetworking')]"
     }
   }
 }
\ No newline at end of file
diff --git a/infra/main.parameters.json b/infra/main.parameters.json
index 834afcf3b..44af30c81 100644
--- a/infra/main.parameters.json
+++ b/infra/main.parameters.json
@@ -2,35 +2,71 @@
   "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
   "contentVersion": "1.0.0.0",
   "parameters": {
-    "environmentName": {
+    "deploymentFlavor": {
+      "value": "${DEPLOYMENT_FLAVOR=bicep}"
+    },
+    "solutionName": {
       "value": "${AZURE_ENV_NAME}"
     },
     "location": {
       "value": "${AZURE_LOCATION}"
     },
+    "azureAiServiceLocation": {
+      "value": "${AZURE_ENV_AI_SERVICE_LOCATION}"
+    },
+    "deployCosmos": {
+      "value": "${AZURE_ENV_DEPLOY_COSMOS=false}"
+    },
+    "deploymentType": {
+      "value": "${AZURE_ENV_MODEL_DEPLOYMENT_TYPE}"
+    },
+    "gptModelName": {
+      "value": "${AZURE_ENV_GPT_MODEL_NAME}"
+    },
+    "gptModelVersion": {
+      "value": "${AZURE_ENV_GPT_MODEL_VERSION}"
+    },
+    "gptDeploymentCapacity": {
+      "value": "${AZURE_ENV_GPT_MODEL_CAPACITY}"
+    },
+    "embeddingModel": {
+      "value": "${AZURE_ENV_EMBEDDING_MODEL_NAME}"
+    },
+    "embeddingDeploymentCapacity": {
+      "value": "${AZURE_ENV_EMBEDDING_DEPLOYMENT_CAPACITY}"
+    },
+    "containerRegistryName": {
+      "value": "${AZURE_ENV_CONTAINER_REGISTRY_NAME}"
+    },
+    "backendContainerImageTag": {
+      "value": "${AZURE_ENV_IMAGE_TAG=latest}"
+    },
+    "frontendContainerImageTag": {
+      "value": "${AZURE_ENV_IMAGE_TAG=latest}"
+    },
+    "appServicePlanSku": {
+      "value": "${AZURE_ENV_APP_SERVICE_PLAN_SKU=B3}"
+    },
     "azureAdTenantId": {
       "value": "${AZURE_AD_TENANT_ID}"
     },
     "azureAdClientId": {
       "value": "${AZURE_AD_CLIENT_ID}"
     },
-    "useExistingAiProject": {
-      "value": "${USE_EXISTING_AI_PROJECT=false}"
-    },
-    "existingAiFoundryServiceName": {
-      "value": "${EXISTING_AI_FOUNDRY_SERVICE_NAME=}"
+    "adminApiKey": {
+      "value": "${ADMIN_API_KEY=}"
     },
-    "existingAiFoundryProjectName": {
-      "value": "${EXISTING_AI_FOUNDRY_PROJECT_NAME=}"
+    "existingLogAnalyticsWorkspaceId": {
+      "value": "${AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID}"
     },
-    "existingAiFoundryEndpoint": {
-      "value": "${EXISTING_AI_FOUNDRY_ENDPOINT=}"
+    "existingFoundryProjectResourceId": {
+      "value": "${AZURE_EXISTING_AIPROJECT_RESOURCE_ID}"
     },
-    "existingAiSearchConnectionName": {
-      "value": "${EXISTING_AI_SEARCH_CONNECTION_NAME=}"
+    "deployingUserPrincipalType": {
+      "value": "${DEPLOYING_USER_PRINCIPAL_TYPE=User}"
     },
-    "adminApiKey": {
-      "value": "${ADMIN_API_KEY=}"
+    "enableMonitoring": {
+      "value": true
     }
   }
-}
+}
\ No newline at end of file
diff --git a/infra/main.waf.parameters.json b/infra/main.waf.parameters.json
new file mode 100644
index 000000000..d1dfe583e
--- /dev/null
+++ b/infra/main.waf.parameters.json
@@ -0,0 +1,93 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
+  "contentVersion": "1.0.0.0",
+  "parameters": {
+    "deploymentFlavor": {
+      "value": "avm-waf"
+    },
+    "solutionName": {
+      "value": "${AZURE_ENV_NAME}"
+    },
+    "location": {
+      "value": "${AZURE_LOCATION}"
+    },
+    "azureAiServiceLocation": {
+      "value": "${AZURE_ENV_AI_SERVICE_LOCATION}"
+    },
+    "deployCosmos": {
+      "value": "${AZURE_ENV_DEPLOY_COSMOS=false}"
+    },
+    "deploymentType": {
+      "value": "${AZURE_ENV_MODEL_DEPLOYMENT_TYPE}"
+    },
+    "gptModelName": {
+      "value": "${AZURE_ENV_GPT_MODEL_NAME}"
+    },
+    "gptModelVersion": {
+      "value": "${AZURE_ENV_GPT_MODEL_VERSION}"
+    },
+    "gptDeploymentCapacity": {
+      "value": "${AZURE_ENV_GPT_MODEL_CAPACITY}"
+    },
+    "embeddingModel": {
+      "value": "${AZURE_ENV_EMBEDDING_MODEL_NAME}"
+    },
+    "embeddingDeploymentCapacity": {
+      "value": "${AZURE_ENV_EMBEDDING_DEPLOYMENT_CAPACITY}"
+    },
+    "containerRegistryName": {
+      "value": "${AZURE_ENV_CONTAINER_REGISTRY_NAME}"
+    },
+    "backendContainerImageTag": {
+      "value": "${AZURE_ENV_IMAGE_TAG=latest}"
+    },
+    "frontendContainerImageTag": {
+      "value": "${AZURE_ENV_IMAGE_TAG=latest}"
+    },
+    "appServicePlanSku": {
+      "value": "${AZURE_ENV_APP_SERVICE_PLAN_SKU=B3}"
+    },
+    "azureAdTenantId": {
+      "value": "${AZURE_AD_TENANT_ID}"
+    },
+    "azureAdClientId": {
+      "value": "${AZURE_AD_CLIENT_ID}"
+    },
+    "adminApiKey": {
+      "value": "${ADMIN_API_KEY=}"
+    },
+    "existingLogAnalyticsWorkspaceId": {
+      "value": "${AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID}"
+    },
+    "existingFoundryProjectResourceId": {
+      "value": "${AZURE_EXISTING_AIPROJECT_RESOURCE_ID}"
+    },
+    "deployingUserPrincipalType": {
+      "value": "${DEPLOYING_USER_PRINCIPAL_TYPE=User}"
+    },
+    "enableTelemetry": {
+      "value": "${AZURE_ENV_ENABLE_TELEMETRY=true}"
+    },
+    "enableMonitoring": {
+      "value": true
+    },
+    "enablePrivateNetworking": {
+      "value": true
+    },
+    "enableScalability": {
+      "value": true
+    },
+    "enableRedundancy": {
+      "value": false
+    },
+    "vmAdminUsername": {
+      "value": "${AZURE_ENV_VM_ADMIN_USERNAME}"
+    },
+    "vmAdminPassword": {
+      "value": "${AZURE_ENV_VM_ADMIN_PASSWORD}"
+    },
+    "vmSize": {
+      "value": "${AZURE_ENV_VM_SIZE}"
+    }
+  }
+}
diff --git a/infra/modules/ai-services.bicep b/infra/modules/ai-services.bicep
deleted file mode 100644
index d9de64dc0..000000000
--- a/infra/modules/ai-services.bicep
+++ /dev/null
@@ -1,389 +0,0 @@
-metadata name = 'Cognitive Services'
-metadata description = 'This module deploys a Cognitive Service.'
-
-@description('Required. The name of Cognitive Services account.')
-param name string
-
-@description('Required. Kind of the Cognitive Services account. Use \'Get-AzCognitiveServicesAccountSku\' to determine a valid combinations of \'kind\' and \'SKU\' for your Azure region.')
-@allowed([
-  'AIServices'
-  'AnomalyDetector'
-  'CognitiveServices'
-  'ComputerVision'
-  'ContentModerator'
-  'ContentSafety'
-  'ConversationalLanguageUnderstanding'
-  'CustomVision.Prediction'
-  'CustomVision.Training'
-  'Face'
-  'FormRecognizer'
-  'HealthInsights'
-  'ImmersiveReader'
-  'Internal.AllInOne'
-  'LUIS'
-  'LUIS.Authoring'
-  'LanguageAuthoring'
-  'MetricsAdvisor'
-  'OpenAI'
-  'Personalizer'
-  'QnAMaker.v2'
-  'SpeechServices'
-  'TextAnalytics'
-  'TextTranslation'
-])
-param kind string
-
-@description('Optional. The name of the AI Foundry project to create.')
-param projectName string = ''
-
-@description('Optional. The description of the AI Foundry project to create.')
-param projectDescription string = ''
-
-@description('Optional. SKU of the Cognitive Services account. Use \'Get-AzCognitiveServicesAccountSku\' to determine a valid combinations of \'kind\' and \'SKU\' for your Azure region.')
-@allowed([
-  'C2'
-  'C3'
-  'C4'
-  'F0'
-  'F1'
-  'S'
-  'S0'
-  'S1'
-  'S10'
-  'S2'
-  'S3'
-  'S4'
-  'S5'
-  'S6'
-  'S7'
-  'S8'
-  'S9'
-])
-param sku string = 'S0'
-
-@description('Optional. Location for all Resources.')
-param location string = resourceGroup().location
-
-import { diagnosticSettingFullType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. The diagnostic settings of the service.')
-param diagnosticSettings diagnosticSettingFullType[]?
-
-@description('Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set.')
-@allowed([
-  'Enabled'
-  'Disabled'
-])
-param publicNetworkAccess string?
-
-@description('Conditional. Subdomain name used for token-based authentication. Required if \'networkAcls\' or \'privateEndpoints\' are set.')
-param customSubDomainName string?
-
-@description('Optional. A collection of rules governing the accessibility from specific network locations.')
-param networkAcls object?
-
-@description('Optional. The network injection subnet resource Id for the Cognitive Services account. This allows to use the AI Services account with a virtual network.')
-param networkInjectionSubnetResourceId string?
-
-import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
-param privateEndpoints privateEndpointSingleServiceType[]?
-
-import { lockType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. The lock settings of the service.')
-param lock lockType?
-
-import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. Array of role assignments to create.')
-param roleAssignments roleAssignmentType[]?
-
-@description('Optional. Tags of the resource.')
-param tags object?
-
-@description('Optional. List of allowed FQDN.')
-param allowedFqdnList array?
-
-@description('Optional. The API properties for special APIs.')
-param apiProperties object?
-
-@description('Optional. Allow only Azure AD authentication. Should be enabled for security reasons.')
-param disableLocalAuth bool = false
-
-import { customerManagedKeyType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. The customer managed key definition.')
-param customerManagedKey customerManagedKeyType?
-
-@description('Optional. The flag to enable dynamic throttling.')
-param dynamicThrottlingEnabled bool = false
-
-@secure()
-@description('Optional. Resource migration token.')
-param migrationToken string?
-
-@description('Optional. Restore a soft-deleted cognitive service at deployment time. Defaults to true so re-deployments succeed when a previous azd down left a soft-deleted resource.')
-param restore bool = true
-
-@description('Optional. Restrict outbound network access.')
-param restrictOutboundNetworkAccess bool = false
-
-@description('Optional. The storage accounts for this resource.')
-param userOwnedStorage array?
-
-import { managedIdentityAllType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. The managed identity definition for this resource.')
-param managedIdentities managedIdentityAllType?
-
-@description('Optional. Array of deployments about cognitive service accounts to create.')
-param deployments deploymentType[]?
-
-@description('Optional. The resource ID of an existing Foundry project to use.')
-param existingFoundryProjectResourceId string = ''
-
-var formattedUserAssignedIdentities = reduce(
-  map((managedIdentities.?userAssignedResourceIds ?? []), (id) => { '${id}': {} }),
-  {},
-  (cur, next) => union(cur, next)
-) // Converts the flat array to an object like { '${id1}': {}, '${id2}': {} }
-var identity = !empty(managedIdentities)
-  ? {
-      type: (managedIdentities.?systemAssigned ?? false)
-        ? (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'SystemAssigned, UserAssigned' : 'SystemAssigned')
-        : (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'UserAssigned' : null)
-      userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
-    }
-  : null
-
-resource cMKKeyVault 'Microsoft.KeyVault/vaults@2024-11-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId)) {
-  name: last(split(customerManagedKey.?keyVaultResourceId!, '/'))
-  scope: resourceGroup(
-    split(customerManagedKey.?keyVaultResourceId!, '/')[2],
-    split(customerManagedKey.?keyVaultResourceId!, '/')[4]
-  )
-
-  resource cMKKey 'keys@2024-11-01' existing = if (!empty(customerManagedKey.?keyVaultResourceId) && !empty(customerManagedKey.?keyName)) {
-    name: customerManagedKey.?keyName!
-  }
-}
-
-resource cMKUserAssignedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2024-11-30' existing = if (!empty(customerManagedKey.?userAssignedIdentityResourceId)) {
-  name: last(split(customerManagedKey.?userAssignedIdentityResourceId!, '/'))
-  scope: resourceGroup(
-    split(customerManagedKey.?userAssignedIdentityResourceId!, '/')[2],
-    split(customerManagedKey.?userAssignedIdentityResourceId!, '/')[4]
-  )
-}
-
-var useExistingService = !empty(existingFoundryProjectResourceId)
-
-resource cognitiveServiceNew 'Microsoft.CognitiveServices/accounts@2025-06-01' = if(!useExistingService) {
-  name: name
-  kind: kind
-  identity: identity
-  location: location
-  tags: tags
-  sku: {
-    name: sku
-  }
-  properties: {
-    customSubDomainName: customSubDomainName
-    allowProjectManagement: true
-    networkAcls: !empty(networkAcls ?? {})
-      ? {
-          defaultAction: networkAcls.?defaultAction
-          virtualNetworkRules: networkAcls.?virtualNetworkRules ?? []
-          ipRules: networkAcls.?ipRules ?? []
-          bypass: networkAcls.?bypass ?? 'None'
-        }
-      : null
-    publicNetworkAccess: publicNetworkAccess != null
-      ? publicNetworkAccess
-      : (!empty(networkAcls) ? 'Enabled' : 'Disabled')
-    allowedFqdnList: allowedFqdnList
-    apiProperties: apiProperties
-    disableLocalAuth: disableLocalAuth
-    #disable-next-line BCP036
-    networkInjections: networkInjectionSubnetResourceId != null
-      ? [
-          {
-            scenario: 'agent'
-            subnetArmId: networkInjectionSubnetResourceId
-            useMicrosoftManagedNetwork: false
-          }
-        ]
-      : null
-    // true is not supported today
-    encryption: !empty(customerManagedKey)
-      ? {
-          keySource: 'Microsoft.KeyVault'
-          keyVaultProperties: {
-            identityClientId: !empty(customerManagedKey.?userAssignedIdentityResourceId ?? '')
-              ? cMKUserAssignedIdentity!.properties.clientId
-              : null
-            keyVaultUri: cMKKeyVault!.properties.vaultUri
-            keyName: customerManagedKey!.keyName
-            keyVersion: !empty(customerManagedKey.?keyVersion ?? '')
-              ? customerManagedKey!.?keyVersion
-              : last(split(cMKKeyVault::cMKKey!.properties.keyUriWithVersion, '/'))
-          }
-        }
-      : null
-    migrationToken: migrationToken
-    restore: restore
-    restrictOutboundNetworkAccess: restrictOutboundNetworkAccess
-    userOwnedStorage: userOwnedStorage
-    dynamicThrottlingEnabled: dynamicThrottlingEnabled
-  }
-}
-
-var existingCognitiveServiceDetails = split(existingFoundryProjectResourceId, '/')
-
-resource cognitiveServiceExisting 'Microsoft.CognitiveServices/accounts@2025-06-01' existing = if(useExistingService) {
-  name: existingCognitiveServiceDetails[8]
-  scope: resourceGroup(existingCognitiveServiceDetails[2], existingCognitiveServiceDetails[4])
-}
-
-module cognitive_service_dependencies './dependencies.bicep' = if(!useExistingService && !empty(projectName)) {
-  params: {
-    projectName: projectName
-    projectDescription: projectDescription
-    name:  cognitiveServiceNew.name
-    location: location
-    deployments: deployments
-    diagnosticSettings: diagnosticSettings
-    lock: lock
-    privateEndpoints: privateEndpoints
-    roleAssignments: roleAssignments
-    sku: sku
-    tags: tags
-  }
-}
-
-module existing_cognitive_service_dependencies './dependencies.bicep' = if(useExistingService) {
-  params: {
-    name:  cognitiveServiceExisting.name
-    projectName: projectName
-    projectDescription: projectDescription
-    existingFoundryProjectResourceId: existingFoundryProjectResourceId
-    location: location
-    deployments: deployments
-    diagnosticSettings: diagnosticSettings
-    lock: lock
-    privateEndpoints: privateEndpoints
-    roleAssignments: roleAssignments
-    sku: sku
-    tags: tags
-  }
-  scope: resourceGroup(existingCognitiveServiceDetails[2], existingCognitiveServiceDetails[4])
-}
-
-var cognitiveService = useExistingService ? cognitiveServiceExisting : cognitiveServiceNew
-
-@description('The name of the cognitive services account.')
-output name string = useExistingService ? cognitiveServiceExisting.name : cognitiveServiceNew.name
-
-@description('The resource ID of the cognitive services account.')
-output resourceId string = useExistingService ? cognitiveServiceExisting.id : cognitiveServiceNew.id
-
-@description('The resource group the cognitive services account was deployed into.')
-output subscriptionId string =  useExistingService ? existingCognitiveServiceDetails[2] : subscription().subscriptionId
-
-@description('The resource group the cognitive services account was deployed into.')
-output resourceGroupName string =  useExistingService ? existingCognitiveServiceDetails[4] : resourceGroup().name
-
-@description('The service endpoint of the cognitive services account.')
-output endpoint string = useExistingService ? cognitiveServiceExisting!.properties.endpoint : cognitiveService.properties.endpoint
-
-@description('All endpoints available for the cognitive services account, types depends on the cognitive service kind.')
-output endpoints endpointType = useExistingService ? cognitiveServiceExisting!.properties.endpoints : cognitiveService.properties.endpoints
-
-@description('The principal ID of the system assigned identity.')
-output systemAssignedMIPrincipalId string? = useExistingService ? cognitiveServiceExisting!.identity.principalId : cognitiveService.?identity.?principalId
-
-@description('The location the resource was deployed into.')
-output location string = useExistingService ? cognitiveServiceExisting!.location : cognitiveService.location
-
-@description('The private endpoints of the congitive services account.')
-output privateEndpoints privateEndpointOutputType[] = !empty(projectName) ? (useExistingService ? existing_cognitive_service_dependencies!.outputs.privateEndpoints : cognitive_service_dependencies!.outputs.privateEndpoints) : []
-
-import { aiProjectOutputType } from './project.bicep'
-output aiProjectInfo aiProjectOutputType = !empty(projectName) ? (useExistingService ? existing_cognitive_service_dependencies!.outputs.aiProjectInfo : cognitive_service_dependencies!.outputs.aiProjectInfo) : { name: '', resourceId: '', apiEndpoint: '', aiprojectSystemAssignedMIPrincipalId: '' }
-
-// ================ //
-// Definitions      //
-// ================ //
-
-@export()
-@description('The type for the private endpoint output.')
-type privateEndpointOutputType = {
-  @description('The name of the private endpoint.')
-  name: string
-
-  @description('The resource ID of the private endpoint.')
-  resourceId: string
-
-  @description('The group Id for the private endpoint Group.')
-  groupId: string?
-
-  @description('The custom DNS configurations of the private endpoint.')
-  customDnsConfigs: {
-    @description('FQDN that resolves to private endpoint IP address.')
-    fqdn: string?
-
-    @description('A list of private IP addresses of the private endpoint.')
-    ipAddresses: string[]
-  }[]
-
-  @description('The IDs of the network interfaces associated with the private endpoint.')
-  networkInterfaceResourceIds: string[]
-}
-
-@export()
-@description('The type for a cognitive services account deployment.')
-type deploymentType = {
-  @description('Optional. Specify the name of cognitive service account deployment.')
-  name: string?
-
-  @description('Required. Properties of Cognitive Services account deployment model.')
-  model: {
-    @description('Required. The name of Cognitive Services account deployment model.')
-    name: string
-
-    @description('Required. The format of Cognitive Services account deployment model.')
-    format: string
-
-    @description('Required. The version of Cognitive Services account deployment model.')
-    version: string
-  }
-
-  @description('Optional. The resource model definition representing SKU.')
-  sku: {
-    @description('Required. The name of the resource model definition representing SKU.')
-    name: string
-
-    @description('Optional. The capacity of the resource model definition representing SKU.')
-    capacity: int?
-
-    @description('Optional. The tier of the resource model definition representing SKU.')
-    tier: string?
-
-    @description('Optional. The size of the resource model definition representing SKU.')
-    size: string?
-
-    @description('Optional. The family of the resource model definition representing SKU.')
-    family: string?
-  }?
-
-  @description('Optional. The name of RAI policy.')
-  raiPolicyName: string?
-
-  @description('Optional. The version upgrade option.')
-  versionUpgradeOption: string?
-}
-
-@export()
-@description('The type for a cognitive services account endpoint.')
-type endpointType = {
-  @description('Type of the endpoint.')
-  name: string?
-  @description('The endpoint URI.')
-  endpoint: string?
-}
diff --git a/infra/modules/app-service-plan.bicep b/infra/modules/app-service-plan.bicep
deleted file mode 100644
index 969453394..000000000
--- a/infra/modules/app-service-plan.bicep
+++ /dev/null
@@ -1,41 +0,0 @@
-@description('Name of the App Service Plan')
-param name string
-
-@description('Location for the resource')
-param location string = resourceGroup().location
-
-@description('Tags for the resource')
-param tags object = {}
-
-@description('SKU name for the App Service Plan')
-@allowed([
-  'B1'
-  'B2'
-  'B3'
-  'S1'
-  'S2'
-  'S3'
-  'P1v3'
-  'P2v3'
-  'P3v3'
-])
-param skuName string = 'B1'
-
-resource appServicePlan 'Microsoft.Web/serverfarms@2024-04-01' = {
-  name: name
-  location: location
-  tags: tags
-  kind: 'linux'
-  properties: {
-    reserved: true
-  }
-  sku: {
-    name: skuName
-  }
-}
-
-@description('The resource ID of the App Service Plan')
-output id string = appServicePlan.id
-
-@description('The name of the App Service Plan')
-output name string = appServicePlan.name
diff --git a/infra/modules/container-registry.bicep b/infra/modules/container-registry.bicep
deleted file mode 100644
index 434fe0050..000000000
--- a/infra/modules/container-registry.bicep
+++ /dev/null
@@ -1,40 +0,0 @@
-metadata description = 'Creates a dedicated Azure Container Registry for the application container images.'
-
-@description('Required. Name of the container registry (alphanumeric, 5-50 chars, globally unique).')
-param name string
-
-@description('Optional. Location for the registry.')
-param location string = resourceGroup().location
-
-@description('Optional. Tags for the registry.')
-param tags object = {}
-
-@description('Optional. SKU for the registry.')
-@allowed([
-  'Basic'
-  'Standard'
-  'Premium'
-])
-param sku string = 'Standard'
-
-resource registry 'Microsoft.ContainerRegistry/registries@2023-07-01' = {
-  name: name
-  location: location
-  tags: tags
-  sku: {
-    name: sku
-  }
-  properties: {
-    adminUserEnabled: false
-    publicNetworkAccess: 'Enabled'
-  }
-}
-
-@description('The name of the container registry.')
-output name string = registry.name
-
-@description('The login server of the container registry.')
-output loginServer string = registry.properties.loginServer
-
-@description('The resource ID of the container registry.')
-output resourceId string = registry.id
diff --git a/infra/modules/cosmos.bicep b/infra/modules/cosmos.bicep
deleted file mode 100644
index e55049194..000000000
--- a/infra/modules/cosmos.bicep
+++ /dev/null
@@ -1,90 +0,0 @@
-param name string
-param location string
-param tags object
-param databaseName string
-
-resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2024-05-15' = {
-  name: name
-  location: location
-  tags: tags
-  kind: 'GlobalDocumentDB'
-  properties: {
-    databaseAccountOfferType: 'Standard'
-    consistencyPolicy: {
-      defaultConsistencyLevel: 'Session'
-    }
-    locations: [
-      {
-        locationName: location
-        failoverPriority: 0
-        isZoneRedundant: false
-      }
-    ]
-    capabilities: [
-      { name: 'EnableServerless' }
-    ]
-    publicNetworkAccess: 'Enabled'
-  }
-}
-
-resource database 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2024-05-15' = {
-  parent: cosmosAccount
-  name: databaseName
-  properties: {
-    resource: {
-      id: databaseName
-    }
-  }
-}
-
-// Chat sessions container
-resource chatSessions 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2024-05-15' = {
-  parent: database
-  name: 'chat_sessions'
-  properties: {
-    resource: {
-      id: 'chat_sessions'
-      partitionKey: { paths: ['/user_id'], kind: 'Hash' }
-    }
-  }
-}
-
-// Chat messages container
-resource chatMessages 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2024-05-15' = {
-  parent: database
-  name: 'chat_messages'
-  properties: {
-    resource: {
-      id: 'chat_messages'
-      partitionKey: { paths: ['/session_id'], kind: 'Hash' }
-    }
-  }
-}
-
-// Document insights container
-resource insights 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2024-05-15' = {
-  parent: database
-  name: 'document_insights'
-  properties: {
-    resource: {
-      id: 'document_insights'
-      partitionKey: { paths: ['/dataset_id'], kind: 'Hash' }
-    }
-  }
-}
-
-// Enrichment cache container
-resource enrichmentCache 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers@2024-05-15' = {
-  parent: database
-  name: 'enrichment_cache'
-  properties: {
-    resource: {
-      id: 'enrichment_cache'
-      partitionKey: { paths: ['/doc_hash'], kind: 'Hash' }
-    }
-  }
-}
-
-output endpoint string = cosmosAccount.properties.documentEndpoint
-output name string = cosmosAccount.name
-output id string = cosmosAccount.id
diff --git a/infra/modules/dependencies.bicep b/infra/modules/dependencies.bicep
deleted file mode 100644
index f905bc8d3..000000000
--- a/infra/modules/dependencies.bicep
+++ /dev/null
@@ -1,430 +0,0 @@
-@description('Required. The name of Cognitive Services account.')
-param name string
-
-@description('Optional. SKU of the Cognitive Services account. Use \'Get-AzCognitiveServicesAccountSku\' to determine a valid combinations of \'kind\' and \'SKU\' for your Azure region.')
-@allowed([
-  'C2'
-  'C3'
-  'C4'
-  'F0'
-  'F1'
-  'S'
-  'S0'
-  'S1'
-  'S10'
-  'S2'
-  'S3'
-  'S4'
-  'S5'
-  'S6'
-  'S7'
-  'S8'
-  'S9'
-])
-param sku string = 'S0'
-
-@description('Optional. Location for all Resources.')
-param location string = resourceGroup().location
-
-@description('Optional. Tags of the resource.')
-param tags object?
-
-@description('Optional. Array of deployments about cognitive service accounts to create.')
-param deployments deploymentType[]?
-
-import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.')
-param privateEndpoints privateEndpointSingleServiceType[]?
-
-import { lockType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. The lock settings of the service.')
-param lock lockType?
-
-import { roleAssignmentType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. Array of role assignments to create.')
-param roleAssignments roleAssignmentType[]?
-
-import { diagnosticSettingFullType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. The diagnostic settings of the service.')
-param diagnosticSettings diagnosticSettingFullType[]?
-
-@description('Optional. Name for the project which needs to be created.')
-param projectName string
-
-@description('Optional. Description  for the project which needs to be created.')
-param projectDescription string
-
-@description('Optional. Provide the existing project resource id in case if it needs to be reused')
-param existingFoundryProjectResourceId string = ''
-
-var builtInRoleNames = {
-  'Cognitive Services Contributor': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68'
-  )
-  'Cognitive Services Custom Vision Contributor': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3'
-  )
-  'Cognitive Services Custom Vision Deployment': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '5c4089e1-6d96-4d2f-b296-c1bc7137275f'
-  )
-  'Cognitive Services Custom Vision Labeler': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '88424f51-ebe7-446f-bc41-7fa16989e96c'
-  )
-  'Cognitive Services Custom Vision Reader': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '93586559-c37d-4a6b-ba08-b9f0940c2d73'
-  )
-  'Cognitive Services Custom Vision Trainer': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b'
-  )
-  'Cognitive Services Data Reader (Preview)': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'b59867f0-fa02-499b-be73-45a86b5b3e1c'
-  )
-  'Cognitive Services Face Recognizer': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '9894cab4-e18a-44aa-828b-cb588cd6f2d7'
-  )
-  'Cognitive Services Immersive Reader User': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'b2de6794-95db-4659-8781-7e080d3f2b9d'
-  )
-  'Cognitive Services Language Owner': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'f07febfe-79bc-46b1-8b37-790e26e6e498'
-  )
-  'Cognitive Services Language Reader': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '7628b7b8-a8b2-4cdc-b46f-e9b35248918e'
-  )
-  'Cognitive Services Language Writer': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8'
-  )
-  'Cognitive Services LUIS Owner': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'f72c8140-2111-481c-87ff-72b910f6e3f8'
-  )
-  'Cognitive Services LUIS Reader': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '18e81cdc-4e98-4e29-a639-e7d10c5a6226'
-  )
-  'Cognitive Services LUIS Writer': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '6322a993-d5c9-4bed-b113-e49bbea25b27'
-  )
-  'Cognitive Services Metrics Advisor Administrator': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'cb43c632-a144-4ec5-977c-e80c4affc34a'
-  )
-  'Cognitive Services Metrics Advisor User': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '3b20f47b-3825-43cb-8114-4bd2201156a8'
-  )
-  'Cognitive Services OpenAI Contributor': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'a001fd3d-188f-4b5d-821b-7da978bf7442'
-  )
-  'Cognitive Services OpenAI User': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
-  )
-  'Cognitive Services QnA Maker Editor': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'f4cc2bf9-21be-47a1-bdf1-5c5804381025'
-  )
-  'Cognitive Services QnA Maker Reader': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '466ccd10-b268-4a11-b098-b4849f024126'
-  )
-  'Cognitive Services Speech Contributor': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '0e75ca1e-0464-4b4d-8b93-68208a576181'
-  )
-  'Cognitive Services Speech User': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'f2dc8367-1007-4938-bd23-fe263f013447'
-  )
-  'Cognitive Services User': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'a97b65f3-24c7-4388-baec-2e87135dc908'
-  )
-  'Azure AI Developer': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '64702f94-c441-49e6-a78b-ef80e0188fee'
-  )
-  Contributor: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')
-  Owner: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')
-  Reader: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')
-  'Role Based Access Control Administrator': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    'f58310d9-a9f6-439a-9e8d-f62e7b41a168'
-  )
-  'User Access Administrator': subscriptionResourceId(
-    'Microsoft.Authorization/roleDefinitions',
-    '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9'
-  )
-}
-
-var formattedRoleAssignments = [
-  for (roleAssignment, index) in (roleAssignments ?? []): union(roleAssignment, {
-    roleDefinitionId: builtInRoleNames[?roleAssignment.roleDefinitionIdOrName] ?? (contains(
-        roleAssignment.roleDefinitionIdOrName,
-        '/providers/Microsoft.Authorization/roleDefinitions/'
-      )
-      ? roleAssignment.roleDefinitionIdOrName
-      : subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleAssignment.roleDefinitionIdOrName))
-  })
-]
-
-var enableReferencedModulesTelemetry = false
-
-resource cognitiveService 'Microsoft.CognitiveServices/accounts@2025-06-01' existing = {
-  name: name
-}
-
-@batchSize(1)
-resource cognitiveService_deployments 'Microsoft.CognitiveServices/accounts/deployments@2024-10-01' = [
-  for (deployment, index) in (deployments ?? []): {
-    parent: cognitiveService
-    name: deployment.?name ?? '${name}-deployments'
-    properties: {
-      model: deployment.model
-      raiPolicyName: deployment.?raiPolicyName
-      versionUpgradeOption: deployment.?versionUpgradeOption
-    }
-    sku: deployment.?sku ?? {
-      name: sku
-      capacity: 10
-    }
-  }
-]
-
-resource cognitiveService_lock 'Microsoft.Authorization/locks@2020-05-01' = if (!empty(lock ?? {}) && lock.?kind != 'None') {
-  name: lock.?name ?? 'lock-${name}'
-  properties: {
-    level: lock.?kind ?? ''
-    notes: lock.?kind == 'CanNotDelete'
-      ? 'Cannot delete resource or child resources.'
-      : 'Cannot delete or modify the resource or child resources.'
-  }
-  scope: cognitiveService
-}
-
-resource cognitiveService_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [
-  for (diagnosticSetting, index) in (diagnosticSettings ?? []): {
-    name: diagnosticSetting.?name ?? '${name}-diagnosticSettings'
-    properties: {
-      storageAccountId: diagnosticSetting.?storageAccountResourceId
-      workspaceId: diagnosticSetting.?workspaceResourceId
-      eventHubAuthorizationRuleId: diagnosticSetting.?eventHubAuthorizationRuleResourceId
-      eventHubName: diagnosticSetting.?eventHubName
-      metrics: [
-        for group in (diagnosticSetting.?metricCategories ?? [{ category: 'AllMetrics' }]): {
-          category: group.category
-          enabled: group.?enabled ?? true
-          timeGrain: null
-        }
-      ]
-      logs: [
-        for group in (diagnosticSetting.?logCategoriesAndGroups ?? [{ categoryGroup: 'allLogs' }]): {
-          categoryGroup: group.?categoryGroup
-          category: group.?category
-          enabled: group.?enabled ?? true
-        }
-      ]
-      marketplacePartnerId: diagnosticSetting.?marketplacePartnerResourceId
-      logAnalyticsDestinationType: diagnosticSetting.?logAnalyticsDestinationType
-    }
-    scope: cognitiveService
-  }
-]
-
-module cognitiveService_privateEndpoints 'br/public:avm/res/network/private-endpoint:0.11.1' = [
-  for (privateEndpoint, index) in (privateEndpoints ?? []): {
-    name: '${uniqueString(deployment().name, location)}-cognitiveService-PrivateEndpoint-${index}'
-    scope: resourceGroup(
-      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[2],
-      split(privateEndpoint.?resourceGroupResourceId ?? resourceGroup().id, '/')[4]
-    )
-    params: {
-      name: privateEndpoint.?name ?? 'pep-${last(split(cognitiveService.id, '/'))}-${privateEndpoint.?service ?? 'account'}-${index}'
-      privateLinkServiceConnections: privateEndpoint.?isManualConnection != true
-        ? [
-            {
-              name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(cognitiveService.id, '/'))}-${privateEndpoint.?service ?? 'account'}-${index}'
-              properties: {
-                privateLinkServiceId: cognitiveService.id
-                groupIds: [
-                  privateEndpoint.?service ?? 'account'
-                ]
-              }
-            }
-          ]
-        : null
-      manualPrivateLinkServiceConnections: privateEndpoint.?isManualConnection == true
-        ? [
-            {
-              name: privateEndpoint.?privateLinkServiceConnectionName ?? '${last(split(cognitiveService.id, '/'))}-${privateEndpoint.?service ?? 'account'}-${index}'
-              properties: {
-                privateLinkServiceId: cognitiveService.id
-                groupIds: [
-                  privateEndpoint.?service ?? 'account'
-                ]
-                requestMessage: privateEndpoint.?manualConnectionRequestMessage ?? 'Manual approval required.'
-              }
-            }
-          ]
-        : null
-      subnetResourceId: privateEndpoint.subnetResourceId
-      enableTelemetry: enableReferencedModulesTelemetry
-      location: privateEndpoint.?location ?? reference(
-        split(privateEndpoint.subnetResourceId, '/subnets/')[0],
-        '2020-06-01',
-        'Full'
-      ).location
-      lock: privateEndpoint.?lock ?? lock
-      privateDnsZoneGroup: privateEndpoint.?privateDnsZoneGroup
-      roleAssignments: privateEndpoint.?roleAssignments
-      tags: privateEndpoint.?tags ?? tags
-      customDnsConfigs: privateEndpoint.?customDnsConfigs
-      ipConfigurations: privateEndpoint.?ipConfigurations
-      applicationSecurityGroupResourceIds: privateEndpoint.?applicationSecurityGroupResourceIds
-      customNetworkInterfaceName: privateEndpoint.?customNetworkInterfaceName
-    }
-    dependsOn: [
-      cognitiveService_deployments
-    ]
-  }
-]
-
-resource cognitiveService_roleAssignments 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
-  for (roleAssignment, index) in (formattedRoleAssignments ?? []): {
-    name: roleAssignment.?name ?? guid(cognitiveService.id, roleAssignment.principalId, roleAssignment.roleDefinitionId)
-    properties: {
-      roleDefinitionId: roleAssignment.roleDefinitionId
-      principalId: roleAssignment.principalId
-      description: roleAssignment.?description
-      principalType: roleAssignment.?principalType
-      condition: roleAssignment.?condition
-      conditionVersion: !empty(roleAssignment.?condition) ? (roleAssignment.?conditionVersion ?? '2.0') : null // Must only be set if condtion is set
-      delegatedManagedIdentityResourceId: roleAssignment.?delegatedManagedIdentityResourceId
-    }
-    scope: cognitiveService
-  }
-]
-
-module aiProject 'project.bicep' = if(!empty(projectName) || !empty(existingFoundryProjectResourceId)) {
-  name: take('${name}-ai-project-${projectName}-deployment', 64)
-  params: {
-    name: projectName
-    desc: projectDescription
-    aiServicesName: cognitiveService.name
-    location: location
-    tags: tags
-    existingFoundryProjectResourceId: existingFoundryProjectResourceId
-  }
-  dependsOn: [
-    cognitiveService_deployments
-  ]
-}
-
-@description('The private endpoints of the congitive services account.')
-output privateEndpoints privateEndpointOutputType[] = [
-  for (pe, index) in (privateEndpoints ?? []): {
-    name: cognitiveService_privateEndpoints[index].outputs.name
-    resourceId: cognitiveService_privateEndpoints[index].outputs.resourceId
-    groupId: cognitiveService_privateEndpoints[index].outputs.?groupId!
-    customDnsConfigs: cognitiveService_privateEndpoints[index].outputs.customDnsConfigs
-    networkInterfaceResourceIds: cognitiveService_privateEndpoints[index].outputs.networkInterfaceResourceIds
-  }
-]
-
-import { aiProjectOutputType } from 'project.bicep'
-output aiProjectInfo aiProjectOutputType = aiProject!.outputs.aiProjectInfo
-
-// ================ //
-// Definitions      //
-// ================ //
-
-@export()
-@description('The type for the private endpoint output.')
-type privateEndpointOutputType = {
-  @description('The name of the private endpoint.')
-  name: string
-
-  @description('The resource ID of the private endpoint.')
-  resourceId: string
-
-  @description('The group Id for the private endpoint Group.')
-  groupId: string?
-
-  @description('The custom DNS configurations of the private endpoint.')
-  customDnsConfigs: {
-    @description('FQDN that resolves to private endpoint IP address.')
-    fqdn: string?
-
-    @description('A list of private IP addresses of the private endpoint.')
-    ipAddresses: string[]
-  }[]
-
-  @description('The IDs of the network interfaces associated with the private endpoint.')
-  networkInterfaceResourceIds: string[]
-}
-
-@export()
-@description('The type for a cognitive services account deployment.')
-type deploymentType = {
-  @description('Optional. Specify the name of cognitive service account deployment.')
-  name: string?
-
-  @description('Required. Properties of Cognitive Services account deployment model.')
-  model: {
-    @description('Required. The name of Cognitive Services account deployment model.')
-    name: string
-
-    @description('Required. The format of Cognitive Services account deployment model.')
-    format: string
-
-    @description('Required. The version of Cognitive Services account deployment model.')
-    version: string
-  }
-
-  @description('Optional. The resource model definition representing SKU.')
-  sku: {
-    @description('Required. The name of the resource model definition representing SKU.')
-    name: string
-
-    @description('Optional. The capacity of the resource model definition representing SKU.')
-    capacity: int?
-
-    @description('Optional. The tier of the resource model definition representing SKU.')
-    tier: string?
-
-    @description('Optional. The size of the resource model definition representing SKU.')
-    size: string?
-
-    @description('Optional. The family of the resource model definition representing SKU.')
-    family: string?
-  }?
-
-  @description('Optional. The name of RAI policy.')
-  raiPolicyName: string?
-
-  @description('Optional. The version upgrade option.')
-  versionUpgradeOption: string?
-}
-
-@export()
-@description('The type for a cognitive services account endpoint.')
-type endpointType = {
-  @description('Type of the endpoint.')
-  name: string?
-  @description('The endpoint URI.')
-  endpoint: string?
-}
diff --git a/infra/modules/deploy_aifp_aisearch_connection.bicep b/infra/modules/deploy_aifp_aisearch_connection.bicep
deleted file mode 100644
index 662a82c7c..000000000
--- a/infra/modules/deploy_aifp_aisearch_connection.bicep
+++ /dev/null
@@ -1,33 +0,0 @@
-@description('Required. Existing AI Project Name')
-param existingAIProjectName string
-
-@description('Required. Existing AI Foundry Name')
-param existingAIFoundryName string
-
-@description('Required. AI Search Name')
-param aiSearchName string
-
-@description('Required. AI Search Resource ID')
-param aiSearchResourceId string
-
-@description('Required. AI Search Location')
-param aiSearchLocation string
-
-@description('Required. AI Search Connection Name')
-param aiSearchConnectionName string
-
-
-resource projectAISearchConnection 'Microsoft.CognitiveServices/accounts/projects/connections@2025-10-01-preview' = {
-  name: '${existingAIFoundryName}/${existingAIProjectName}/${aiSearchConnectionName}'
-  properties: {
-    category: 'CognitiveSearch'
-    target: 'https://${aiSearchName}.search.windows.net'
-    authType: 'AAD'
-    isSharedToAll: true
-    metadata: {
-      ApiType: 'Azure'
-      ResourceId: aiSearchResourceId
-      location: aiSearchLocation
-    }
-  }
-}
diff --git a/infra/modules/project.bicep b/infra/modules/project.bicep
deleted file mode 100644
index 844f72366..000000000
--- a/infra/modules/project.bicep
+++ /dev/null
@@ -1,71 +0,0 @@
-@description('Required. Name of the AI Services project.')
-param name string
-
-@description('Required. The location of the Project resource.')
-param location string = resourceGroup().location
-
-@description('Optional. The description of the AI Foundry project to create. Defaults to the project name.')
-param desc string = name
-
-@description('Required. Name of the existing Cognitive Services resource to create the AI Foundry project in.')
-param aiServicesName string
-
-@description('Optional. Tags to be applied to the resources.')
-param tags object = {}
-
-@description('Optional. Use this parameter to use an existing AI project resource ID from different resource group')
-param existingFoundryProjectResourceId string = ''
-
-var useExistingProject = !empty(existingFoundryProjectResourceId)
-var existingProjName = useExistingProject ? last(split(existingFoundryProjectResourceId, '/')) : ''
-var existingAiFoundryAiServicesSubscriptionId = useExistingProject ? split(existingFoundryProjectResourceId, '/')[2] : ''
-var existingAiFoundryAiServicesResourceGroupName = useExistingProject ? split(existingFoundryProjectResourceId, '/')[4] : ''
-var existingAiFoundryAiServicesServiceName = useExistingProject ? split(existingFoundryProjectResourceId, '/')[8] : ''
-var existingProjEndpoint = useExistingProject ? format('https://{0}.services.ai.azure.com/api/projects/{1}', existingAiFoundryAiServicesServiceName, existingProjName) : ''
-
-resource cogServiceReference 'Microsoft.CognitiveServices/accounts@2025-06-01' existing = {
-  name: aiServicesName
-}
-
-resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-06-01' = if (!useExistingProject) {
-  parent: cogServiceReference
-  name: name
-  tags: tags
-  location: location
-  identity: {
-    type: 'SystemAssigned'
-  }
-  properties: {
-    description: desc
-    displayName: name
-  }
-}
-
-resource existingAiProject 'Microsoft.CognitiveServices/accounts/projects@2025-06-01' existing = if (useExistingProject) {
-  name: '${existingAiFoundryAiServicesServiceName}/${existingProjName}'
-  scope: resourceGroup(existingAiFoundryAiServicesSubscriptionId, existingAiFoundryAiServicesResourceGroupName)
-}
-
-@description('AI Project metadata including name, resource ID, and API endpoint.')
-output aiProjectInfo aiProjectOutputType = {
-  name: useExistingProject ? existingProjName : aiProject.name
-  resourceId: useExistingProject ? existingFoundryProjectResourceId : aiProject.id
-  apiEndpoint: useExistingProject ? existingProjEndpoint : aiProject!.properties.endpoints['AI Foundry API']
-  aiprojectSystemAssignedMIPrincipalId: useExistingProject ? existingAiProject!.identity.principalId : aiProject!.identity.principalId
-}
-
-@export()
-@description('Output type representing AI project information.')
-type aiProjectOutputType = {
-  @description('Required. Name of the AI project.')
-  name: string
-
-  @description('Required. Resource ID of the AI project.')
-  resourceId: string
-
-  @description('Required. API endpoint for the AI project.')
-  apiEndpoint: string
-
-  @description('Required. System Assigned Managed Identity Principal Id of the AI project.')
-  aiprojectSystemAssignedMIPrincipalId: string
-}
diff --git a/infra/modules/roles.bicep b/infra/modules/roles.bicep
deleted file mode 100644
index cd5317a61..000000000
--- a/infra/modules/roles.bicep
+++ /dev/null
@@ -1,251 +0,0 @@
-param openaiName string
-param searchName string
-param storageName string
-param cosmosName string
-param backendPrincipalId string
-
-@description('Principal ID of the frontend web app managed identity')
-param frontendPrincipalId string = ''
-
-@description('Name of the Azure Container Registry (empty if not using ACR)')
-param acrName string = ''
-
-@description('Principal ID of the deploying user (for local script access)')
-param deployerPrincipalId string = ''
-
-@description('Principal ID of the AI Foundry project managed identity (for agent search access)')
-param aiProjectPrincipalId string = ''
-
-// ========== Role Definition IDs ========== //
-var roles = {
-  cognitiveServicesOpenAIUser: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')
-  cognitiveServicesUser: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')
-  azureAIDeveloper: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')
-  searchIndexDataContributor: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')
-  searchServiceContributor: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')
-  searchIndexDataReader: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1407120a-92aa-4202-b7e9-c0e197c71c8f')
-  storageBlobDataContributor: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')
-  storageQueueDataContributor: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')
-  cosmosDBDataContributor: '00000000-0000-0000-0000-000000000002'
-  acrPull: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')
-  foundryUser: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d')
-}
-
-// ========== Backend App (ServicePrincipal) Roles ========== //
-
-resource openaiRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(openai.id, backendPrincipalId, roles.cognitiveServicesOpenAIUser)
-  scope: openai
-  properties: {
-    roleDefinitionId: roles.cognitiveServicesOpenAIUser
-    principalId: backendPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-resource foundryUserRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(openai.id, backendPrincipalId, roles.foundryUser)
-  scope: openai
-  properties: {
-    roleDefinitionId: roles.foundryUser
-    principalId: backendPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-resource searchRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(search.id, backendPrincipalId, roles.searchIndexDataContributor)
-  scope: search
-  properties: {
-    roleDefinitionId: roles.searchIndexDataContributor
-    principalId: backendPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-resource searchContribRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(search.id, backendPrincipalId, roles.searchServiceContributor)
-  scope: search
-  properties: {
-    roleDefinitionId: roles.searchServiceContributor
-    principalId: backendPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-resource searchOpenAIRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(openai.id, search.id, roles.cognitiveServicesOpenAIUser)
-  scope: openai
-  properties: {
-    roleDefinitionId: roles.cognitiveServicesOpenAIUser
-    principalId: search.identity.principalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-resource storageRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(storage.id, backendPrincipalId, roles.storageBlobDataContributor)
-  scope: storage
-  properties: {
-    roleDefinitionId: roles.storageBlobDataContributor
-    principalId: backendPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-resource storageQueueRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
-  name: guid(storage.id, backendPrincipalId, roles.storageQueueDataContributor)
-  scope: storage
-  properties: {
-    roleDefinitionId: roles.storageQueueDataContributor
-    principalId: backendPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-resource cosmosRole 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2024-05-15' = if (cosmosName != '') {
-  parent: cosmos
-  name: guid(cosmos.id, backendPrincipalId, roles.cosmosDBDataContributor)
-  properties: {
-    roleDefinitionId: '${cosmos.id}/sqlRoleDefinitions/${roles.cosmosDBDataContributor}'
-    principalId: backendPrincipalId
-    scope: cosmos.id
-  }
-}
-
-// ========== Deploying User Roles ========== //
-
-resource deployerAiDeveloperRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId)) {
-  name: guid(openai.id, deployerPrincipalId, roles.azureAIDeveloper)
-  scope: openai
-  properties: {
-    roleDefinitionId: roles.azureAIDeveloper
-    principalId: deployerPrincipalId
-    principalType: 'User'
-  }
-}
-
-resource deployerFoundryUserRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId)) {
-  name: guid(openai.id, deployerPrincipalId, roles.foundryUser)
-  scope: openai
-  properties: {
-    roleDefinitionId: roles.foundryUser
-    principalId: deployerPrincipalId
-    principalType: 'User'
-  }
-}
-
-resource deployerOpenaiRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId)) {
-  name: guid(openai.id, deployerPrincipalId, roles.cognitiveServicesOpenAIUser)
-  scope: openai
-  properties: {
-    roleDefinitionId: roles.cognitiveServicesOpenAIUser
-    principalId: deployerPrincipalId
-    principalType: 'User'
-  }
-}
-
-resource deployerSearchRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId)) {
-  name: guid(search.id, deployerPrincipalId, roles.searchIndexDataContributor)
-  scope: search
-  properties: {
-    roleDefinitionId: roles.searchIndexDataContributor
-    principalId: deployerPrincipalId
-    principalType: 'User'
-  }
-}
-
-resource deployerSearchContribRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId)) {
-  name: guid(search.id, deployerPrincipalId, roles.searchServiceContributor)
-  scope: search
-  properties: {
-    roleDefinitionId: roles.searchServiceContributor
-    principalId: deployerPrincipalId
-    principalType: 'User'
-  }
-}
-
-resource deployerStorageRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId)) {
-  name: guid(storage.id, deployerPrincipalId, roles.storageBlobDataContributor)
-  scope: storage
-  properties: {
-    roleDefinitionId: roles.storageBlobDataContributor
-    principalId: deployerPrincipalId
-    principalType: 'User'
-  }
-}
-
-resource deployerStorageQueueRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId)) {
-  name: guid(storage.id, deployerPrincipalId, roles.storageQueueDataContributor)
-  scope: storage
-  properties: {
-    roleDefinitionId: roles.storageQueueDataContributor
-    principalId: deployerPrincipalId
-    principalType: 'User'
-  }
-}
-
-// ========== AI Foundry Project Roles ========== //
-
-resource aiProjectSearchReaderRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiProjectPrincipalId)) {
-  name: guid(search.id, aiProjectPrincipalId, roles.searchIndexDataReader)
-  scope: search
-  properties: {
-    roleDefinitionId: roles.searchIndexDataReader
-    principalId: aiProjectPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-resource aiProjectSearchContribRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiProjectPrincipalId)) {
-  name: guid(search.id, aiProjectPrincipalId, roles.searchServiceContributor)
-  scope: search
-  properties: {
-    roleDefinitionId: roles.searchServiceContributor
-    principalId: aiProjectPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-// ========== Existing resource references ========== //
-resource openai 'Microsoft.CognitiveServices/accounts@2024-10-01' existing = {
-  name: openaiName
-}
-
-resource search 'Microsoft.Search/searchServices@2024-06-01-preview' existing = {
-  name: searchName
-}
-
-resource storage 'Microsoft.Storage/storageAccounts@2023-05-01' existing = {
-  name: storageName
-}
-
-resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2024-05-15' existing = if (!empty(cosmosName)) {
-  name: cosmosName
-}
-
-resource acr 'Microsoft.ContainerRegistry/registries@2023-07-01' existing = if (!empty(acrName)) {
-  name: acrName
-}
-
-// ========== ACR Pull Roles ========== //
-
-resource backendAcrPullRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(acrName)) {
-  name: guid(acr.id, backendPrincipalId, roles.acrPull)
-  scope: acr
-  properties: {
-    roleDefinitionId: roles.acrPull
-    principalId: backendPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
-
-resource frontendAcrPullRole 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(acrName) && !empty(frontendPrincipalId)) {
-  name: guid(acr.id, frontendPrincipalId, roles.acrPull)
-  scope: acr
-  properties: {
-    roleDefinitionId: roles.acrPull
-    principalId: frontendPrincipalId
-    principalType: 'ServicePrincipal'
-  }
-}
diff --git a/infra/modules/search.bicep b/infra/modules/search.bicep
deleted file mode 100644
index e057258e2..000000000
--- a/infra/modules/search.bicep
+++ /dev/null
@@ -1,34 +0,0 @@
-param name string
-param location string
-param tags object
-
-@description('SKU for the search service')
-@allowed(['free', 'basic', 'standard', 'standard2', 'standard3'])
-param skuName string = 'basic'
-
-resource search 'Microsoft.Search/searchServices@2024-06-01-preview' = {
-  name: name
-  location: location
-  tags: tags
-  identity: {
-    type: 'SystemAssigned'
-  }
-  sku: { name: skuName }
-  properties: {
-    replicaCount: 1
-    partitionCount: 1
-    hostingMode: 'default'
-    publicNetworkAccess: 'enabled'
-    semanticSearch: 'free'
-    authOptions: {
-      aadOrApiKey: {
-        aadAuthFailureMode: 'http401WithBearerChallenge'
-      }
-    }
-  }
-}
-
-output endpoint string = 'https://${name}.search.windows.net'
-output name string = search.name
-output id string = search.id
-output principalId string = search.identity.principalId
diff --git a/infra/modules/sql.bicep b/infra/modules/sql.bicep
deleted file mode 100644
index bfdda1d5e..000000000
--- a/infra/modules/sql.bicep
+++ /dev/null
@@ -1,66 +0,0 @@
-param serverName string
-param databaseName string
-param location string
-param tags object
-
-@description('Object ID of the Azure AD admin for the SQL server')
-param adminObjectId string = ''
-
-@description('Display name of the Azure AD admin')
-param adminLogin string = 'azd-admin'
-
-resource sqlServer 'Microsoft.Sql/servers@2023-08-01-preview' = {
-  name: serverName
-  location: location
-  tags: tags
-  properties: {
-    minimalTlsVersion: '1.2'
-    publicNetworkAccess: 'Enabled'
-    administrators: {
-      azureADOnlyAuthentication: true
-      administratorType: 'ActiveDirectory'
-      login: adminLogin
-      sid: adminObjectId
-      tenantId: subscription().tenantId
-    }
-  }
-}
-
-resource sqlDatabase 'Microsoft.Sql/servers/databases@2023-08-01-preview' = {
-  parent: sqlServer
-  name: databaseName
-  location: location
-  tags: tags
-  sku: {
-    name: 'Basic'
-    tier: 'Basic'
-    capacity: 5
-  }
-  properties: {
-    collation: 'SQL_Latin1_General_CP1_CI_AS'
-    maxSizeBytes: 2147483648 // 2GB
-  }
-}
-
-resource firewallRule 'Microsoft.Sql/servers/firewallRules@2025-01-01' = {
-  name: 'AllowSpecificRange'
-  parent: sqlServer
-  properties: {
-    startIpAddress: '0.0.0.0'
-    endIpAddress: '255.255.255.255'
-  }
-}
-
-// Allow Azure services to access
-resource AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2025-01-01' = {
-  name: 'AllowAllWindowsAzureIps'
-  parent: sqlServer
-  properties: {
-    startIpAddress: '0.0.0.0'
-    endIpAddress: '0.0.0.0'
-  }
-}
-
-output serverFqdn string = sqlServer.properties.fullyQualifiedDomainName
-output serverName string = sqlServer.name
-output databaseName string = sqlDatabase.name
diff --git a/infra/modules/storage.bicep b/infra/modules/storage.bicep
deleted file mode 100644
index 8cc85ab8c..000000000
--- a/infra/modules/storage.bicep
+++ /dev/null
@@ -1,42 +0,0 @@
-param name string
-param location string
-param tags object
-
-resource storageAccount 'Microsoft.Storage/storageAccounts@2023-05-01' = {
-  name: name
-  location: location
-  tags: tags
-  kind: 'StorageV2'
-  sku: { name: 'Standard_LRS' }
-  properties: {
-    minimumTlsVersion: 'TLS1_2'
-    allowBlobPublicAccess: false
-    supportsHttpsTrafficOnly: true
-    accessTier: 'Hot'
-  }
-}
-
-resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2023-05-01' = {
-  parent: storageAccount
-  name: 'default'
-}
-
-resource documentsContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01' = {
-  parent: blobService
-  name: 'documents'
-  properties: {
-    publicAccess: 'None'
-  }
-}
-
-resource cuTempContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01' = {
-  parent: blobService
-  name: 'cu-temp'
-  properties: {
-    publicAccess: 'None'
-  }
-}
-
-output accountName string = storageAccount.name
-output id string = storageAccount.id
-output primaryEndpoint string = storageAccount.properties.primaryEndpoints.blob
diff --git a/infra/modules/web-sites.bicep b/infra/modules/web-sites.bicep
deleted file mode 100644
index 9254e4539..000000000
--- a/infra/modules/web-sites.bicep
+++ /dev/null
@@ -1,187 +0,0 @@
-@description('Required. Name of the site.')
-param name string
-
-@description('Optional. Location for all Resources.')
-param location string = resourceGroup().location
-
-@description('Required. Type of site to deploy.')
-@allowed([
-  'functionapp'
-  'functionapp,linux'
-  'app,linux'
-  'app'
-  'app,linux,container'
-  'app,container,windows'
-])
-param kind string
-
-@description('Required. The resource ID of the app service plan to use for the site.')
-param serverFarmResourceId string
-
-@description('Optional. Configures a site to accept only HTTPS requests.')
-param httpsOnly bool = true
-
-@description('Optional. If client affinity is enabled.')
-param clientAffinityEnabled bool = true
-
-import { managedIdentityAllType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. The managed identity definition for this resource.')
-param managedIdentities managedIdentityAllType?
-
-@description('Optional. The site config object.')
-param siteConfig resourceInput<'Microsoft.Web/sites@2024-04-01'>.properties.siteConfig = {
-  alwaysOn: true
-  minTlsVersion: '1.2'
-  ftpsState: 'FtpsOnly'
-}
-
-@description('Optional. The web site config.')
-param configs appSettingsConfigType[]?
-
-import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. Configuration details for private endpoints.')
-param privateEndpoints privateEndpointSingleServiceType[]?
-
-@description('Optional. Tags of the resource.')
-param tags object?
-
-import { diagnosticSettingFullType } from 'br/public:avm/utl/types/avm-common-types:0.5.1'
-@description('Optional. The diagnostic settings of the service.')
-param diagnosticSettings diagnosticSettingFullType[]?
-
-@description('Optional. Whether or not public network access is allowed.')
-@allowed([
-  'Enabled'
-  'Disabled'
-])
-param publicNetworkAccess string?
-
-@description('Optional. Virtual Network Route All enabled.')
-param vnetRouteAllEnabled bool = false
-
-@description('Optional. To enable pulling image over Virtual Network.')
-param vnetImagePullEnabled bool = false
-
-@description('Optional. Azure Resource Manager ID of the Virtual network and subnet to be joined.')
-param virtualNetworkSubnetId string?
-
-var formattedUserAssignedIdentities = reduce(
-  map((managedIdentities.?userAssignedResourceIds ?? []), (id) => { '${id}': {} }),
-  {},
-  (cur, next) => union(cur, next)
-)
-
-var identity = !empty(managedIdentities)
-  ? {
-      type: (managedIdentities.?systemAssigned ?? false)
-        ? (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'SystemAssigned, UserAssigned' : 'SystemAssigned')
-        : (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'UserAssigned' : 'None')
-      userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
-    }
-  : null
-
-resource app 'Microsoft.Web/sites@2024-04-01' = {
-  name: name
-  location: location
-  kind: kind
-  tags: tags
-  identity: identity
-  properties: {
-    serverFarmId: serverFarmResourceId
-    clientAffinityEnabled: clientAffinityEnabled
-    httpsOnly: httpsOnly
-    virtualNetworkSubnetId: virtualNetworkSubnetId
-    siteConfig: siteConfig
-    vnetImagePullEnabled: vnetImagePullEnabled
-    vnetRouteAllEnabled: vnetRouteAllEnabled
-    publicNetworkAccess: !empty(publicNetworkAccess)
-      ? any(publicNetworkAccess)
-      : (!empty(privateEndpoints) ? 'Disabled' : 'Enabled')
-  }
-}
-
-module app_config './web-sites.config.bicep' = [
-  for (config, index) in (configs ?? []): {
-    name: '${uniqueString(deployment().name, location)}-Site-Config-${index}'
-    params: {
-      appName: app.name
-      name: config.name
-      applicationInsightResourceId: config.?applicationInsightResourceId
-      properties: config.?properties
-      currentAppSettings: config.?retainCurrentAppSettings ?? true && config.name == 'appsettings'
-        ? list('${app.id}/config/appsettings', '2023-12-01').properties
-        : {}
-    }
-  }
-]
-
-#disable-next-line use-recent-api-versions
-resource app_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = [
-  for (diagnosticSetting, index) in (diagnosticSettings ?? []): {
-    name: diagnosticSetting.?name ?? '${name}-diagnosticSettings'
-    properties: {
-      storageAccountId: diagnosticSetting.?storageAccountResourceId
-      workspaceId: diagnosticSetting.?workspaceResourceId
-      eventHubAuthorizationRuleId: diagnosticSetting.?eventHubAuthorizationRuleResourceId
-      eventHubName: diagnosticSetting.?eventHubName
-      metrics: [
-        for group in (diagnosticSetting.?metricCategories ?? [{ category: 'AllMetrics' }]): {
-          category: group.category
-          enabled: group.?enabled ?? true
-          timeGrain: null
-        }
-      ]
-      logs: [
-        for group in (diagnosticSetting.?logCategoriesAndGroups ?? [{ categoryGroup: 'allLogs' }]): {
-          categoryGroup: group.?categoryGroup
-          category: group.?category
-          enabled: group.?enabled ?? true
-        }
-      ]
-      marketplacePartnerId: diagnosticSetting.?marketplacePartnerResourceId
-      logAnalyticsDestinationType: diagnosticSetting.?logAnalyticsDestinationType
-    }
-    scope: app
-  }
-]
-
-@description('The name of the site.')
-output name string = app.name
-
-@description('The resource ID of the site.')
-output resourceId string = app.id
-
-@description('The resource group the site was deployed into.')
-output resourceGroupName string = resourceGroup().name
-
-@description('The principal ID of the system assigned identity.')
-output systemAssignedMIPrincipalId string? = app.?identity.?principalId
-
-@description('The location the resource was deployed into.')
-output location string = app.location
-
-@description('Default hostname of the app.')
-output defaultHostname string = app.properties.defaultHostName
-
-// ================ //
-// Definitions       //
-// ================ //
-
-@export()
-@description('The type of an app settings configuration.')
-type appSettingsConfigType = {
-  @description('Required. The type of config.')
-  name: 'appsettings'
-
-  @description('Optional. Resource ID of the application insight to leverage for this resource.')
-  applicationInsightResourceId: string?
-
-  @description('Optional. The retain the current app settings. Defaults to true.')
-  retainCurrentAppSettings: bool?
-
-  @description('Optional. The app settings key-value pairs.')
-  properties: {
-    @description('Required. An app settings key-value pair.')
-    *: string
-  }?
-}
diff --git a/infra/modules/web-sites.config.bicep b/infra/modules/web-sites.config.bicep
deleted file mode 100644
index 7d599f2ad..000000000
--- a/infra/modules/web-sites.config.bicep
+++ /dev/null
@@ -1,66 +0,0 @@
-metadata name = 'Site App Settings'
-metadata description = 'This module deploys a Site App Setting.'
-
-@description('Conditional. The name of the parent site resource.')
-param appName string
-
-@description('Required. The name of the config.')
-@allowed([
-  'appsettings'
-  'authsettings'
-  'authsettingsV2'
-  'azurestorageaccounts'
-  'backup'
-  'connectionstrings'
-  'logs'
-  'metadata'
-  'pushsettings'
-  'slotConfigNames'
-  'web'
-])
-param name string
-
-@description('Optional. The properties of the config.')
-param properties object = {}
-
-@description('Optional. Resource ID of the application insight to leverage for this resource.')
-param applicationInsightResourceId string?
-
-@description('Optional. The current app settings.')
-param currentAppSettings {
-  @description('Required. The key-values pairs of the current app settings.')
-  *: string
-} = {}
-
-var appInsightsValues = !empty(applicationInsightResourceId)
-  ? {
-      APPLICATIONINSIGHTS_CONNECTION_STRING: applicationInsights!.properties.ConnectionString
-    }
-  : {}
-
-var expandedProperties = union(currentAppSettings, properties, appInsightsValues)
-
-resource applicationInsights 'Microsoft.Insights/components@2020-02-02' existing = if (!empty(applicationInsightResourceId)) {
-  name: last(split(applicationInsightResourceId!, '/'))
-  scope: resourceGroup(split(applicationInsightResourceId!, '/')[2], split(applicationInsightResourceId!, '/')[4])
-}
-
-resource app 'Microsoft.Web/sites@2023-12-01' existing = {
-  name: appName
-}
-
-resource config 'Microsoft.Web/sites/config@2024-04-01' = {
-  parent: app
-  #disable-next-line BCP225
-  name: name
-  properties: expandedProperties
-}
-
-@description('The name of the site config.')
-output name string = config.name
-
-@description('The resource ID of the site config.')
-output resourceId string = config.id
-
-@description('The resource group the site config was deployed into.')
-output resourceGroupName string = resourceGroup().name
diff --git a/infra/scripts/build/build_and_push_images.ps1 b/infra/scripts/build/build_and_push_images.ps1
index 80f01db02..f46578cd7 100644
--- a/infra/scripts/build/build_and_push_images.ps1
+++ b/infra/scripts/build/build_and_push_images.ps1
@@ -9,22 +9,54 @@
     Docker is required. Configuration is resolved from the azd environment
     (ACR_NAME, ACR_LOGIN_SERVER, API_APP_NAME, FRONTEND_APP_NAME, image names/tags,
     RESOURCE_GROUP_NAME). After pushing, each App Service is pointed at its ACR
-    image and set to pull via managed identity, then restarted.
+    image and set to pull with its system-assigned managed identity, then restarted.
 .EXAMPLE
     bash/pwsh: ./infra/scripts/build/build_and_push_images.ps1
 #>
 
+param(
+    [string]$ResourceGroupName,
+    [string]$AcrName,
+    [string]$AcrLoginServer,
+    [string]$ApiAppName,
+    [string]$FrontendAppName,
+    [string]$BackendImageName,
+    [string]$BackendImageTag,
+    [string]$FrontendImageName,
+    [string]$FrontendImageTag
+)
+
 $ErrorActionPreference = "Stop"
 
 # Repo root is three levels up from this script (infra/scripts/build -> repo root)
 $repoRoot = (Resolve-Path (Join-Path $PSScriptRoot "../../..")).Path
 
+# azd may be unavailable in AVM / non-azd deployments; guard so callers can rely on
+# explicit parameters and resource-group auto-discovery instead.
+$azdAvailable = [bool](Get-Command azd -ErrorAction SilentlyContinue)
+
 function Get-AzdValue([string]$key) {
+    if (-not $azdAvailable) { return "" }
     $val = (azd env get-value $key 2>$null)
     if ($LASTEXITCODE -ne 0 -or -not $val -or $val -match 'ERROR|not found') { return "" }
     return $val.Trim()
 }
 
+# ── Auto-discovery helpers: resolve resource names from the resource group when
+#    not supplied explicitly and not available via azd (non-azd / AVM deployments). ──
+function Get-DiscoveredAcrName([string]$rg) {
+    if (-not $rg) { return "" }
+    $names = (az acr list --resource-group $rg --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    return (($names -split "`n") | Where-Object { $_ } | Select-Object -First 1).Trim()
+}
+function Get-DiscoveredWebAppName([string]$rg, [string]$prefix) {
+    if (-not $rg) { return "" }
+    $names = (az webapp list --resource-group $rg --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    return (($names -split "`n") | Where-Object { $_ -like "$prefix*" } | Select-Object -First 1).Trim()
+}
+
 Write-Host ""
 Write-Host "===============================================" -ForegroundColor Cyan
 Write-Host "  Build & Push Container Images" -ForegroundColor Cyan
@@ -42,16 +74,24 @@ if ($LASTEXITCODE -ne 0) {
     }
 }
 
-# ── Resolve configuration from azd environment ──
-$resourceGroup   = Get-AzdValue "RESOURCE_GROUP_NAME"
-$acrName         = Get-AzdValue "ACR_NAME"
-$acrLoginServer  = Get-AzdValue "ACR_LOGIN_SERVER"
-$backendImage    = Get-AzdValue "BACKEND_CONTAINER_IMAGE_NAME"
-$backendTag      = Get-AzdValue "BACKEND_CONTAINER_IMAGE_TAG"
-$frontendImage   = Get-AzdValue "FRONTEND_CONTAINER_IMAGE_NAME"
-$frontendTag     = Get-AzdValue "FRONTEND_CONTAINER_IMAGE_TAG"
-$backendApp      = Get-AzdValue "API_APP_NAME"
-$frontendApp     = Get-AzdValue "FRONTEND_APP_NAME"
+# ── Resolve configuration. When -ResourceGroupName is passed explicitly, treat it as
+#    the source of truth and do NOT read azd env: a local azd default env may point to
+#    a different deployment. Precedence: explicit param → (RG discovery | azd env). ──
+$rgProvided = [bool]$ResourceGroupName
+$resourceGroup   = if ($ResourceGroupName) { $ResourceGroupName } else { Get-AzdValue "RESOURCE_GROUP_NAME" }
+$acrName         = if ($AcrName) { $AcrName } elseif ($rgProvided) { "" } else { Get-AzdValue "ACR_NAME" }
+$acrLoginServer  = if ($AcrLoginServer) { $AcrLoginServer } elseif ($rgProvided) { "" } else { Get-AzdValue "ACR_LOGIN_SERVER" }
+$backendImage    = if ($BackendImageName) { $BackendImageName } elseif ($rgProvided) { "" } else { Get-AzdValue "BACKEND_CONTAINER_IMAGE_NAME" }
+$backendTag      = if ($BackendImageTag) { $BackendImageTag } elseif ($rgProvided) { "" } else { Get-AzdValue "BACKEND_CONTAINER_IMAGE_TAG" }
+$frontendImage   = if ($FrontendImageName) { $FrontendImageName } elseif ($rgProvided) { "" } else { Get-AzdValue "FRONTEND_CONTAINER_IMAGE_NAME" }
+$frontendTag     = if ($FrontendImageTag) { $FrontendImageTag } elseif ($rgProvided) { "" } else { Get-AzdValue "FRONTEND_CONTAINER_IMAGE_TAG" }
+$backendApp      = if ($ApiAppName) { $ApiAppName } elseif ($rgProvided) { "" } else { Get-AzdValue "API_APP_NAME" }
+$frontendApp     = if ($FrontendAppName) { $FrontendAppName } elseif ($rgProvided) { "" } else { Get-AzdValue "FRONTEND_APP_NAME" }
+
+# ── Auto-discovery from the resource group (when azd is bypassed/unavailable or didn't resolve a value) ──
+if (-not $acrName)     { $acrName     = Get-DiscoveredAcrName $resourceGroup }
+if (-not $backendApp)  { $backendApp  = Get-DiscoveredWebAppName $resourceGroup "api-" }
+if (-not $frontendApp) { $frontendApp = Get-DiscoveredWebAppName $resourceGroup "app-" }
 
 # ── Fallbacks / defaults ──
 if (-not $acrLoginServer -and $acrName) { $acrLoginServer = "$acrName.azurecr.io" }
@@ -61,9 +101,14 @@ if (-not $frontendImage) { $frontendImage = "km-app" }
 if (-not $frontendTag)   { $frontendTag   = "latest" }
 
 if (-not $acrName -or -not $backendApp -or -not $frontendApp) {
-    Write-Host "ERROR: Could not resolve ACR / App Service names from azd env." -ForegroundColor Red
-    Write-Host "       Ensure 'azd provision' (or 'azd up') has completed for this environment." -ForegroundColor Yellow
-    Write-Host "       Required azd outputs: ACR_NAME, API_APP_NAME, FRONTEND_APP_NAME." -ForegroundColor Yellow
+    Write-Host "ERROR: Could not resolve ACR / App Service names." -ForegroundColor Red
+    if ($azdAvailable) {
+        Write-Host "       Ensure 'azd provision' (or 'azd up') has completed for this environment," -ForegroundColor Yellow
+        Write-Host "       or pass -AcrName, -ApiAppName and -FrontendAppName explicitly." -ForegroundColor Yellow
+    } else {
+        Write-Host "       Auto-discovery from -ResourceGroupName '$resourceGroup' did not find them (expects a single ACR and" -ForegroundColor Yellow
+        Write-Host "       App Services named 'api-*'/'app-*'). Pass -AcrName, -ApiAppName and -FrontendAppName explicitly." -ForegroundColor Yellow
+    }
     exit 1
 }
 
@@ -98,6 +143,12 @@ function Update-WebAppImage([string]$appName, [string]$image, [string]$tag) {
     $fullImage = "$acrLoginServer/${image}:${tag}"
     Write-Host ""
     Write-Host "Pointing App Service '$appName' at '$fullImage'..." -ForegroundColor Yellow
+    # App Service pulls with its system-assigned managed identity (AcrPull granted in Bicep).
+    # Enable managed-identity pull first so the container config below needs no admin creds.
+    $webappId = (az webapp show --name $appName --resource-group $resourceGroup --query id -o tsv)
+    az resource update --ids "$webappId/config/web" `
+        --set properties.acrUseManagedIdentityCreds=true `
+        --output none 2>$null
     az webapp config container set `
         --name $appName `
         --resource-group $resourceGroup `
@@ -109,19 +160,31 @@ function Update-WebAppImage([string]$appName, [string]$image, [string]$tag) {
         Write-Host "ERROR: Failed to set container image on '$appName'." -ForegroundColor Red
         exit 1
     }
-    # Pull via managed identity (no admin credentials)
-    az resource update `
-        --resource-group $resourceGroup `
-        --namespace Microsoft.Web `
-        --resource-type sites `
-        --name $appName `
-        --set properties.siteConfig.acrUseManagedIdentityCreds=true `
-        --output none 2>$null
     Write-Host "Restarting App Service '$appName'..." -ForegroundColor Yellow
     az webapp restart --name $appName --resource-group $resourceGroup --output none
     Write-Host "App Service '$appName' updated." -ForegroundColor Green
 }
 
+function Wait-ForAppReady([string]$appName, [string]$healthPath = "/", [int]$timeoutSeconds = 300) {
+    $url = "https://$appName.azurewebsites.net$healthPath"
+    Write-Host "Waiting for '$appName' to become ready..." -ForegroundColor Yellow
+    $deadline = (Get-Date).AddSeconds($timeoutSeconds)
+    while ((Get-Date) -lt $deadline) {
+        try {
+            $response = Invoke-WebRequest -Uri $url -Method GET -TimeoutSec 10 -SkipHttpErrorCheck
+            if ($response.StatusCode -ge 200 -and $response.StatusCode -lt 500) {
+                Write-Host "'$appName' is ready." -ForegroundColor Green
+                return $true
+            }
+        } catch {
+            # Ignore transient errors (connection refused, 503, timeouts) while cold-starting.
+        }
+        Start-Sleep -Seconds 5
+    }
+    Write-Host "WARNING: '$appName' did not become ready within ${timeoutSeconds}s — continuing anyway." -ForegroundColor Yellow
+    return $false
+}
+
 # ── Build & push both images ──
 Build-Image $backendImage  $backendTag  $backendDockerfile  $backendContext
 Build-Image $frontendImage $frontendTag $frontendDockerfile $frontendContext
@@ -130,6 +193,11 @@ Build-Image $frontendImage $frontendTag $frontendDockerfile $frontendContext
 Update-WebAppImage $backendApp  $backendImage  $backendTag
 Update-WebAppImage $frontendApp $frontendImage $frontendTag
 
+# ── Wait for both apps to finish cold-starting on the new image
+Write-Host ""
+Wait-ForAppReady $backendApp "/api/health" | Out-Null
+Wait-ForAppReady $frontendApp "/" | Out-Null
+
 Write-Host ""
 Write-Host "===============================================" -ForegroundColor Green
 Write-Host "  Images built & pushed; App Services updated." -ForegroundColor Green
diff --git a/infra/scripts/post-provision/connect-data.ps1 b/infra/scripts/post-provision/connect-data.ps1
index b1de83cd5..14594b3ac 100644
--- a/infra/scripts/post-provision/connect-data.ps1
+++ b/infra/scripts/post-provision/connect-data.ps1
@@ -19,27 +19,61 @@ param(
     [string]$Database,
     [string]$Table,
     [string]$ConnectionString,
-    [string]$WorkspaceId
+    [string]$WorkspaceId,
+    # Resource group for non-azd / AVM deployments; inherited from the parent script.
+    [string]$ResourceGroupName
 )
 
 $ErrorActionPreference = "Stop"
 
+# azd may be unavailable in AVM / non-azd deployments; guard so callers can rely on
+# the -ResourceGroupName parameter and resource-group auto-discovery instead.
+$azdAvailable = [bool](Get-Command azd -ErrorAction SilentlyContinue)
+
 function Get-AzdEnvValue {
     param([string]$Name)
+    if (-not $azdAvailable) { return "" }
     $value = azd env get-value $Name 2>$null
     if (-not $value) { return "" }
     if ($value -is [string] -and $value.StartsWith("ERROR:")) { return "" }
     return "$value".Trim()
 }
 
+function Get-DiscoveredWebAppName {
+    param([string]$Rg, [string]$Prefix)
+    if (-not $Rg) { return "" }
+    $names = (az webapp list --resource-group $Rg --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    return (($names -split "`n") | Where-Object { $_ -like "$Prefix*" } | Select-Object -First 1).Trim()
+}
+
+# Hydrate this process's environment from the deployed API App Service settings so
+# create_agent.py reads that deployment's config. -Overwrite makes the RG the source of
+# truth, replacing stale session/.env values from a different environment.
+function Import-AppSettingsToEnv {
+    param([string]$AppName, [string]$Rg, [switch]$Overwrite)
+    if (-not $AppName -or -not $Rg) { return }
+    $json = (az webapp config appsettings list --name $AppName --resource-group $Rg -o json 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $json) { return }
+    try { $settings = $json | ConvertFrom-Json } catch { return }
+    foreach ($s in $settings) {
+        if ($s.name -and ($Overwrite -or -not (Test-Path "Env:$($s.name)"))) {
+            Set-Item -Path "Env:$($s.name)" -Value $s.value
+        }
+    }
+}
+
 function Sync-AgentSettingsToApi {
     param([string]$ProjectRoot)
 
-    $apiAppName = Get-AzdEnvValue -Name "API_APP_NAME"
-    $resourceGroup = Get-AzdEnvValue -Name "RESOURCE_GROUP_NAME"
+    # Explicit RG is authoritative — skip azd env (may point to a different deployment).
+    $rgProvided = [bool]$ResourceGroupName
+    $resourceGroup = if ($ResourceGroupName) { $ResourceGroupName } else { Get-AzdEnvValue -Name "RESOURCE_GROUP_NAME" }
     if (-not $resourceGroup) {
         $resourceGroup = Get-AzdEnvValue -Name "AZURE_RESOURCE_GROUP"
     }
+    $apiAppName = if ($rgProvided) { Get-DiscoveredWebAppName $resourceGroup "api-" } else { Get-AzdEnvValue -Name "API_APP_NAME" }
+    if (-not $apiAppName) { $apiAppName = Get-DiscoveredWebAppName $resourceGroup "api-" }
 
     $agentNameChat = Get-AzdEnvValue -Name "AGENT_NAME_CHAT"
     $agentNameTitle = Get-AzdEnvValue -Name "AGENT_NAME_TITLE"
@@ -108,7 +142,7 @@ if (-not (Test-Path $pipExe)) {
 
 # Ensure .env exists
 $envFile = Join-Path $projectRoot ".env"
-if (-not (Test-Path $envFile)) {
+if (-not (Test-Path $envFile) -and $azdAvailable) {
     Write-Host "No .env file found. Generating from azd..." -ForegroundColor Yellow
     Push-Location $projectRoot
     azd env get-values 2>$null | ForEach-Object {
@@ -117,6 +151,15 @@ if (-not (Test-Path $envFile)) {
     Pop-Location
 }
 
+# When an explicit resource group is provided it is the source of truth: hydrate this
+# process's environment from the deployed API app (overwrite) so create_agent.py targets
+# that deployment's Foundry project instead of a stale azd env / .env.
+$rgProvided = [bool]$ResourceGroupName
+if ($rgProvided) {
+    $rgApiAppName = Get-DiscoveredWebAppName $ResourceGroupName "api-"
+    Import-AppSettingsToEnv -AppName $rgApiAppName -Rg $ResourceGroupName -Overwrite
+}
+
 # Check Python dependencies
 $deps = @("azure-identity", "pyodbc")
 foreach ($dep in $deps) {
@@ -176,8 +219,9 @@ if ($resolvedSourceType -eq "azure_search") {
     $agentName = $agentName -replace '-{2,}', '-'   # collapse consecutive hyphens
     $agentName = $agentName.Substring(0, [Math]::Min($agentName.Length, 63)).TrimEnd('-')
 
-    # Read AZURE_AI_AGENT_ENDPOINT
-    $agentEndpoint = azd env get-value AZURE_AI_AGENT_ENDPOINT 2>$null
+    # Read AZURE_AI_AGENT_ENDPOINT. Explicit RG is authoritative — read from the hydrated
+    # environment (populated from the deployed API app) rather than a stale azd env / .env.
+    $agentEndpoint = if ($rgProvided) { $env:AZURE_AI_AGENT_ENDPOINT } else { azd env get-value AZURE_AI_AGENT_ENDPOINT 2>$null }
     if (-not $agentEndpoint) {
         $envFile = Join-Path $projectRoot ".env"
         if (Test-Path $envFile) {
@@ -258,8 +302,9 @@ elseif ($resolvedSourceType -eq "fabric") {
     $agentName = $agentName -replace '-{2,}', '-'   # collapse consecutive hyphens
     $agentName = $agentName.Substring(0, [Math]::Min($agentName.Length, 63)).TrimEnd('-')
 
-    # Read AZURE_AI_AGENT_ENDPOINT
-    $agentEndpoint = azd env get-value AZURE_AI_AGENT_ENDPOINT 2>$null
+    # Read AZURE_AI_AGENT_ENDPOINT. Explicit RG is authoritative — read from the hydrated
+    # environment (populated from the deployed API app) rather than a stale azd env / .env.
+    $agentEndpoint = if ($rgProvided) { $env:AZURE_AI_AGENT_ENDPOINT } else { azd env get-value AZURE_AI_AGENT_ENDPOINT 2>$null }
     if (-not $agentEndpoint) {
         $envFile = Join-Path $projectRoot ".env"
         if (Test-Path $envFile) {
diff --git a/infra/scripts/post-provision/create_agent.py b/infra/scripts/post-provision/create_agent.py
index ac396de6b..457a738d8 100644
--- a/infra/scripts/post-provision/create_agent.py
+++ b/infra/scripts/post-provision/create_agent.py
@@ -489,18 +489,59 @@ def create_agents(project_client, instructions, title_instructions, agent_tools)
 logger.info(f"Agent config saved to: {agent_ids_path}")
 
 # Persist agent names so the API and test scripts can find them.
-def set_azd_env(key, value):
-    """Set a key in the azd environment."""
-    import subprocess
-    subprocess.run(["azd", "env", "set", key, value], check=False,
-                   capture_output=True)
+# The azd write-back only applies to azd-based deployments. Pure Bicep/AVM
+# deployments have no azd environment: writing would otherwise hang on an
+# interactive prompt (azd installed, no env) or raise FileNotFoundError (azd
+# absent). setup-agent.ps1 syncs the API App Service from agent_ids.json, so
+# skipping the azd write-back is safe in the non-azd path.
+import shutil
+import subprocess
+
+
+def _azd_env_selected():
+    """True when azd is installed and a default environment is selected."""
+    if not shutil.which("azd"):
+        return False
+    try:
+        result = subprocess.run(
+            ["azd", "env", "get-value", "AZURE_ENV_NAME"],
+            check=False, capture_output=True, text=True,
+            stdin=subprocess.DEVNULL, timeout=15,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return False
+    out = (result.stdout or "").strip()
+    return result.returncode == 0 and bool(out) and not out.upper().startswith("ERROR")
+
+
+def set_azd_env(key, value, write_azd=True):
+    """Mirror a key into the process env, and into the azd env when available."""
     os.environ[key] = value
+    if not write_azd:
+        return
+    # stdin=DEVNULL + timeout guard against a hang if azd ever prompts.
+    try:
+        subprocess.run(
+            ["azd", "env", "set", key, value], check=False,
+            capture_output=True, stdin=subprocess.DEVNULL, timeout=30,
+        )
+    except (OSError, subprocess.SubprocessError):
+        pass
 
-set_azd_env("AGENT_NAME_CHAT", CHAT_AGENT_NAME)
-set_azd_env("AGENT_NAME_TITLE", TITLE_AGENT_NAME)
-set_azd_env("USE_SQL", str(USE_SQL))
-set_azd_env("DATA_SOURCE_TYPE", DATA_SOURCE_TYPE)
-logger.info(f"azd env set: AGENT_NAME_CHAT={CHAT_AGENT_NAME}, AGENT_NAME_TITLE={TITLE_AGENT_NAME}, USE_SQL={USE_SQL}, DATA_SOURCE_TYPE={DATA_SOURCE_TYPE}")
+
+_azd_available = _azd_env_selected()
+_agent_env = {
+    "AGENT_NAME_CHAT": CHAT_AGENT_NAME,
+    "AGENT_NAME_TITLE": TITLE_AGENT_NAME,
+    "USE_SQL": str(USE_SQL),
+    "DATA_SOURCE_TYPE": DATA_SOURCE_TYPE,
+}
+for _k, _v in _agent_env.items():
+    set_azd_env(_k, _v, write_azd=_azd_available)
+if _azd_available:
+    logger.info("azd env set: " + ", ".join(f"{k}={v}" for k, v in _agent_env.items()))
+else:
+    logger.info("azd environment not detected — skipping azd env write-back (App Service settings are synced separately).")
 
 # Write the agent values back into .env so the local backend picks them up
 # without needing azd. Existing keys are updated in-place; missing keys are appended.
diff --git a/infra/scripts/post-provision/enrich_byod_data.py b/infra/scripts/post-provision/enrich_byod_data.py
index b809cec9d..d6a37e320 100644
--- a/infra/scripts/post-provision/enrich_byod_data.py
+++ b/infra/scripts/post-provision/enrich_byod_data.py
@@ -403,17 +403,64 @@ def _store_enriched_metadata(self, enriched_docs: List[Dict[str, Any]], source_t
                 try:
                     doc_id = doc.get("id", "")
                     summary = doc.get("summary", "")
-                    entities = json.dumps(doc.get("entities", []))
-                    key_phrases = json.dumps(doc.get("key_phrases", []))
+                    raw_entities = doc.get("entities", [])
+                    raw_key_phrases = doc.get("key_phrases", [])
+                    entities = json.dumps(raw_entities)
+                    key_phrases = json.dumps(raw_key_phrases)
                     topic = doc.get("topic", "")
                     source_file = doc.get("title", "")
-                    
+
+                    # Runtime queries (agent SQL tool, insights facets, scope filters) read
+                    # JSON_VALUE(metadata, '$.field'); build the same metadata shape seeded
+                    # ingestion writes so BYOD rows are filterable the same way.
+                    entity_names = [
+                        e.get("name", "").strip()
+                        for e in raw_entities
+                        if isinstance(e, dict) and e.get("name")
+                    ]
+                    if not entity_names and isinstance(raw_entities, list):
+                        entity_names = [str(e).strip() for e in raw_entities if e]
+                    try:
+                        topics_list = (
+                            json.loads(topic)
+                            if isinstance(topic, str) and topic.strip().startswith("[")
+                            else ([topic] if topic else [])
+                        )
+                    except Exception:
+                        topics_list = [topic] if topic else []
+                    # Persist topics as a JSON array so SqlService.load_all_documents' json.loads succeeds.
+                    topics_json = json.dumps(topics_list)
+                    # topics/entities/key_phrases stay as arrays for the app's facet UI;
+                    # add scalar aliases (JSON_VALUE can't read arrays) so the agent's SQL
+                    # tool can GROUP BY a category the same way seeded scenarios do.
+                    primary_topic = topics_list[0] if topics_list else ""
+                    metadata_obj = {
+                        "source_type": source_type,
+                        "source": source_type,
+                        "source_file": source_file,
+                        "summary": summary,
+                        "topics": topics_list,
+                        "key_phrases": raw_key_phrases,
+                        "entities": entity_names,
+                    }
+                    # Carry over scalar source fields (e.g. sentiment, category) for facets.
+                    for meta_key, meta_value in doc.items():
+                        if meta_key in ("id", "text", "title", "summary", "entities", "key_phrases", "topic"):
+                            continue
+                        if isinstance(meta_value, (str, int, float, bool)) and meta_key not in metadata_obj:
+                            metadata_obj[meta_key] = meta_value
+                    # Only add scalar topic/category aliases when the source didn't already
+                    # supply them, so a real source category is never overwritten.
+                    metadata_obj.setdefault("topic", primary_topic)
+                    metadata_obj.setdefault("category", primary_topic)
+                    metadata = json.dumps(metadata_obj)
+
                     # Insert or update document with enrichment
                     cursor.execute("""
                         MERGE INTO documents AS target
-                        USING (VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)) AS source (
+                        USING (VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)) AS source (
                             id, source_type, summary, entities, key_phrases, topics, 
-                            source_file, text_content, doc_type
+                            source_file, text_content, doc_type, metadata
                         )
                         ON target.id = source.id
                         WHEN MATCHED THEN
@@ -422,16 +469,17 @@ def _store_enriched_metadata(self, enriched_docs: List[Dict[str, Any]], source_t
                                 entities = source.entities,
                                 key_phrases = source.key_phrases,
                                 topics = source.topics,
-                                source_file = source.source_file
+                                source_file = source.source_file,
+                                metadata = source.metadata
                         WHEN NOT MATCHED THEN
                             INSERT (id, source_type, summary, entities, key_phrases, topics, 
-                                    source_file, text_content, doc_type)
+                                    source_file, text_content, doc_type, metadata)
                             VALUES (source.id, source.source_type, source.summary, source.entities, 
                                     source.key_phrases, source.topics, source.source_file, 
-                                    source.text_content, source.doc_type);
+                                    source.text_content, source.doc_type, source.metadata);
                     """, (
-                        doc_id, source_type, summary, entities, key_phrases, topic,
-                        source_file, doc.get("text", ""), "byod"
+                        doc_id, source_type, summary, entities, key_phrases, topics_json,
+                        source_file, doc.get("text", ""), "byod", metadata
                     ))
                     
                 except Exception as e:
diff --git a/infra/scripts/post-provision/generate_agent_prompt.py b/infra/scripts/post-provision/generate_agent_prompt.py
index c4f3e0490..10dd00e4b 100644
--- a/infra/scripts/post-provision/generate_agent_prompt.py
+++ b/infra/scripts/post-provision/generate_agent_prompt.py
@@ -92,7 +92,7 @@
     print(f"Tools: {'SQL + Azure AI Search' if USE_SQL else 'Azure AI Search only'}")
 
 
-def build_prompt(name, description, use_sql, table, columns):
+def build_prompt(name, description, use_sql, table, columns, byod_search=False):
     sql_section = f"""        - Always use the **SQL tool** first for quantified, numerical, or metric-based queries.
             - **Always** use the **get_sql_response** function to execute queries.
             - Generate valid T-SQL queries using:
@@ -106,6 +106,17 @@ def build_prompt(name, description, use_sql, table, columns):
                 "**combined response** including all results in one structured answer.\n"
                 ) if use_sql else ""
 
+    # For azure_search BYOD the external index may lack the filter field entirely, so the
+    # Azure AI Search tool can return 0 results even when the data exists — make the SQL
+    # fallback mandatory there only. Seeded/other scenarios are left unchanged.
+    if byod_search and use_sql:
+        sql_fallback = """            - **IMPORTANT (this data source):** The Azure AI Search index may not contain the metadata fields used by the document filter, so the Azure AI Search tool can return **zero results even when the data exists**. A zero-result or \"no documents match the filter\" response from Azure AI Search is **NOT** a valid final answer.
+            - When Azure AI Search returns no results for a summary, topic, category, sentiment, content, or insight question, you **MUST** call **get_sql_response** and answer from the enriched `documents` table instead. Call **get_schema_and_sample_values** first to discover the exact field names, then use the `summary` column for content and, for topic/category grouping/counts, the scalar `JSON_VALUE(metadata, '$.topic')` or `JSON_VALUE(metadata, '$.category')` (the `topics`, `entities`, and `key_phrases` columns are JSON arrays — group or count them with `OPENJSON`, not `JSON_VALUE`).
+            - **Never** tell the user you could not find matching documents without first answering from **get_sql_response**.
+"""
+    else:
+        sql_fallback = ""
+
     return f"""You are a helpful assistant for the {name} scenario.
 
     {description}
@@ -118,7 +129,7 @@ def build_prompt(name, description, use_sql, table, columns):
             - Include citations inline using the exact format provided by the search tool (e.g., 【4:0†source】, 【4:1†source】).
             - **DO NOT** remove, modify, or omit any citation markers from your response - they must appear exactly as the search tool provides them.
             - Every fact, quote, or piece of information derived from search results must be immediately followed by its citation marker.
-
+{sql_fallback}
 {combined}
     Greeting Handling:
     - If the question is a greeting or polite phrase (e.g., "Hello", "Hi", "Good morning", "How are you?"), respond naturally and politely. You may greet and ask how you can assist.
@@ -177,7 +188,8 @@ def build_fabric_prompt(data_source_name, table_name=""):
     prompt_text = build_fabric_prompt(data_source_name, data_source_table)
 else:
     prompt_text = build_prompt(
-        scenario_name, scenario_desc, USE_SQL, SQL_TABLE, SQL_COLUMNS)
+        scenario_name, scenario_desc, USE_SQL, SQL_TABLE, SQL_COLUMNS,
+        byod_search=is_byod and data_source_type == "azure_search")
 
 os.makedirs(config_dir, exist_ok=True)
 with open(prompt_path, "w", encoding="utf-8") as f:
diff --git a/infra/scripts/post-provision/manage-network-access.ps1 b/infra/scripts/post-provision/manage-network-access.ps1
new file mode 100644
index 000000000..06eb2438d
--- /dev/null
+++ b/infra/scripts/post-provision/manage-network-access.ps1
@@ -0,0 +1,378 @@
+#!/usr/bin/env pwsh
+<#
+.SYNOPSIS
+    Temporarily enable / restore public network access on data-plane resources so
+    the post-provision scripts (image build/push, SQL role grant, data seeding)
+    can reach them when the environment was deployed with private endpoints
+    (enablePrivateNetworking = true).
+.DESCRIPTION
+    The post-provision hooks run from the deployer's machine, which has no network
+    path into the VNet's private endpoints. Container Registry, SQL Server, Storage
+    Account, Cosmos DB (when deployed), and the backend API App Service can have
+    public network access disabled.
+
+    -Action Enable:  inspects each resource's *current* publicNetworkAccess state
+                     and flips any that are Disabled to Enabled.
+    -Action Disable: for a private-networking (WAF) deployment — detected from the
+                     ENABLE_PRIVATE_NETWORKING azd output — unconditionally restores
+                     private-only access on every data-plane resource. No state file
+                     is required, so lock-down still works even if Enable ran in a
+                     different session (or not at all).
+
+    For a non-private deployment (enablePrivateNetworking = false) the resources are
+    meant to stay public, so Disable leaves them untouched (it only clears any
+    leftover temporary SQL firewall rule).
+
+    ACR and Storage also enforce a separate network rule set (defaultAction
+    Allow/Deny) on top of publicNetworkAccess — both are toggled together. SQL
+    Server has no such ruleset; instead a temporary named firewall rule
+    (azd-postprovision-temp, 0.0.0.0-255.255.255.255) is added and later removed.
+.EXAMPLE
+    ./infra/scripts/post-provision/manage-network-access.ps1 -Action Enable
+    ./infra/scripts/post-provision/manage-network-access.ps1 -Action Disable
+#>
+
+param(
+    [Parameter(Mandatory = $true)]
+    [ValidateSet("Enable", "Disable")]
+    [string]$Action,
+
+    # Resource group to operate on. When omitted, resolved from the azd environment.
+    # Required for non-azd / AVM deployments where no local azd env exists.
+    [string]$ResourceGroupName,
+
+    # Override private-networking (WAF) detection: "true" or "false". When omitted,
+    # resolved from the azd ENABLE_PRIVATE_NETWORKING output, then from the presence
+    # of private endpoints in the resource group.
+    [string]$EnablePrivateNetworking
+)
+
+$ErrorActionPreference = "Stop"
+
+# azd may be unavailable in AVM / non-azd deployments; guard so callers can rely on
+# -ResourceGroupName / -EnablePrivateNetworking and resource-group auto-discovery instead.
+$azdAvailable = [bool](Get-Command azd -ErrorAction SilentlyContinue)
+
+function Get-AzdValue([string]$key) {
+    if (-not $azdAvailable) { return "" }
+    $val = (azd env get-value $key 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $val -or $val -match 'ERROR|not found') { return "" }
+    return $val.Trim()
+}
+
+# When -ResourceGroupName is passed explicitly, treat it as the source of truth and do
+# NOT read azd env: a local azd default env may point to a different deployment.
+$rgProvided = [bool]$ResourceGroupName
+$resourceGroup = if ($ResourceGroupName) { $ResourceGroupName } else { Get-AzdValue "RESOURCE_GROUP_NAME" }
+if (-not $resourceGroup) {
+    Write-Host "  [SKIP] Resource group not provided and RESOURCE_GROUP_NAME not found in azd env — nothing to do." -ForegroundColor Yellow
+    Write-Host "         Pass -ResourceGroupName for non-azd / AVM deployments." -ForegroundColor Yellow
+    exit 0
+}
+
+# ── Discovery helpers: resolve resource names from the resource group when azd is
+#    unavailable / didn't provide them (non-azd / AVM deployments). ──
+function Get-FirstResourceName([string]$rg, [string]$azType) {
+    $names = (az resource list --resource-group $rg --resource-type $azType --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    return (($names -split "`n") | Where-Object { $_ } | Select-Object -First 1).Trim()
+}
+function Get-DiscoveredWebAppName([string]$rg, [string]$prefix) {
+    $names = (az webapp list --resource-group $rg --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    return (($names -split "`n") | Where-Object { $_ -like "$prefix*" } | Select-Object -First 1).Trim()
+}
+
+$acrName       = if ($rgProvided) { "" } else { Get-AzdValue "ACR_NAME" }
+$storageName   = if ($rgProvided) { "" } else { Get-AzdValue "AZURE_STORAGE_ACCOUNT" }
+$sqlServerFqdn = if ($rgProvided) { "" } else { Get-AzdValue "AZURE_SQL_SERVER" }
+$sqlServerName = if ($sqlServerFqdn) { $sqlServerFqdn.Split('.')[0] } else { "" }
+$cosmosEndpoint = if ($rgProvided) { "" } else { Get-AzdValue "AZURE_COSMOS_ENDPOINT" }
+$cosmosName    = ""
+if ($cosmosEndpoint -match 'https://([^.]+)\.') { $cosmosName = $Matches[1] }
+$apiAppName    = if ($rgProvided) { "" } else { Get-AzdValue "API_APP_NAME" }
+$frontendAppName = if ($rgProvided) { "" } else { Get-AzdValue "FRONTEND_APP_NAME" }
+
+# ── Auto-discover any names azd didn't provide (non-azd / AVM deployments) ──
+if (-not $acrName)         { $acrName         = Get-FirstResourceName $resourceGroup "Microsoft.ContainerRegistry/registries" }
+if (-not $storageName)     { $storageName     = Get-FirstResourceName $resourceGroup "Microsoft.Storage/storageAccounts" }
+if (-not $sqlServerName)   { $sqlServerName   = Get-FirstResourceName $resourceGroup "Microsoft.Sql/servers" }
+if (-not $cosmosName)      { $cosmosName      = Get-FirstResourceName $resourceGroup "Microsoft.DocumentDB/databaseAccounts" }
+if (-not $apiAppName)      { $apiAppName      = Get-DiscoveredWebAppName $resourceGroup "api-" }
+if (-not $frontendAppName) { $frontendAppName = Get-DiscoveredWebAppName $resourceGroup "app-" }
+
+$envName   = if ($rgProvided) { "" } else { Get-AzdValue "AZURE_ENV_NAME" }
+$stateFile = Join-Path ([System.IO.Path]::GetTempPath()) "km-network-access-state-$envName-$resourceGroup.json"
+
+# ── Resolve the private-networking (WAF) flag once: explicit param → azd env →
+#    presence of private endpoints in the resource group. ──
+function Test-PrivateEndpointsPresent([string]$rg) {
+    $pe = (az network private-endpoint list --resource-group $rg --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0) { return $false }
+    return [bool]($pe -and $pe.Trim())
+}
+if ($EnablePrivateNetworking) {
+    $isPrivateNetworking = ($EnablePrivateNetworking -match '^(?i:true)$')
+} else {
+    $azdFlag = if ($rgProvided) { "" } else { Get-AzdValue "ENABLE_PRIVATE_NETWORKING" }
+    if ($azdFlag) {
+        $isPrivateNetworking = ($azdFlag -match '^(?i:true)$')
+    } else {
+        $isPrivateNetworking = Test-PrivateEndpointsPresent $resourceGroup
+    }
+}
+
+# ── Resource-specific helpers: get / set publicNetworkAccess ──
+function Get-AcrPublicAccess([string]$name) {
+    (az acr show --name $name --resource-group $resourceGroup --query "publicNetworkAccess" -o tsv 2>$null)
+}
+function Set-AcrPublicAccess([string]$name, [string]$enabled) {
+    az acr update --name $name --resource-group $resourceGroup --public-network-enabled $enabled --output none
+}
+function Get-StoragePublicAccess([string]$name) {
+    (az storage account show --name $name --resource-group $resourceGroup --query "publicNetworkAccess" -o tsv 2>$null)
+}
+function Set-StoragePublicAccess([string]$name, [string]$value) {
+    az storage account update --name $name --resource-group $resourceGroup --public-network-access $value --output none
+}
+function Get-SqlPublicAccess([string]$name) {
+    (az sql server show --name $name --resource-group $resourceGroup --query "publicNetworkAccess" -o tsv 2>$null)
+}
+function Set-SqlPublicAccess([string]$name, [string]$enabled) {
+    az sql server update --name $name --resource-group $resourceGroup --enable-public-network $enabled --output none
+}
+function Get-CosmosPublicAccess([string]$name) {
+    (az cosmosdb show --name $name --resource-group $resourceGroup --query "publicNetworkAccess" -o tsv 2>$null)
+}
+function Set-CosmosPublicAccess([string]$name, [string]$value) {
+    az cosmosdb update --name $name --resource-group $resourceGroup --public-network-access $value --output none
+}
+function Get-ApiAppPublicAccess([string]$name) {
+    (az webapp show --name $name --resource-group $resourceGroup --query "publicNetworkAccess" -o tsv 2>$null)
+}
+function Set-ApiAppPublicAccess([string]$name, [string]$value) {
+    az webapp update --name $name --resource-group $resourceGroup --set publicNetworkAccess=$value --output none
+}
+
+# ── vnetRouteAllEnabled: routes the app's outbound traffic (incl. ACR image pulls)
+# through the VNet so it can reach private-endpoint resources. Toggled true only
+# for the enable window per user request; reverted to false on Disable. ──
+function Get-VnetRouteAll([string]$name) {
+    (az webapp show --name $name --resource-group $resourceGroup --query "siteConfig.vnetRouteAllEnabled" -o tsv 2>$null)
+}
+function Set-VnetRouteAll([string]$name, [string]$value) {
+    # `az webapp update --set siteConfig.vnetRouteAllEnabled=...` silently no-ops (property
+    # lives under /config/web, not the top-level site resource) — PATCH the config/web
+    # sub-resource directly instead.
+    $siteId = (az webapp show --name $name --resource-group $resourceGroup --query id -o tsv 2>$null)
+    if (-not $siteId) { $global:LASTEXITCODE = 1; return }
+    $tempFile = Join-Path ([System.IO.Path]::GetTempPath()) "vnetroute-$name-$([guid]::NewGuid()).json"
+    "{`"properties`":{`"vnetRouteAllEnabled`":$value}}" | Out-File -FilePath $tempFile -Encoding ascii -NoNewline
+    try {
+        az rest --method patch --uri "https://management.azure.com$siteId/config/web?api-version=2022-03-01" --body "@$tempFile" --headers "Content-Type=application/json" --output none
+    } finally {
+        Remove-Item -Force $tempFile -ErrorAction SilentlyContinue
+    }
+}
+
+# ── ACR / Storage also enforce a network rule set (defaultAction) independent of publicNetworkAccess ──
+function Get-AcrDefaultAction([string]$name) {
+    (az acr show --name $name --resource-group $resourceGroup --query "networkRuleSet.defaultAction" -o tsv 2>$null)
+}
+function Set-AcrDefaultAction([string]$name, [string]$value) {
+    az acr update --name $name --resource-group $resourceGroup --default-action $value --output none
+}
+function Get-StorageDefaultAction([string]$name) {
+    (az storage account show --name $name --resource-group $resourceGroup --query "networkRuleSet.defaultAction" -o tsv 2>$null)
+}
+function Set-StorageDefaultAction([string]$name, [string]$value) {
+    az storage account update --name $name --resource-group $resourceGroup --default-action $value --output none
+}
+
+# ── SQL Server has no defaultAction ruleset — use a temporary named firewall rule instead ──
+$sqlTempRuleName = "azd-postprovision-temp"
+function Test-SqlTempFirewallRule([string]$server) {
+    $rule = (az sql server firewall-rule show --resource-group $resourceGroup --server $server --name $sqlTempRuleName -o tsv 2>$null)
+    return [bool]$rule
+}
+function Add-SqlTempFirewallRule([string]$server) {
+    az sql server firewall-rule create --resource-group $resourceGroup --server $server --name $sqlTempRuleName --start-ip-address "0.0.0.0" --end-ip-address "255.255.255.255" --output none
+}
+function Remove-SqlTempFirewallRule([string]$server) {
+    az sql server firewall-rule delete --resource-group $resourceGroup --server $server --name $sqlTempRuleName --output none
+}
+
+Write-Host ""
+Write-Host "========================================" -ForegroundColor Cyan
+Write-Host "  Network Access: $Action" -ForegroundColor Cyan
+Write-Host "========================================" -ForegroundColor Cyan
+
+if ($Action -eq "Enable") {
+    # Only private-networking (WAF) deployments need public access temporarily opened.
+    # For a public deployment the resources are already reachable — skip entirely.
+    if (-not $isPrivateNetworking) {
+        Write-Host "  Skipping network configuration: this is not a private-networking (WAF) deployment. Resources are already publicly reachable." -ForegroundColor DarkGray
+        Write-Host ""
+        exit 0
+    }
+
+    $toggled = @()
+
+    $candidates = @(
+        @{ Name = "acr";     ResourceName = $acrName;       Get = { Get-AcrPublicAccess $acrName };           Set = { param($v) Set-AcrPublicAccess $acrName $v };       OnValue = "true";      OffValue = "false";     DisabledMatch = "Disabled" }
+        @{ Name = "storage"; ResourceName = $storageName;   Get = { Get-StoragePublicAccess $storageName };   Set = { param($v) Set-StoragePublicAccess $storageName $v }; OnValue = "Enabled";   OffValue = "Disabled";  DisabledMatch = "Disabled" }
+        @{ Name = "sql";     ResourceName = $sqlServerName; Get = { Get-SqlPublicAccess $sqlServerName };     Set = { param($v) Set-SqlPublicAccess $sqlServerName $v };   OnValue = "true";      OffValue = "false";     DisabledMatch = "Disabled" }
+        @{ Name = "cosmos";  ResourceName = $cosmosName;    Get = { Get-CosmosPublicAccess $cosmosName };     Set = { param($v) Set-CosmosPublicAccess $cosmosName $v };   OnValue = "Enabled";   OffValue = "Disabled";  DisabledMatch = "Disabled" }
+        @{ Name = "apiapp";  ResourceName = $apiAppName;    Get = { Get-ApiAppPublicAccess $apiAppName };     Set = { param($v) Set-ApiAppPublicAccess $apiAppName $v };   OnValue = "Enabled";   OffValue = "Disabled";  DisabledMatch = "Disabled" }
+        @{ Name = "frontendapp"; ResourceName = $frontendAppName; Get = { Get-ApiAppPublicAccess $frontendAppName }; Set = { param($v) Set-ApiAppPublicAccess $frontendAppName $v }; OnValue = "Enabled"; OffValue = "Disabled"; DisabledMatch = "Disabled" }
+        @{ Name = "api-vnetroute"; ResourceName = $apiAppName;      Get = { Get-VnetRouteAll $apiAppName };      Set = { param($v) Set-VnetRouteAll $apiAppName $v };      OnValue = "true"; OffValue = "false"; DisabledMatch = "false" }
+        @{ Name = "app-vnetroute"; ResourceName = $frontendAppName; Get = { Get-VnetRouteAll $frontendAppName };  Set = { param($v) Set-VnetRouteAll $frontendAppName $v }; OnValue = "true"; OffValue = "false"; DisabledMatch = "false" }
+    )
+
+    foreach ($c in $candidates) {
+        if (-not $c.ResourceName) {
+            Write-Host "  [SKIP] $($c.Name): not deployed in this environment." -ForegroundColor DarkGray
+            continue
+        }
+        $current = & $c.Get
+        if (-not $current) {
+            Write-Host "  [SKIP] $($c.Name) '$($c.ResourceName)': could not read current state (resource not found?)." -ForegroundColor Yellow
+            continue
+        }
+        if ($current -eq $c.DisabledMatch) {
+            Write-Host "  Enabling public network access on $($c.Name) '$($c.ResourceName)'..." -ForegroundColor Yellow
+            & $c.Set $c.OnValue
+            if ($LASTEXITCODE -eq 0) {
+                Write-Host "    [OK] Enabled." -ForegroundColor Green
+                $toggled += $c.Name
+            } else {
+                Write-Host "    [WARN] Failed to enable public access on $($c.Name)." -ForegroundColor Yellow
+            }
+        } else {
+            Write-Host "  [OK] $($c.Name) '$($c.ResourceName)' already public (state: $current) — no change needed." -ForegroundColor DarkGray
+        }
+    }
+
+    # Give Azure time to propagate the publicNetworkAccess changes above before
+    # attempting dependent operations (e.g. SQL rejects firewall-rule writes
+    # while it still considers the public network interface disabled). SQL in
+    # particular can take a couple of minutes, so poll its actual state rather
+    # than using a fixed sleep.
+    if ($toggled.Count -gt 0) {
+        Write-Host ""
+        Write-Host "Waiting for publicNetworkAccess changes to propagate..." -ForegroundColor Yellow
+        Start-Sleep -Seconds 30
+        if ($sqlServerName -and ($toggled -contains "sql")) {
+            $deadline = (Get-Date).AddMinutes(5)
+            while ((Get-Date) -lt $deadline) {
+                $sqlState = Get-SqlPublicAccess $sqlServerName
+                if ($sqlState -eq "Enabled") { break }
+                Write-Host "  ...sql still reports '$sqlState', waiting 15s more..." -ForegroundColor DarkGray
+                Start-Sleep -Seconds 15
+            }
+        }
+    }
+
+    # ── ACR / Storage network rule set (defaultAction) — separate gate from publicNetworkAccess ──
+    $ruleCandidates = @(
+        @{ Name = "acr-rule";     ResourceName = $acrName;     Get = { Get-AcrDefaultAction $acrName };         Set = { param($v) Set-AcrDefaultAction $acrName $v } }
+        @{ Name = "storage-rule"; ResourceName = $storageName; Get = { Get-StorageDefaultAction $storageName }; Set = { param($v) Set-StorageDefaultAction $storageName $v } }
+    )
+    foreach ($c in $ruleCandidates) {
+        if (-not $c.ResourceName) { continue }
+        $current = & $c.Get
+        if ($current -eq "Deny") {
+            Write-Host "  Opening firewall (default-action) on $($c.Name -replace '-rule','') '$($c.ResourceName)'..." -ForegroundColor Yellow
+            & $c.Set "Allow"
+            if ($LASTEXITCODE -eq 0) {
+                Write-Host "    [OK] Allowed." -ForegroundColor Green
+                $toggled += $c.Name
+            } else {
+                Write-Host "    [WARN] Failed to open firewall on $($c.Name)." -ForegroundColor Yellow
+            }
+        }
+    }
+
+    # ── SQL Server: add a temporary broad firewall rule (no defaultAction concept on SQL) ──
+    if ($sqlServerName) {
+        if (-not (Test-SqlTempFirewallRule $sqlServerName)) {
+            Write-Host "  Adding temporary firewall rule on sql '$sqlServerName'..." -ForegroundColor Yellow
+            $sqlRetries = 0
+            do {
+                Add-SqlTempFirewallRule $sqlServerName
+                if ($LASTEXITCODE -ne 0 -and $sqlRetries -lt 4) {
+                    Write-Host "    ...not ready yet, retrying in 20s..." -ForegroundColor DarkGray
+                    Start-Sleep -Seconds 20
+                }
+                $sqlRetries++
+            } while ($LASTEXITCODE -ne 0 -and $sqlRetries -le 4)
+            if ($LASTEXITCODE -eq 0) {
+                Write-Host "    [OK] Temporary firewall rule added." -ForegroundColor Green
+                $toggled += "sql-firewall"
+            } else {
+                Write-Host "    [WARN] Failed to add temporary SQL firewall rule." -ForegroundColor Yellow
+            }
+        } else {
+            Write-Host "  [OK] Temporary SQL firewall rule already present." -ForegroundColor DarkGray
+        }
+    }
+
+    if ($toggled.Count -gt 0) {
+        ConvertTo-Json -InputObject @{ resourceGroup = $resourceGroup; toggled = $toggled } | Set-Content -Path $stateFile -Encoding utf8
+    } else {
+        Write-Host "  No resources needed a network change." -ForegroundColor DarkGray
+        Remove-Item -Force $stateFile -ErrorAction SilentlyContinue
+    }
+}
+else {
+    # Disable: lock down based on whether this is a private-networking (WAF) deployment,
+    # not on a state file — so revert works regardless of how/where Enable ran.
+    Remove-Item -Force $stateFile -ErrorAction SilentlyContinue
+
+    if (-not $isPrivateNetworking) {
+        Write-Host "  Skipping network lockdown: this is not a private-networking (WAF) deployment. Resources are intended to remain public." -ForegroundColor DarkGray
+        # Best-effort: clear any leftover temporary SQL firewall rule from an Enable run.
+        if ($sqlServerName -and (Test-SqlTempFirewallRule $sqlServerName)) {
+            Write-Host "  Removing leftover temporary SQL firewall rule on SQL server '$sqlServerName'..." -ForegroundColor Yellow
+            Remove-SqlTempFirewallRule $sqlServerName
+        }
+        Write-Host ""
+        exit 0
+    }
+
+    Write-Host "  Private-networking (WAF) deployment detected. Enforcing private-only access on all data-plane resources." -ForegroundColor Yellow
+
+    # publicNetworkAccess → Disabled/false. vnetRouteAllEnabled is intentionally left
+    # true (required for the App Services to reach private-endpoint resources).
+    $reverts = @(
+        @{ Name = "Container Registry";      ResourceName = $acrName;         Action = { Set-AcrPublicAccess $acrName "false" } }
+        @{ Name = "Storage account";         ResourceName = $storageName;     Action = { Set-StoragePublicAccess $storageName "Disabled" } }
+        @{ Name = "SQL server";              ResourceName = $sqlServerName;    Action = { Set-SqlPublicAccess $sqlServerName "false" } }
+        @{ Name = "Cosmos DB";               ResourceName = $cosmosName;      Action = { Set-CosmosPublicAccess $cosmosName "Disabled" } }
+        @{ Name = "API app";                 ResourceName = $apiAppName;      Action = { Set-ApiAppPublicAccess $apiAppName "Disabled" } }
+        # Frontend app is intentionally left public — it's the user-facing UI and must stay reachable.
+        @{ Name = "Container Registry firewall"; ResourceName = $acrName;     Action = { Set-AcrDefaultAction $acrName "Deny" } }
+        @{ Name = "Storage account firewall";    ResourceName = $storageName; Action = { Set-StorageDefaultAction $storageName "Deny" } }
+    )
+    foreach ($r in $reverts) {
+        if (-not $r.ResourceName) { continue }
+        Write-Host "  Disabling public network access on $($r.Name) '$($r.ResourceName)'..." -ForegroundColor Yellow
+        & $r.Action
+        if ($LASTEXITCODE -eq 0) {
+            Write-Host "    [OK] Public access disabled." -ForegroundColor Green
+        } else {
+            Write-Host "    [WARN] Could not disable public access on $($r.Name). Please disable it manually in the Azure portal." -ForegroundColor Yellow
+        }
+    }
+
+    # SQL has no defaultAction ruleset — remove the temporary broad firewall rule if present.
+    if ($sqlServerName -and (Test-SqlTempFirewallRule $sqlServerName)) {
+        Write-Host "  Removing temporary SQL firewall rule on SQL server '$sqlServerName'..." -ForegroundColor Yellow
+        Remove-SqlTempFirewallRule $sqlServerName
+        if ($LASTEXITCODE -eq 0) { Write-Host "    [OK] Temporary SQL firewall rule removed." -ForegroundColor Green }
+        else { Write-Host "    [WARN] Could not remove the temporary SQL firewall rule. Please remove it manually in the Azure portal." -ForegroundColor Yellow }
+    }
+}
+
+Write-Host ""
+exit 0
diff --git a/infra/scripts/post-provision/setup-agent.ps1 b/infra/scripts/post-provision/setup-agent.ps1
index cb2ac9000..706fa306d 100644
--- a/infra/scripts/post-provision/setup-agent.ps1
+++ b/infra/scripts/post-provision/setup-agent.ps1
@@ -12,17 +12,62 @@
 #>
 
 param(
-    [string]$Scenario
+    [string]$Scenario,
+    [string]$ResourceGroupName,
+    [string]$ApiAppName
 )
 
+# azd may be unavailable in AVM / non-azd deployments; guard so callers can rely on
+# explicit parameters and resource-group auto-discovery instead.
+$azdAvailable = [bool](Get-Command azd -ErrorAction SilentlyContinue)
+
 function Get-AzdEnvValue {
     param([string]$Name)
+    if (-not $azdAvailable) { return "" }
     $value = azd env get-value $Name 2>$null
     if (-not $value) { return "" }
     if ($value -is [string] -and $value.StartsWith("ERROR:")) { return "" }
     return "$value".Trim()
 }
 
+function Get-DiscoveredWebAppName {
+    param([string]$Rg, [string]$Prefix)
+    if (-not $Rg) { return "" }
+    $names = (az webapp list --resource-group $Rg --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    return (($names -split "`n") | Where-Object { $_ -like "$Prefix*" } | Select-Object -First 1).Trim()
+}
+
+# For non-azd / AVM deployments (no local .env), hydrate this process's environment
+# from the deployed API App Service settings so create_agent.py can read them.
+# -Overwrite makes the RG the source of truth: it replaces stale session/.env values
+# (e.g. leftovers from a previous run against a different environment).
+function Import-AppSettingsToEnv {
+    param([string]$AppName, [string]$Rg, [switch]$Overwrite)
+    if (-not $AppName -or -not $Rg) { return }
+    $json = (az webapp config appsettings list --name $AppName --resource-group $Rg -o json 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $json) { return }
+    try { $settings = $json | ConvertFrom-Json } catch { return }
+    foreach ($s in $settings) {
+        if ($s.name -and ($Overwrite -or -not (Test-Path "Env:$($s.name)"))) {
+            Set-Item -Path "Env:$($s.name)" -Value $s.value
+        }
+    }
+}
+
+# ── Resolve resource group / API app. When -ResourceGroupName is passed explicitly, treat
+#    it as the source of truth and do NOT read azd env (which may point to a different env). ──
+$rgProvided = [bool]$ResourceGroupName
+$resourceGroup = if ($ResourceGroupName) { $ResourceGroupName } else { Get-AzdEnvValue -Name "RESOURCE_GROUP_NAME" }
+if (-not $resourceGroup) { $resourceGroup = Get-AzdEnvValue -Name "AZURE_RESOURCE_GROUP" }
+$apiAppName = if ($ApiAppName) { $ApiAppName } elseif ($rgProvided) { Get-DiscoveredWebAppName $resourceGroup "api-" } else { Get-AzdEnvValue -Name "API_APP_NAME" }
+if (-not $apiAppName) { $apiAppName = Get-DiscoveredWebAppName $resourceGroup "api-" }
+
+# Explicit RG: hydrate config from that deployment's API app so a stale local .env
+# (from a different azd environment) cannot leak into agent creation. Overwrite so the
+# RG wins over any pre-existing session env var or stale .env value.
+if ($rgProvided) { Import-AppSettingsToEnv -AppName $apiAppName -Rg $resourceGroup -Overwrite }
+
 Write-Host ""
 Write-Host "========================================" -ForegroundColor Cyan
 Write-Host "  Knowledge Mining - Agent Setup" -ForegroundColor Cyan
@@ -31,27 +76,31 @@ Write-Host ""
 
 $envFile = Join-Path $PSScriptRoot ".." ".." ".." ".env"
 if (-not (Test-Path $envFile)) {
-    Write-Host "WARNING: .env file not found. Trying azd env values..." -ForegroundColor Yellow
+    Write-Host "WARNING: .env file not found. Resolving configuration from the deployment..." -ForegroundColor Yellow
 
-    # Try to get values from azd
-    $endpoint = azd env get-value AZURE_AI_AGENT_ENDPOINT 2>$null
+    $endpoint = Get-AzdEnvValue -Name "AZURE_AI_AGENT_ENDPOINT"
+    if (-not $endpoint) {
+        # Non-azd / AVM deployment: hydrate from the deployed API App Service settings.
+        Import-AppSettingsToEnv -AppName $apiAppName -Rg $resourceGroup
+        $endpoint = $env:AZURE_AI_AGENT_ENDPOINT
+    }
     if (-not $endpoint) {
         Write-Host "ERROR: AZURE_AI_AGENT_ENDPOINT not set." -ForegroundColor Red
-        Write-Host "Set it in .env or run: azd env set AZURE_AI_AGENT_ENDPOINT <value>" -ForegroundColor Yellow
+        Write-Host "Set it in .env, run 'azd env set AZURE_AI_AGENT_ENDPOINT <value>', or pass -ResourceGroupName so it can be read from the deployed API app." -ForegroundColor Yellow
         exit 1
     }
 }
 
-# Activate venv if available
-$venvPath = Join-Path $PSScriptRoot ".." ".." ".." "venv" "Scripts" "Activate.ps1"
-if (Test-Path $venvPath) {
-    & $venvPath
-}
+# Resolve the Python interpreter — prefer the project virtual environment, which
+# has the pinned SDK versions (requirements.txt). Fall back to PATH python.
+$projectRoot = (Resolve-Path (Join-Path $PSScriptRoot ".." ".." "..")).Path
+$pythonExe = Join-Path $projectRoot ".venv\Scripts\python.exe"
+if (-not (Test-Path $pythonExe)) { $pythonExe = "python" }
 
 Write-Host "Generating scenario-based agent prompt..." -ForegroundColor Yellow
 $genArgs = @()
 if ($Scenario) { $genArgs += @("--scenario", $Scenario) }
-python (Join-Path $PSScriptRoot "generate_agent_prompt.py") @genArgs
+& $pythonExe (Join-Path $PSScriptRoot "generate_agent_prompt.py") @genArgs
 if ($LASTEXITCODE -ne 0) {
     Write-Host "Prompt generation failed." -ForegroundColor Red
     exit 1
@@ -60,7 +109,7 @@ if ($LASTEXITCODE -ne 0) {
 Write-Host "Creating agents..." -ForegroundColor Yellow
 $createArgs = @()
 if ($Scenario) { $createArgs += @("--scenario", $Scenario) }
-python (Join-Path $PSScriptRoot "create_agent.py") @createArgs
+& $pythonExe (Join-Path $PSScriptRoot "create_agent.py") @createArgs
 
 if ($LASTEXITCODE -eq 0) {
     Write-Host ""
@@ -69,15 +118,25 @@ if ($LASTEXITCODE -eq 0) {
 
     # Push the freshly created agent settings to the API App Service so the
     # running backend picks up AGENT_NAME_CHAT / AGENT_NAME_TITLE / USE_SQL.
-    $apiAppName    = Get-AzdEnvValue -Name "API_APP_NAME"
-    $resourceGroup = Get-AzdEnvValue -Name "RESOURCE_GROUP_NAME"
-    if (-not $resourceGroup) {
-        $resourceGroup = Get-AzdEnvValue -Name "AZURE_RESOURCE_GROUP"
+    # $resourceGroup and $apiAppName were resolved above (param → azd env → RG discovery).
+    $agentNameChat  = if ($rgProvided) { "" } else { Get-AzdEnvValue -Name "AGENT_NAME_CHAT" }
+    $agentNameTitle = if ($rgProvided) { "" } else { Get-AzdEnvValue -Name "AGENT_NAME_TITLE" }
+    $useSql         = if ($rgProvided) { "" } else { Get-AzdEnvValue -Name "USE_SQL" }
+    $dataSourceType = if ($rgProvided) { "" } else { Get-AzdEnvValue -Name "DATA_SOURCE_TYPE" }
+
+    # Fallback (non-azd / AVM): read what create_agent.py just wrote to agent_ids.json.
+    if (-not $agentNameChat -or -not $agentNameTitle) {
+        $agentIdsPath = Join-Path $projectRoot "data" "config" "agent_ids.json"
+        if (Test-Path $agentIdsPath) {
+            try {
+                $agentIds = Get-Content $agentIdsPath -Raw | ConvertFrom-Json
+                if (-not $agentNameChat)  { $agentNameChat  = $agentIds.chat_agent_name }
+                if (-not $agentNameTitle) { $agentNameTitle = $agentIds.title_agent_name }
+                if (-not $useSql)         { $useSql         = [string]$agentIds.use_sql }
+                if (-not $dataSourceType) { $dataSourceType = $agentIds.data_source_type }
+            } catch {}
+        }
     }
-    $agentNameChat  = Get-AzdEnvValue -Name "AGENT_NAME_CHAT"
-    $agentNameTitle = Get-AzdEnvValue -Name "AGENT_NAME_TITLE"
-    $useSql         = Get-AzdEnvValue -Name "USE_SQL"
-    $dataSourceType = Get-AzdEnvValue -Name "DATA_SOURCE_TYPE"
 
     if ($apiAppName -and $resourceGroup) {
         Write-Host "Updating API App Service '$apiAppName' agent settings..." -ForegroundColor Yellow
@@ -93,7 +152,7 @@ if ($LASTEXITCODE -eq 0) {
             $global:LASTEXITCODE = 0
         }
     } else {
-        Write-Host "  [SKIP] API_APP_NAME / RESOURCE_GROUP_NAME not found in azd env" -ForegroundColor Yellow
+        Write-Host "  [SKIP] Could not resolve API app / resource group; skipping App Service settings sync" -ForegroundColor Yellow
     }
 
     Write-Host ""
diff --git a/infra/scripts/post-provision/setup-data.ps1 b/infra/scripts/post-provision/setup-data.ps1
index 6e7cbc3b0..825d9afaf 100644
--- a/infra/scripts/post-provision/setup-data.ps1
+++ b/infra/scripts/post-provision/setup-data.ps1
@@ -43,7 +43,11 @@ param(
     [string]$ConnectionString,
 
     [string]$BackendUrl = "http://localhost:8000",
-    [switch]$AllowDeployedFallback
+    [switch]$AllowDeployedFallback,
+
+    # Resource group for non-azd / AVM deployments; used to auto-discover the
+    # deployed backend and threaded down to child scripts (setup-agent/connect-data).
+    [string]$ResourceGroupName
 )
 
 $ErrorActionPreference = "Stop"
@@ -56,9 +60,46 @@ Write-Host ""
 
 $projectRoot = (Resolve-Path (Join-Path $PSScriptRoot "../../..")).Path
 
-# Read a deploy value from azd env, falling back to the project .env
+# Resolve the Python interpreter — prefer the project virtual environment, which
+# has the pinned SDK versions (requirements.txt). Fall back to PATH python.
+$pythonExe = Join-Path $projectRoot ".venv\Scripts\python.exe"
+if (-not (Test-Path $pythonExe)) { $pythonExe = "python" }
+# Cache of the deployed backend's app settings, populated once per resource group.
+$script:RgAppSettingsCache = $null
+
+# Read every app setting from the api-* App Service in the resource group (cached).
+# This is the source of truth when a resource group is targeted explicitly.
+function Get-RgAppSettings {
+    param([string]$Rg)
+    if (-not $Rg) { return @{} }
+    if ($null -ne $script:RgAppSettingsCache) { return $script:RgAppSettingsCache }
+
+    $settings = @{}
+    $names = (az webapp list --resource-group $Rg --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -eq 0 -and $names) {
+        $apiApp = (($names -split "`n") | Where-Object { $_ -like "api-*" } | Select-Object -First 1)
+        if ($apiApp) {
+            $json = (az webapp config appsettings list --name $apiApp.Trim() --resource-group $Rg -o json 2>$null)
+            if ($LASTEXITCODE -eq 0 -and $json) {
+                try { foreach ($kv in ($json | ConvertFrom-Json)) { $settings[$kv.name] = $kv.value } } catch {}
+            }
+        }
+    }
+    $script:RgAppSettingsCache = $settings
+    return $settings
+}
+
 function Get-DeployValue {
     param([string]$Name)
+
+    # When a resource group is targeted, config MUST come from the deployed backend
+    # in that group — the local azd env may point at an unrelated deployment.
+    if ($ResourceGroupName) {
+        $rgSettings = Get-RgAppSettings $ResourceGroupName
+        if ($rgSettings.Contains($Name)) { return "$($rgSettings[$Name])".Trim() }
+        return ""
+    }
+
     $val = azd env get-value $Name 2>$null
     if ($LASTEXITCODE -eq 0 -and $val -and "$val" -notmatch '^ERROR:') {
         return "$val".Trim()
@@ -71,6 +112,20 @@ function Get-DeployValue {
     return ""
 }
 
+# Discover the deployed backend URL from an api-* App Service in the resource group.
+# Used for non-azd / AVM deployments where no local backend is running.
+function Get-DiscoveredBackendUrl {
+    param([string]$Rg)
+    if (-not $Rg) { return "" }
+    $names = (az webapp list --resource-group $Rg --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    $apiApp = (($names -split "`n") | Where-Object { $_ -like "api-*" } | Select-Object -First 1)
+    if (-not $apiApp) { return "" }
+    $hostName = (az webapp show --name $apiApp.Trim() --resource-group $Rg --query defaultHostName -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $hostName) { return "" }
+    return "https://$($hostName.Trim())"
+}
+
 # ── Load scenarios config (used by interactive menu and scenario resolution) ──
 $configPath = Join-Path $projectRoot "data" "config" "scenarios.json"
 $scenarioConfig = Get-Content $configPath -Raw | ConvertFrom-Json
@@ -115,6 +170,17 @@ function Resolve-ScenarioDataPath {
 if ($PSBoundParameters.ContainsKey("BackendUrl")) {
     Write-Host "Using explicit backend: $BackendUrl" -ForegroundColor Yellow
 }
+elseif ($ResourceGroupName) {
+    # Non-azd / AVM deployment: target the deployed backend discovered from the resource group.
+    $discovered = Get-DiscoveredBackendUrl $ResourceGroupName
+    if ($discovered) {
+        $BackendUrl = $discovered
+        Write-Host "Using deployed backend discovered from resource group '$ResourceGroupName': $BackendUrl" -ForegroundColor Yellow
+    } else {
+        Write-Host "ERROR: Could not discover the backend App Service (api-*) in resource group '$ResourceGroupName'." -ForegroundColor Red
+        exit 1
+    }
+}
 elseif ($BackendUrl -eq "http://localhost:8000") {
     $localHealthy = $false
     try {
@@ -183,16 +249,181 @@ function Invoke-DataCleanup {
     # Clear existing demo data (documents, insights cache) and any external data source
     # registrations so every scenario starts from a clean slate.
     Write-Host "Clearing existing data and external source connections for scenario isolation..." -ForegroundColor Yellow
-    try {
-        Invoke-RestMethod -Uri "$BackendUrl/api/ingestion/clear?include_external=true" -Method DELETE -Headers $Headers | Out-Null
-        Write-Host "Previous data and external source registrations cleared." -ForegroundColor Green
-    } catch {
-        Write-Host "ERROR: Could not clear existing data before scenario load: $_" -ForegroundColor Red
-        Write-Host "Aborting to prevent mixed data across use cases." -ForegroundColor Yellow
-        exit 1
+    $maxAttempts = 5
+    for ($attempt = 1; $attempt -le $maxAttempts; $attempt++) {
+        try {
+            Invoke-RestMethod -Uri "$BackendUrl/api/ingestion/clear?include_external=true" -Method DELETE -Headers $Headers | Out-Null
+            Write-Host "Previous data and external source registrations cleared." -ForegroundColor Green
+            return
+        } catch {
+            $statusCode = $null
+            if ($_.Exception.Response) { $statusCode = [int]$_.Exception.Response.StatusCode }
+            $isTransient = ($statusCode -eq 503 -or $statusCode -eq 502 -or $statusCode -eq 504 -or -not $statusCode)
+            if ($isTransient -and $attempt -lt $maxAttempts) {
+                Write-Host "Backend not ready yet (attempt $attempt/$maxAttempts) — retrying in 10s..." -ForegroundColor Yellow
+                Start-Sleep -Seconds 10
+                continue
+            }
+            Write-Host "ERROR: Could not clear existing data before scenario load: $_" -ForegroundColor Red
+            Write-Host "Aborting to prevent mixed data across use cases." -ForegroundColor Yellow
+            exit 1
+        }
     }
 }
 
+# Wait until every uploaded file has actually been processed, by checking the DURABLE store
+# rather than the API's in-memory /files list. On WAF deployments the API runs on multiple
+# App Service instances, each with its own in-memory cache, so /files (and /stats) are not
+# coherent — a long-lived poller pins to one instance via HTTP keep-alive and sees a stale
+# view forever. The Azure AI Search index is instance-independent: a file only appears there
+# (>=1 chunk under its source_file) once extraction + enrichment + indexing have completed.
+# We key on the exact filenames we uploaded and re-submit any that never land in the index
+# (recovers Content Understanding timeouts). If the search index can't be reached we fall back
+# to the reliable SQL total exposed by POST /refresh (registration only). Reaching all-indexed
+# before the caller recycles the app (agent step / network re-lock) is what prevents data loss.
+function Wait-ForIngestionCompletion {
+    [CmdletBinding()]
+    param(
+        [string]$BackendUrl,
+        [hashtable]$Headers,
+        $ExpectedFiles = @(),
+        [int]$TimeoutSec = 1500,
+        [int]$PollIntervalSec = 15,
+        [int]$MaxRetryRounds = 3,
+        [int]$RetryGraceSec = 180
+    )
+
+    # De-duplicate expected files by name, keeping the FileInfo so we can re-upload if needed.
+    $byName = [ordered]@{}
+    foreach ($f in @($ExpectedFiles | Where-Object { $_ })) {
+        if (-not $byName.Contains($f.Name)) { $byName[$f.Name] = $f }
+    }
+    $expectedNames = @($byName.Keys)
+    if ($expectedNames.Count -eq 0) {
+        return [pscustomobject]@{ Completed = $true; Indexed = 0; Expected = 0; Pending = @() }
+    }
+
+    Write-Host ""
+    Write-Host "Waiting for processing to finish (verifying against the search index — durable, instance-independent)..." -ForegroundColor Yellow
+
+    $searchEndpoint = (Get-DeployValue "AZURE_SEARCH_ENDPOINT").TrimEnd("/")
+    $searchIndexName = Get-DeployValue "AZURE_SEARCH_INDEX_NAME"
+    if (-not $searchIndexName) { $searchIndexName = "knowledge-mining-index" }
+    $apiVer = "2023-11-01"
+    $searchToken = az account get-access-token --resource https://search.azure.com --query accessToken -o tsv 2>$null
+
+    # Fallback: search index unreachable — wait on the reliable SQL total from /refresh.
+    if (-not $searchEndpoint -or -not $searchToken) {
+        Write-Warning "Search index not reachable — falling back to SQL registration count via /refresh."
+        $elapsed = 0
+        $cnt = 0
+        while ($elapsed -lt $TimeoutSec) {
+            $cnt = -1
+            try { $r = Invoke-RestMethod -Uri "$BackendUrl/api/ingestion/refresh" -Method POST -Headers $Headers; $cnt = [int]$r.files } catch {}
+            $pct = if ($expectedNames.Count) { [int](100 * [Math]::Max(0, $cnt) / $expectedNames.Count) } else { 100 }
+            Write-Progress -Activity "Registering files" -Status "$([Math]::Max(0, $cnt))/$($expectedNames.Count) registered in SQL (${elapsed}s elapsed)" -PercentComplete ([Math]::Min(100, $pct))
+            if ($cnt -ge $expectedNames.Count) {
+                Write-Progress -Activity "Registering files" -Completed
+                Write-Host "  All $($expectedNames.Count) file(s) registered in SQL (readiness not verified — check the Sources page)." -ForegroundColor Green
+                return [pscustomobject]@{ Completed = $true; Indexed = $cnt; Expected = $expectedNames.Count; Pending = @() }
+            }
+            Start-Sleep -Seconds $PollIntervalSec
+            $elapsed += $PollIntervalSec
+        }
+        Write-Progress -Activity "Registering files" -Completed
+        Write-Warning "Timed out after ${TimeoutSec}s waiting for files to register in SQL. Retry from the Sources page in the web UI."
+        return [pscustomobject]@{ Completed = $false; Indexed = [Math]::Max(0, $cnt); Expected = $expectedNames.Count; Pending = @($expectedNames) }
+    }
+
+    $searchUri = "$searchEndpoint/indexes/$searchIndexName/docs/search?api-version=$apiVer"
+    $elapsed = 0
+    $retryRound = 0
+    $lastRetryAt = -99999
+    $pending = @($expectedNames)
+    while ($elapsed -lt $TimeoutSec) {
+        $pending = @()
+        foreach ($name in $expectedNames) {
+            $esc = $name.Replace("'", "''")
+            $body = @{ search = '*'; filter = "source_file eq '$esc'"; top = 0; count = $true } | ConvertTo-Json
+            $count = -1
+            for ($try = 0; $try -lt 2; $try++) {
+                try {
+                    $resp = Invoke-RestMethod -Uri $searchUri -Method POST -Body $body `
+                        -Headers @{ Authorization = "Bearer $searchToken"; 'Content-Type' = 'application/json' }
+                    $count = [int]$resp.'@odata.count'
+                    break
+                } catch {
+                    $code = $null; if ($_.Exception.Response) { $code = [int]$_.Exception.Response.StatusCode }
+                    if ($code -eq 401) {
+                        $searchToken = az account get-access-token --resource https://search.azure.com --query accessToken -o tsv 2>$null
+                        continue
+                    }
+                    break  # transient — treat as not-yet-indexed this round
+                }
+            }
+            if ($count -le 0) { $pending += $name }
+        }
+
+        if ($pending.Count -eq 0) {
+            Write-Progress -Activity "Processing files" -Completed
+            Write-Host "  All $($expectedNames.Count) file(s) processed and indexed." -ForegroundColor Green
+            return [pscustomobject]@{ Completed = $true; Indexed = $expectedNames.Count; Expected = $expectedNames.Count; Pending = @() }
+        }
+
+        $done = $expectedNames.Count - $pending.Count
+        $pct = if ($expectedNames.Count) { [int](100 * $done / $expectedNames.Count) } else { 100 }
+        Write-Progress -Activity "Processing files" -Status "$done/$($expectedNames.Count) indexed (${elapsed}s elapsed)" -PercentComplete ([Math]::Min(100, $pct))
+        Write-Verbose "Waiting on: $($pending -join ', ')"
+
+        # After a grace period, re-submit still-missing files to recover CU timeouts/failures.
+        if (($elapsed - $lastRetryAt) -ge $RetryGraceSec -and $retryRound -lt $MaxRetryRounds) {
+            $retryRound++
+            $lastRetryAt = $elapsed
+            Write-Verbose "Re-submitting $($pending.Count) unprocessed file(s) (round $retryRound/$MaxRetryRounds)..."
+            $retryItems = @($pending | ForEach-Object { $byName[$_] })
+            for ($i = 0; $i -lt $retryItems.Count; $i += 5) {
+                $batch = @($retryItems[$i..([Math]::Min($i + 4, $retryItems.Count - 1))])
+                $fileItems = @(); foreach ($b in $batch) { $fileItems += Get-Item $b.FullName }
+                Invoke-UploadBatchWithRetry -BackendUrl $BackendUrl -Headers $Headers -FileItems $fileItems | Out-Null
+            }
+        }
+
+        Start-Sleep -Seconds $PollIntervalSec
+        $elapsed += $PollIntervalSec
+    }
+
+    Write-Progress -Activity "Processing files" -Completed
+    Write-Warning "Timed out after ${TimeoutSec}s. Not yet indexed: $($pending -join ', '). Retry from the Sources page in the web UI."
+    return [pscustomobject]@{ Completed = $false; Indexed = ($expectedNames.Count - $pending.Count); Expected = $expectedNames.Count; Pending = @($pending) }
+}
+
+# Upload a single batch of files, retrying transient upload failures a few times.
+# Returns $true if the batch was accepted by the backend, $false otherwise.
+function Invoke-UploadBatchWithRetry {
+    [CmdletBinding()]
+    param(
+        [string]$BackendUrl,
+        [hashtable]$Headers,
+        [array]$FileItems,
+        [int]$MaxAttempts = 3
+    )
+    for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
+        try {
+            Invoke-RestMethod -Uri "$BackendUrl/api/ingestion/upload/document" `
+                -Method POST -Form @{ files = $FileItems } -Headers $Headers | Out-Null
+            return $true
+        } catch {
+            if ($attempt -lt $MaxAttempts) {
+                Write-Warning "Upload attempt $attempt/$MaxAttempts failed — retrying in 10s: $_"
+                Start-Sleep -Seconds 10
+            } else {
+                Write-Warning "Upload FAILED after $MaxAttempts attempts: $_"
+            }
+        }
+    }
+    return $false
+}
+
 # Ensure the solution search index exists
 function Invoke-EnsureSearchIndex {
     Write-Host "Ensuring search index exists..." -ForegroundColor Yellow
@@ -205,7 +436,7 @@ function Invoke-EnsureSearchIndex {
     if ($searchIndexName)     { $idxArgs += "--index-name", $searchIndexName }
     if ($openaiEndpoint)      { $idxArgs += "--openai-endpoint", $openaiEndpoint }
     if ($embeddingDeployment) { $idxArgs += "--embedding-deployment", $embeddingDeployment }
-    python @idxArgs
+    & $pythonExe @idxArgs
     if ($LASTEXITCODE -ne 0) {
         Write-Host "Warning: Could not ensure search index — uploads may fail." -ForegroundColor Yellow
     }
@@ -265,7 +496,7 @@ if (-not $Scenario -and -not $DataPath -and -not $UseSampleData -and -not $Exter
                 Invoke-DataCleanup -BackendUrl $BackendUrl -Headers $headers
                 Write-Host ""
                 $env:BACKEND_URL = $BackendUrl
-                & (Join-Path $PSScriptRoot "connect-data.ps1") -Type $sourceType
+                & (Join-Path $PSScriptRoot "connect-data.ps1") -Type $sourceType -ResourceGroupName $ResourceGroupName
                 exit $LASTEXITCODE
             }
             $Scenario = $selected.key
@@ -276,7 +507,7 @@ if (-not $Scenario -and -not $DataPath -and -not $UseSampleData -and -not $Exter
             Invoke-DataCleanup -BackendUrl $BackendUrl -Headers $headers
             Write-Host ""
             $env:BACKEND_URL = $BackendUrl
-            & (Join-Path $PSScriptRoot "connect-data.ps1") -Type $selected.key
+            & (Join-Path $PSScriptRoot "connect-data.ps1") -Type $selected.key -ResourceGroupName $ResourceGroupName
             exit $LASTEXITCODE
         }
         "skip" {
@@ -287,7 +518,7 @@ if (-not $Scenario -and -not $DataPath -and -not $UseSampleData -and -not $Exter
             Invoke-EnsureSearchIndex
             Write-Host ""
             Write-Host "Creating default AI agent with SQL and Azure AI Search tools..." -ForegroundColor Yellow
-            & (Join-Path $PSScriptRoot "setup-agent.ps1") -Scenario "skip"
+            & (Join-Path $PSScriptRoot "setup-agent.ps1") -Scenario "skip" -ResourceGroupName $ResourceGroupName
             if ($LASTEXITCODE -ne 0) {
                 Write-Host "WARNING: Agent setup failed — retry with: ./infra/scripts/post-provision/setup-agent.ps1 -Scenario skip" -ForegroundColor Yellow
             }
@@ -351,10 +582,23 @@ if ($Scenario) {
         Write-Host "This scenario has pre-processed data. Loading via seed script..." -ForegroundColor Yellow
         Write-Host ""
 
+        # Export deploy-resolved config so the seed subprocess targets THIS deployment.
+        # Overwrites any stale session/.env values (e.g. leftovers from a prior run
+        # against a different environment) that seed-sample-data.py would otherwise use.
+        foreach ($name in @(
+            "AZURE_SEARCH_ENDPOINT", "AZURE_SEARCH_INDEX_NAME",
+            "AZURE_OPENAI_ENDPOINT", "AZURE_OPENAI_EMBEDDING_DEPLOYMENT",
+            "AZURE_COSMOS_ENDPOINT", "AZURE_COSMOS_DATABASE",
+            "AZURE_SQL_SERVER", "AZURE_SQL_DATABASE"
+        )) {
+            $val = Get-DeployValue $name
+            if ($val) { Set-Item -Path "Env:$name" -Value $val }
+        }
+
         # Run seed-sample-data.py with the scenario data directory
         $env:KM_SCENARIO_DATA_DIR = $scenarioDataPath
         $env:BACKEND_URL = $BackendUrl
-        python (Join-Path $PSScriptRoot "seed-sample-data.py")
+        & $pythonExe (Join-Path $PSScriptRoot "seed-sample-data.py")
 
         if ($LASTEXITCODE -eq 0) {
             Write-Host ""
@@ -406,6 +650,9 @@ if ($DataPath) {
     if ($docFiles.Count -gt 0) { Write-Host "  $($docFiles.Count) document files (PDF/JSON/DOCX/etc.)" -ForegroundColor Cyan }
     Write-Host ""
 
+    $audioUploaded = 0
+    $docUploaded = 0
+
     # ── Audio files (batch upload) ──
     if ($audioFiles.Count -gt 0) {
         Write-Host ""
@@ -422,17 +669,15 @@ if ($DataPath) {
                 $fileItems += Get-Item $f.FullName
                 Write-Host "  $($f.Name)" -ForegroundColor White
             }
-            try {
-                Invoke-RestMethod -Uri "$BackendUrl/api/ingestion/upload/document" `
-                    -Method POST -Form @{ files = $fileItems } -Headers $headers | Out-Null
+            if (Invoke-UploadBatchWithRetry -BackendUrl $BackendUrl -Headers $headers -FileItems $fileItems) {
                 $success += $batch.Count
                 Write-Host "  Batch of $($batch.Count) submitted" -ForegroundColor Green
-            } catch {
-                Write-Host "  Batch FAILED: $_" -ForegroundColor Red
+            } else {
                 $failed += $batch.Count
             }
         }
         Write-Host "  Audio: $success uploaded, $failed failed" -ForegroundColor $(if ($failed) { "Yellow" } else { "Green" })
+        $audioUploaded = $success
         if ($success -gt 0) {
             Write-Host "  Audio files are processing in background — check Sources page for status." -ForegroundColor Cyan
         }
@@ -453,21 +698,32 @@ if ($DataPath) {
                 $fileItems += Get-Item $f.FullName
                 Write-Host "  $($f.Name)" -ForegroundColor White
             }
-            try {
-                Invoke-RestMethod -Uri "$BackendUrl/api/ingestion/upload/document" `
-                    -Method POST -Form @{ files = $fileItems } -Headers $headers | Out-Null
+            if (Invoke-UploadBatchWithRetry -BackendUrl $BackendUrl -Headers $headers -FileItems $fileItems) {
                 $success += $batch.Count
                 Write-Host "  Batch of $($batch.Count) submitted" -ForegroundColor Green
-            } catch {
-                Write-Host "  Batch FAILED: $_" -ForegroundColor Red
+            } else {
                 $failed += $batch.Count
             }
         }
         Write-Host "  Documents: $success uploaded, $failed failed" -ForegroundColor $(if ($failed) { "Yellow" } else { "Green" })
+        $docUploaded = $success
+    }
+
+    $ingestion = $null
+    if ($audioFiles.Count -gt 0 -or $docFiles.Count -gt 0) {
+        # Verify against the durable search index, keyed on the actual files we uploaded.
+        $expectedItems = @()
+        if ($audioFiles) { $expectedItems += $audioFiles }
+        if ($docFiles)   { $expectedItems += $docFiles }
+        $ingestion = Wait-ForIngestionCompletion -BackendUrl $BackendUrl -Headers $headers -ExpectedFiles $expectedItems
     }
 
     Write-Host ""
-    Write-Host "Data upload complete!" -ForegroundColor Green
+    if ($ingestion -and -not $ingestion.Completed) {
+        Write-Host "Data upload finished — $($ingestion.Indexed)/$($ingestion.Expected) file(s) indexed. Retry the rest from the Sources page." -ForegroundColor Yellow
+    } else {
+        Write-Host "Data upload complete!" -ForegroundColor Green
+    }
 }
 
 # ══════════════════════════════════════════
@@ -486,7 +742,7 @@ if ($ExternalSource) {
     if ($Table)            { $pyArgs += "--table", $Table }
     if ($ConnectionString) { $pyArgs += "--connection-string", $ConnectionString }
 
-    python (Join-Path $PSScriptRoot "connect-data.py") @pyArgs
+    & $pythonExe (Join-Path $PSScriptRoot "connect-data.py") @pyArgs
     if ($LASTEXITCODE -ne 0) {
         Write-Host "External data source connection failed." -ForegroundColor Red
         exit 1
@@ -522,7 +778,7 @@ Write-Host ""
 if ($Scenario) {
     Write-Host ""
     Write-Host "Creating scenario-based AI agent for '$Scenario'..." -ForegroundColor Yellow
-    & (Join-Path $PSScriptRoot "setup-agent.ps1") -Scenario $Scenario
+    & (Join-Path $PSScriptRoot "setup-agent.ps1") -Scenario $Scenario -ResourceGroupName $ResourceGroupName
     if ($LASTEXITCODE -ne 0) {
         Write-Host "WARNING: Agent setup failed — retry with: ./infra/scripts/post-provision/setup-agent.ps1 -Scenario $Scenario" -ForegroundColor Yellow
     }
diff --git a/infra/scripts/post-provision/setup-sql-roles.ps1 b/infra/scripts/post-provision/setup-sql-roles.ps1
index 9bfb6b204..e0f76666c 100644
--- a/infra/scripts/post-provision/setup-sql-roles.ps1
+++ b/infra/scripts/post-provision/setup-sql-roles.ps1
@@ -6,58 +6,208 @@
     Reads the SQL server/database and the API managed identity from the azd
     environment, then creates a contained database user and assigns
     db_datareader / db_datawriter / db_ddladmin. Runs as the deployer (Azure CLI
-    credentials), who must be the SQL Azure AD admin.
+    credentials); if the caller isn't the server's Entra ID admin, it temporarily
+    elevates itself, runs the grant, then restores the original admin.
 #>
 
+param(
+    [string]$ResourceGroupName,
+    [string]$SqlServerName,
+    [string]$SqlDatabaseName,
+    [string]$ApiAppName,
+    [string]$PrincipalId,
+    # Skip the temporary Entra-admin elevation (caller must already be the SQL admin).
+    [switch]$SkipAdminElevation
+)
+
 $ErrorActionPreference = "Stop"
 
+# azd may be unavailable in AVM / non-azd deployments; guard so callers can rely on
+# explicit parameters and resource-group auto-discovery instead.
+$azdAvailable = [bool](Get-Command azd -ErrorAction SilentlyContinue)
+
+function Get-AzdValue([string]$key) {
+    if (-not $azdAvailable) { return "" }
+    $val = (azd env get-value $key 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $val -or $val -match 'ERROR|not found') { return "" }
+    return $val.Trim()
+}
+
+# ── Auto-discovery helpers: resolve names from the resource group when not
+#    supplied explicitly and not available via azd (non-azd / AVM deployments). ──
+function Get-DiscoveredSqlServerName([string]$rg) {
+    if (-not $rg) { return "" }
+    $names = (az sql server list --resource-group $rg --query "[].fullyQualifiedDomainName" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    return (($names -split "`n") | Where-Object { $_ } | Select-Object -First 1).Trim()
+}
+function Get-DiscoveredSqlDatabaseName([string]$rg, [string]$serverShortName) {
+    if (-not $rg -or -not $serverShortName) { return "" }
+    $names = (az sql db list --resource-group $rg --server $serverShortName --query "[?name!='master'].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    return (($names -split "`n") | Where-Object { $_ } | Select-Object -First 1).Trim()
+}
+function Get-DiscoveredWebAppName([string]$rg, [string]$prefix) {
+    if (-not $rg) { return "" }
+    $names = (az webapp list --resource-group $rg --query "[].name" -o tsv 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $names) { return "" }
+    return (($names -split "`n") | Where-Object { $_ -like "$prefix*" } | Select-Object -First 1).Trim()
+}
+
 Write-Host ""
 Write-Host "========================================" -ForegroundColor Cyan
 Write-Host "  Granting API identity SQL access" -ForegroundColor Cyan
 Write-Host "========================================" -ForegroundColor Cyan
 
-$server      = (azd env get-value AZURE_SQL_SERVER 2>$null)      | Where-Object { $_ -notmatch 'ERROR' }
-$database    = (azd env get-value AZURE_SQL_DATABASE 2>$null)     | Where-Object { $_ -notmatch 'ERROR' }
-$apiName     = (azd env get-value API_APP_NAME 2>$null)           | Where-Object { $_ -notmatch 'ERROR' }
-$principalId = (azd env get-value AZURE_API_PRINCIPAL_ID 2>$null) | Where-Object { $_ -notmatch 'ERROR' }
+# ── Resolve configuration. When -ResourceGroupName is passed explicitly, treat it as the
+#    source of truth and do NOT read azd env (a local azd default env may point elsewhere). ──
+$rgProvided = [bool]$ResourceGroupName
+$server      = if ($SqlServerName) { $SqlServerName } elseif ($rgProvided) { "" } else { Get-AzdValue "AZURE_SQL_SERVER" }
+$database    = if ($SqlDatabaseName) { $SqlDatabaseName } elseif ($rgProvided) { "" } else { Get-AzdValue "AZURE_SQL_DATABASE" }
+$apiName     = if ($ApiAppName) { $ApiAppName } elseif ($rgProvided) { "" } else { Get-AzdValue "API_APP_NAME" }
+$principalId = if ($PrincipalId) { $PrincipalId } elseif ($rgProvided) { "" } else { Get-AzdValue "AZURE_API_PRINCIPAL_ID" }
 
-$envName  = (azd env get-value AZURE_ENV_NAME 2>$null)        | Where-Object { $_ -notmatch 'ERROR' }
-$backendUri = (azd env get-value SERVICE_BACKEND_URI 2>$null) | Where-Object { $_ -notmatch 'ERROR' }
+$resourceGroup = if ($ResourceGroupName) { $ResourceGroupName } else { Get-AzdValue "RESOURCE_GROUP_NAME" }
+$envName    = if ($rgProvided) { "" } else { Get-AzdValue "AZURE_ENV_NAME" }
+$backendUri = if ($rgProvided) { "" } else { Get-AzdValue "SERVICE_BACKEND_URI" }
 
-# Fallbacks for environments provisioned before the API_APP_NAME / AZURE_API_PRINCIPAL_ID
-# outputs were added: derive the app name from the backend URI and look up the
-# principal ID with the Azure CLI.
+# Derive the app name from the backend URI (azd envs provisioned before API_APP_NAME existed).
 if (-not $apiName -and $backendUri -match 'https://([^.]+)\.azurewebsites') {
     $apiName = $Matches[1]
 }
-if (-not $principalId -and $apiName -and $envName) {
-    $principalId = (az webapp identity show --name $apiName --resource-group "rg-$envName" --query principalId -o tsv 2>$null)
+
+# ── Auto-discovery from the resource group (used when azd is unavailable/didn't resolve a value) ──
+if (-not $resourceGroup -and $envName) { $resourceGroup = "rg-$envName" }
+if (-not $server)   { $server   = Get-DiscoveredSqlServerName $resourceGroup }
+if (-not $apiName)  { $apiName  = Get-DiscoveredWebAppName $resourceGroup "api-" }
+if (-not $database) { $database = Get-DiscoveredSqlDatabaseName $resourceGroup ($server -replace '\.database\.windows\.net$', '') }
+
+if (-not $principalId -and $apiName -and $resourceGroup) {
+    $principalId = (az webapp identity show --name $apiName --resource-group $resourceGroup --query principalId -o tsv 2>$null)
 }
 
-if (-not $server -or -not $database -or -not $apiName -or -not $principalId) {
-    Write-Host "Skipping SQL role assignment — missing AZURE_SQL_SERVER / AZURE_SQL_DATABASE / API_APP_NAME / AZURE_API_PRINCIPAL_ID." -ForegroundColor Yellow
-    exit 0
+# The backend authenticates to SQL with its USER-ASSIGNED managed identity, whose client id
+# is exposed as the AZURE_CLIENT_ID app setting. A SQL contained user for a managed identity
+# must be created with a SID derived from that identity's CLIENT (application) id — not its
+# object/principal id — so resolve the client id (and the identity's name) here.
+$appClientId = ""
+$appMiName = ""
+if ($apiName -and $resourceGroup) {
+    $appClientId = (az webapp config appsettings list --name $apiName --resource-group $resourceGroup --query "[?name=='AZURE_CLIENT_ID'].value | [0]" -o tsv 2>$null)
+    if ($appClientId) { $appClientId = $appClientId.Trim() }
 }
+if ($appClientId -and $resourceGroup) {
+    $appMiName = (az identity list --resource-group $resourceGroup --query "[?clientId=='$appClientId'].name | [0]" -o tsv 2>$null)
+    if ($appMiName) { $appMiName = $appMiName.Trim() }
+}
+# Fallback (system-assigned identity): derive the client (app) id from the principal id.
+if (-not $appClientId -and $principalId) {
+    $appClientId = (az ad sp show --id $principalId --query appId -o tsv 2>$null)
+    if ($appClientId) { $appClientId = $appClientId.Trim() }
+}
+$sqlIdentityClientId = if ($appClientId) { $appClientId } else { $principalId }
+$sqlIdentityName     = if ($appMiName) { $appMiName } else { $apiName }
 
-$accountType = (az account show --query user.type -o tsv 2>$null)
-$isServicePrincipal = ($accountType -eq 'servicePrincipal')
+if (-not $server -or -not $database -or -not $apiName -or -not $sqlIdentityClientId) {
+    Write-Host "Skipping SQL role assignment — missing SQL server / database / API app name / managed identity client id." -ForegroundColor Yellow
+    if (-not $azdAvailable -or -not $resourceGroup) {
+        Write-Host "       For non-azd/AVM deployments, pass -ResourceGroupName (and optionally -SqlServerName, -SqlDatabaseName, -ApiAppName, -PrincipalId)." -ForegroundColor Yellow
+    }
+    exit 0
+}
 
+# A managed identity is always created via the SID path (WITH SID = <clientId>, TYPE = E),
+# which needs no Microsoft Graph permission on the SQL server.
 $roles = @(
-    @{ principalId = $principalId; displayName = $apiName; role = "db_datareader";  isServicePrincipal = $isServicePrincipal },
-    @{ principalId = $principalId; displayName = $apiName; role = "db_datawriter";  isServicePrincipal = $isServicePrincipal },
-    @{ principalId = $principalId; displayName = $apiName; role = "db_ddladmin";    isServicePrincipal = $isServicePrincipal }
+    @{ principalId = $sqlIdentityClientId; displayName = $sqlIdentityName; role = "db_datareader"; isServicePrincipal = $true },
+    @{ principalId = $sqlIdentityClientId; displayName = $sqlIdentityName; role = "db_datawriter"; isServicePrincipal = $true },
+    @{ principalId = $sqlIdentityClientId; displayName = $sqlIdentityName; role = "db_ddladmin";   isServicePrincipal = $true }
 )
 
 # Write to a temp file to avoid CLI JSON quoting issues across shells
 $tmp = [System.IO.Path]::GetTempFileName()
 ConvertTo-Json -InputObject $roles -Depth 5 | Set-Content -Path $tmp -Encoding utf8
 
-Write-Host "API identity : $apiName ($principalId), account type: $accountType" -ForegroundColor DarkGray
+Write-Host "API identity : $sqlIdentityName (client id $sqlIdentityClientId)" -ForegroundColor DarkGray
 Write-Host "SQL target   : $server / $database" -ForegroundColor DarkGray
 
 $script = Join-Path $PSScriptRoot "add_user_scripts/assign_sql_roles.py"
-python $script --server $server --database $database --roles-file $tmp
-$exit = $LASTEXITCODE
+
+# ── SQL requires the caller to be the server's Entra ID admin to create contained users.
+#    If the caller isn't the admin, temporarily elevate self, run the grant, then restore
+#    the original admin. The app authenticates via its own contained user (not the admin
+#    slot), so this swap does not affect application runtime. Skippable with -SkipAdminElevation. ──
+$sqlServerShort = ($server -replace '\.database\.windows\.net$', '')
+$adminSwapped = $false
+$originalAdmin = $null
+
+if (-not $SkipAdminElevation -and $resourceGroup -and $sqlServerShort) {
+    # Resolve the current principal's object id (works for both users and service principals).
+    $acct = (az account show -o json 2>$null) | ConvertFrom-Json
+    $myObjectId = ""
+    $myDisplayName = ""
+    if ($acct) {
+        if ($acct.user.type -eq 'servicePrincipal') {
+            $myObjectId    = (az ad sp show --id $acct.user.name --query id -o tsv 2>$null)
+            $myDisplayName = $acct.user.name
+        } else {
+            $me = (az ad signed-in-user show -o json 2>$null) | ConvertFrom-Json
+            if ($me) { $myObjectId = $me.id; $myDisplayName = $me.userPrincipalName }
+        }
+    }
+    if ($myObjectId) { $myObjectId = $myObjectId.Trim() }
+
+    $currentAdmin = (az sql server ad-admin list --resource-group $resourceGroup --server $sqlServerShort -o json 2>$null) | ConvertFrom-Json
+    $currentAdmin = $currentAdmin | Select-Object -First 1
+    $adminSid = if ($currentAdmin) { $currentAdmin.sid } else { "" }
+
+    if ($myObjectId -and $adminSid -ne $myObjectId) {
+        Write-Host "Current principal is not the SQL Entra admin — elevating temporarily..." -ForegroundColor Yellow
+        if ($currentAdmin) {
+            az sql server ad-admin update --resource-group $resourceGroup --server $sqlServerShort --display-name $myDisplayName --object-id $myObjectId 2>$null | Out-Null
+        } else {
+            az sql server ad-admin create --resource-group $resourceGroup --server $sqlServerShort --display-name $myDisplayName --object-id $myObjectId 2>$null | Out-Null
+        }
+        if ($LASTEXITCODE -eq 0) {
+            $adminSwapped = $true
+            $originalAdmin = $currentAdmin
+            Write-Host "Elevated. Original admin will be restored after the grant." -ForegroundColor DarkGray
+        } else {
+            Write-Host "WARNING: Could not set current principal as SQL Entra admin (needs SQL Server Contributor/Owner). The grant may fail." -ForegroundColor Yellow
+        }
+    }
+}
+
+$exit = 1
+try {
+    # AAD admin changes can take up to ~60s to apply to new logins; retry the grant while it propagates.
+    $maxAttempts = if ($adminSwapped) { 5 } else { 1 }
+    for ($attempt = 1; $attempt -le $maxAttempts; $attempt++) {
+        python $script --server $server --database $database --roles-file $tmp
+        $exit = $LASTEXITCODE
+        if ($exit -eq 0) { break }
+        if ($attempt -lt $maxAttempts) {
+            Write-Host "Grant attempt $attempt failed; waiting for the admin change to propagate..." -ForegroundColor DarkYellow
+            Start-Sleep -Seconds 15
+        }
+    }
+}
+finally {
+    # Always restore the original admin, even if the grant threw or failed.
+    if ($adminSwapped) {
+        if ($originalAdmin) {
+            az sql server ad-admin update --resource-group $resourceGroup --server $sqlServerShort --display-name $originalAdmin.login --object-id $originalAdmin.sid 2>$null | Out-Null
+        } else {
+            az sql server ad-admin delete --resource-group $resourceGroup --server $sqlServerShort 2>$null | Out-Null
+        }
+        if ($LASTEXITCODE -eq 0) {
+            Write-Host "Restored original SQL Entra admin." -ForegroundColor DarkGray
+        } else {
+            $restoreName = if ($originalAdmin) { $originalAdmin.login } else { '(none)' }
+            Write-Host "WARNING: Failed to restore original SQL Entra admin '$restoreName'. Restore it manually." -ForegroundColor Red
+        }
+    }
+}
 
 Remove-Item -Force $tmp -ErrorAction SilentlyContinue
 
diff --git a/infra/scripts/utilities/test_all_features.py b/infra/scripts/utilities/test_all_features.py
index 9c1c28c6c..df2667874 100644
--- a/infra/scripts/utilities/test_all_features.py
+++ b/infra/scripts/utilities/test_all_features.py
@@ -153,15 +153,14 @@ def test_rag_chat():
 test("RAG Chat (Ask)", test_rag_chat)
 
 
-# ── 9. Conversation ──
+# ── 9. Conversation (multi-turn via /ask with conversation_id) ──
 def test_conversation():
     payload = {
-        "messages": [
-            {"role": "user", "content": "What products do you have data about?"}
-        ],
+        "question": "What products do you have data about?",
         "top_k": 3,
+        "conversation_id": "test-conv-001",
     }
-    r = requests.post(f"{BASE}/api/rag/conversation", json=payload, headers=HEADERS, timeout=60)
+    r = requests.post(f"{BASE}/api/rag/ask", json=payload, headers=HEADERS, timeout=60)
     assert r.status_code == 200, f"Conversation returned {r.status_code}: {r.text[:300]}"
     data = r.json()
     answer = data.get("answer", "")
diff --git a/infra/vscode_web/.gitignore b/infra/vscode_web/.gitignore
deleted file mode 100644
index 23de01ef5..000000000
--- a/infra/vscode_web/.gitignore
+++ /dev/null
@@ -1,85 +0,0 @@
-# ========== .NET ========== #
-## Build results
-bin/
-obj/
-[Bb]uild/
-[Ll]ogs/
-*.log
-## User-specific files
-*.user
-*.suo
-*.userosscache
-*.sln.docstates
-*.vsp
-*.vspx
-*.vspscc
-## Rider / VS Code / Visual Studio
-.idea/
-.vscode/
-.vs/
-## NuGet packages
-*.nupkg
-packages/
-*.snupkg
-project.lock.json
-project.assets.json
-## Dotnet tools
-.tools/
-# ========== Java ========== #
-## Compiled class files
-*.class
-## Logs
-*.log
-## Maven
-target/
-## Gradle
-.gradle/
-build/
-## Eclipse
-.project
-.classpath
-.settings/
-.loadpath
-## IntelliJ IDEA
-*.iml
-*.ipr
-*.iws
-out/
-.idea/
-# ========== Python ========== #
-## Byte-compiled / cache
-__pycache__/
-*.py[cod]
-*$py.class
-## Virtual environment
-env/
-venv/
-ENV/
-.venv/
-.env*
-## PyInstaller
-*.spec
-dist/
-build/
-## Jupyter Notebook
-.ipynb_checkpoints/
-## Misc
-*.log
-*.pot
-*.pyc
-.DS_Store
-*.sqlite3
-# ========== General ========== #
-## OS generated
-Thumbs.db
-ehthumbs.db
-Desktop.ini
-.DS_Store
-*.swp
-*.swo
-*.bak
-*.tmp
-*.old
-## Node (just in case mixed project)
-node_modules/
-# End
\ No newline at end of file
diff --git a/infra/vscode_web/LICENSE b/infra/vscode_web/LICENSE
deleted file mode 100644
index 22aed37e6..000000000
--- a/infra/vscode_web/LICENSE
+++ /dev/null
@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) Microsoft Corporation.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/infra/vscode_web/README-noazd.md b/infra/vscode_web/README-noazd.md
deleted file mode 100644
index 1436b6150..000000000
--- a/infra/vscode_web/README-noazd.md
+++ /dev/null
@@ -1,2 +0,0 @@
-# VS Code for the Web - Azure AI Foundry Templates
-
diff --git a/infra/vscode_web/README.md b/infra/vscode_web/README.md
deleted file mode 100644
index 6ce5aedfa..000000000
--- a/infra/vscode_web/README.md
+++ /dev/null
@@ -1,43 +0,0 @@
-# VS Code for the Web - Azure AI Foundry Templates
-
-We've generated a simple development environment for you to deploy the templates.
-
-The Azure AI Foundry extension provides tools to help you build, test, and deploy AI models and AI Applications directly from VS Code. It offers simplified operations for interacting with your models, agents, and threads without leaving your development environment. Click on the Azure AI Foundry Icon on the left to see more.
-
-Follow the instructions below to get started!
-
-You should see a terminal opened with the template code already cloned.
-
-## Deploy the template 
-
-You can provision and deploy this template using:
-
-```bash
-azd up
-```
-
-Follow any instructions from the deployment script and launch the application.
-
-
-If you need to delete the deployment and stop incurring any charges, run:
-
-```bash
-azd down
-```
-
-## Continuing on your local desktop
-
-You can keep working locally on VS Code Desktop by clicking "Continue On Desktop..." at the bottom left of this screen. Be sure to take the .env file with you using these steps:
-
-- Right-click the .env file
-- Select "Download"
-- Move the file from your Downloads folder to the local git repo directory
-- For Windows, you will need to rename the file back to .env using right-click "Rename..."
-
-## More examples
-
-Check out [Azure AI Projects client library for Python](https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/ai/azure-ai-projects/README.md) for more information on using this SDK.
-
-## Troubleshooting
-
-- If you are instantiating your client via endpoint on an Azure AI Foundry project, ensure the endpoint is set in the `.env` as https://{your-foundry-resource-name}.services.ai.azure.com/api/projects/{your-foundry-project-name}`
\ No newline at end of file
diff --git a/infra/vscode_web/codeSample.py b/infra/vscode_web/codeSample.py
deleted file mode 100644
index 2ad2d0413..000000000
--- a/infra/vscode_web/codeSample.py
+++ /dev/null
@@ -1,25 +0,0 @@
-from azure.ai.projects import AIProjectClient
-from azure.identity import DefaultAzureCredential
-
-project_client = AIProjectClient.from_connection_string(
-    credential=DefaultAzureCredential(),
-    conn_str="<%= connectionString %>")
-
-agent = project_client.agents.get_agent("<%= agentId %>")
-
-thread = project_client.agents.create_thread()
-print(f"Created thread, ID: {thread.id}")
-
-message = project_client.agents.create_message(
-    thread_id=thread.id,
-    role="user",
-    content="<%= userMessage %>"
-)
-
-run = project_client.agents.create_and_process_run(
-    thread_id=thread.id,
-    agent_id=agent.id)
-messages = project_client.agents.list_messages(thread_id=thread.id)
-
-for text_message in messages.text_messages:
-    print(text_message.as_dict())
\ No newline at end of file
diff --git a/infra/vscode_web/endpoint-requirements.txt b/infra/vscode_web/endpoint-requirements.txt
deleted file mode 100644
index 18d6803e8..000000000
--- a/infra/vscode_web/endpoint-requirements.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-azure-ai-projects==1.0.0b12
-azure-identity==1.20.0
-ansible-core~=2.17.0
\ No newline at end of file
diff --git a/infra/vscode_web/endpointCodeSample.py b/infra/vscode_web/endpointCodeSample.py
deleted file mode 100644
index 21452478a..000000000
--- a/infra/vscode_web/endpointCodeSample.py
+++ /dev/null
@@ -1,31 +0,0 @@
-from azure.ai.projects import AIProjectClient
-from azure.identity import DefaultAzureCredential
-from azure.ai.agents.models import ListSortOrder
-
-project = AIProjectClient(
-    credential=DefaultAzureCredential(),
-    endpoint="<%= endpoint %>")
-
-agent = project.agents.get_agent("<%= agentId %>")
-
-thread = project.agents.threads.create()
-print(f"Created thread, ID: {thread.id}")
-
-message = project.agents.messages.create(
-    thread_id=thread.id,
-    role="user",
-    content="<%= userMessage %>"
-)
-
-run = project.agents.runs.create_and_process(
-    thread_id=thread.id,
-    agent_id=agent.id)
-
-if run.status == "failed":
-    print(f"Run failed: {run.last_error}")
-else:
-    messages = project.agents.messages.list(thread_id=thread.id, order=ListSortOrder.ASCENDING)
-
-    for message in messages:
-        if message.text_messages:
-            print(f"{message.role}: {message.text_messages[-1].text.value}")
\ No newline at end of file
diff --git a/infra/vscode_web/index.json b/infra/vscode_web/index.json
deleted file mode 100644
index 55157c9da..000000000
--- a/infra/vscode_web/index.json
+++ /dev/null
@@ -1,72 +0,0 @@
-{
-  "ai-projects-sdk": {
-    "python": {
-      "default-azure-auth": {
-        "connectionString": [
-          {
-            "name": "run_agent.py",
-            "type": "code",
-            "path": "/codeSample.py"
-          },
-          {
-            "name": "INSTRUCTIONS.md",
-            "type": "readme",
-            "path": "/README-noazd.md"
-          },
-          {
-            "name": "requirements.txt",
-            "type": "dependencies",
-            "path": "/requirements.txt"
-          },
-          {
-            "name": ".env",
-            "type": "env",
-            "path": "/.env"
-          },
-          {
-            "name": "install.sh",
-            "type": "install",
-            "path": "/install.sh"
-          },
-          {
-            "name": ".gitignore",
-            "type": "code",
-            "path": "/.gitignore"
-          }
-        ],
-        "endpoint": [
-          {
-            "name": "run_agent.py",
-            "type": "code",
-            "path": "/endpointCodeSample.py"
-          },
-          {
-            "name": "INSTRUCTIONS.md",
-            "type": "readme",
-            "path": "/README.md"
-          },
-          {
-            "name": "requirements.txt",
-            "type": "dependencies",
-            "path": "/endpoint-requirements.txt"
-          },
-          {
-            "name": ".env",
-            "type": "env",
-            "path": "/.env"
-          },
-          {
-            "name": "install.sh",
-            "type": "install",
-            "path": "/install.sh"
-          },
-          {
-            "name": ".gitignore",
-            "type": "code",
-            "path": "/.gitignore"
-          }
-        ]
-      }
-    }
- }   
-}
\ No newline at end of file
diff --git a/infra/vscode_web/install.sh b/infra/vscode_web/install.sh
deleted file mode 100644
index c172fa2f4..000000000
--- a/infra/vscode_web/install.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-pip install -r requirements.txt --user -q
-
-azd init -t microsoft/Conversation-Knowledge-Mining-Solution-Accelerator
\ No newline at end of file
diff --git a/infra/vscode_web/requirements.txt b/infra/vscode_web/requirements.txt
deleted file mode 100644
index 18d6803e8..000000000
--- a/infra/vscode_web/requirements.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-azure-ai-projects==1.0.0b12
-azure-identity==1.20.0
-ansible-core~=2.17.0
\ No newline at end of file
diff --git a/src/api/config.py b/src/api/config.py
index 645de1d1a..48f0d39eb 100644
--- a/src/api/config.py
+++ b/src/api/config.py
@@ -46,6 +46,9 @@ class Settings(BaseSettings):
     azure_ad_tenant_id: str = ""
     azure_ad_client_id: str = ""
 
+    # Optional user-assigned managed identity. Empty uses the system-assigned identity.
+    azure_client_id: str = ""
+
     # RAG Configuration
     rag_top_k: int = 5
     rag_enable_reranking: bool = False
diff --git a/src/api/modules/data_sources/azure_search.py b/src/api/modules/data_sources/azure_search.py
index 4bf0cc807..bfb597ee7 100644
--- a/src/api/modules/data_sources/azure_search.py
+++ b/src/api/modules/data_sources/azure_search.py
@@ -4,7 +4,11 @@
 import uuid
 from typing import Iterator, Optional
 
-from azure.identity import DefaultAzureCredential
+from azure.identity import (
+    AzureCliCredential,
+    ChainedTokenCredential,
+    ManagedIdentityCredential,
+)
 from azure.search.documents import SearchClient
 
 from src.api.modules.data_sources.base import (
@@ -12,6 +16,7 @@
     ColumnInfo,
     DataSourceConfig,
 )
+from src.api.config import get_settings
 
 logger = logging.getLogger(__name__)
 
@@ -20,7 +25,12 @@ class AzureSearchDataSource(BaseExternalDataSource):
     """Adapter for Azure AI Search — enables BYOI (bring your own index)."""
 
     def _get_client(self, config: DataSourceConfig) -> SearchClient:
-        credential = DefaultAzureCredential()
+        settings = get_settings()
+        # Managed identity in Azure, Azure CLI fallback for local runs (e.g. post-provision enrichment).
+        credential = ChainedTokenCredential(
+            ManagedIdentityCredential(client_id=settings.azure_client_id or None),
+            AzureCliCredential(),
+        )
         return SearchClient(
             endpoint=config.endpoint,
             index_name=config.table_or_query,  # index name stored in table_or_query
diff --git a/src/api/modules/document_intelligence/enrichment_agent.py b/src/api/modules/document_intelligence/enrichment_agent.py
index 397844c60..35744206f 100644
--- a/src/api/modules/document_intelligence/enrichment_agent.py
+++ b/src/api/modules/document_intelligence/enrichment_agent.py
@@ -56,14 +56,23 @@ async def _create():
                                 return False
                         except Exception:
                             pass  # Not found — create below
-                        await pc.agents.create_version(
-                            agent_name=ENRICHMENT_AGENT_NAME,
-                            definition=PromptAgentDefinition(
-                                model=settings.azure_openai_chat_deployment,
-                                instructions=_INSTRUCTIONS,
-                            ),
-                        )
-                        return True
+                        try:
+                            await pc.agents.create_version(
+                                agent_name=ENRICHMENT_AGENT_NAME,
+                                definition=PromptAgentDefinition(
+                                    model=settings.azure_openai_chat_deployment,
+                                    instructions=_INSTRUCTIONS,
+                                ),
+                            )
+                            return True
+                        except Exception as ce:
+                            # On multi-instance deploys another worker may create the same
+                            # agent concurrently -> 409 conflict. The agent now exists, so
+                            # reuse it instead of failing enrichment for this file.
+                            msg = str(ce).lower()
+                            if "conflict" in msg or "already exists" in msg or "modified concurrently" in msg:
+                                return False
+                            raise
                 created = asyncio.run(_create())
                 self._name = ENRICHMENT_AGENT_NAME
                 logger.info(
diff --git a/src/api/modules/document_intelligence/service.py b/src/api/modules/document_intelligence/service.py
index 48ee3c5b3..62e7712dc 100644
--- a/src/api/modules/document_intelligence/service.py
+++ b/src/api/modules/document_intelligence/service.py
@@ -213,6 +213,40 @@ def _ensure_defaults(self):
             logger.info("Content Understanding defaults configured.")
             self._defaults_ensured = True
 
+    # Analyzer resource states that are safe to submit an analysis against.
+    _ANALYZER_READY_STATES = {"ready", "succeeded"}
+    _ANALYZER_FAILED_STATES = {"failed"}
+
+    def _wait_for_analyzer_ready(
+        self, client: httpx.Client, analyzer_id: str, url: str, max_wait: int = 180
+    ):
+        """Poll the analyzer resource until it reaches a ready state.
+
+        CU analyzer creation is asynchronous. On multi-instance deployments several
+        workers may create the same analyzer concurrently; the losers get a 409 while
+        the analyzer is still in a 'creating'/'Running' state. Submitting an analysis
+        against a not-ready analyzer returns 404 ModelNotFound, so callers must wait
+        for readiness before analyzing.
+        """
+        elapsed = 0
+        interval = 2
+        while elapsed < max_wait:
+            resp = client.get(url, headers=self._auth_headers())
+            if resp.status_code == 200:
+                status = (resp.json().get("status") or "").lower()
+                if status in self._ANALYZER_READY_STATES:
+                    return
+                if status in self._ANALYZER_FAILED_STATES:
+                    raise RuntimeError(
+                        f"CU analyzer '{analyzer_id}' creation failed: {resp.text}"
+                    )
+            time.sleep(interval)
+            elapsed += interval
+            interval = min(interval * 2, 15)
+        logger.warning(
+            f"CU analyzer '{analyzer_id}' still not ready after {max_wait}s; proceeding anyway."
+        )
+
     def _ensure_analyzer(self, analyzer_id: str | None = None):
         """Create the CU analyzer if it doesn't exist yet."""
         if analyzer_id is None:
@@ -236,6 +270,12 @@ def _ensure_analyzer(self, analyzer_id: str | None = None):
             # Check if analyzer exists
             resp = client.get(url, headers=self._auth_headers())
             if resp.status_code == 200:
+                # An analyzer resource can exist while still being provisioned
+                # (status 'creating'/'Running'). Submitting an analysis against a
+                # not-ready analyzer returns 404 ModelNotFound, so wait for it.
+                status = (resp.json().get("status") or "").lower()
+                if status not in self._ANALYZER_READY_STATES:
+                    self._wait_for_analyzer_ready(client, analyzer_id, url)
                 self._analyzers_ensured.add(analyzer_id)
                 return
 
@@ -245,9 +285,15 @@ def _ensure_analyzer(self, analyzer_id: str | None = None):
             # Create the analyzer
             resp = client.put(url, headers=headers, json=template)
             if resp.status_code == 409:
+                # Another instance is creating the same analyzer concurrently. The
+                # analyzer is likely still in a 'Running'/creating state, so we must
+                # wait for it to become ready before returning — otherwise the next
+                # :analyze call fails with 404 ModelNotFound.
                 logger.info(
-                    f"CU analyzer '{analyzer_id}' already exists (409 Conflict); reusing it."
+                    f"CU analyzer '{analyzer_id}' is being created concurrently (409 Conflict); "
+                    "waiting for it to become ready."
                 )
+                self._wait_for_analyzer_ready(client, analyzer_id, url)
                 self._analyzers_ensured.add(analyzer_id)
                 return
             if resp.status_code >= 400:
diff --git a/src/api/modules/ingestion/azure_storage.py b/src/api/modules/ingestion/azure_storage.py
index cb028538d..cf22d3bbc 100644
--- a/src/api/modules/ingestion/azure_storage.py
+++ b/src/api/modules/ingestion/azure_storage.py
@@ -8,7 +8,7 @@
 from datetime import datetime, timedelta, timezone
 
 from azure.core.exceptions import ResourceNotFoundError
-from azure.identity import DefaultAzureCredential
+from azure.identity import AzureCliCredential, ManagedIdentityCredential
 from azure.storage.blob import BlobServiceClient, ContentSettings, generate_blob_sas, BlobSasPermissions
 from azure.search.documents import SearchClient
 from azure.search.documents.indexes import SearchIndexClient
@@ -29,7 +29,13 @@ def __init__(self):
 
     def _get_credential(self):
         if self._credential is None:
-            self._credential = DefaultAzureCredential()
+            settings = get_settings()
+            if settings.app_env.lower() == "dev":
+                self._credential = AzureCliCredential()
+            else:
+                self._credential = ManagedIdentityCredential(
+                    client_id=settings.azure_client_id or None
+                )
         return self._credential
 
     def _get_blob_client(self) -> BlobServiceClient:
diff --git a/src/api/modules/ingestion/queue_service.py b/src/api/modules/ingestion/queue_service.py
index 7d5b6e36a..403d662ef 100644
--- a/src/api/modules/ingestion/queue_service.py
+++ b/src/api/modules/ingestion/queue_service.py
@@ -5,7 +5,7 @@
 from typing import Optional
 
 from azure.core.exceptions import ResourceNotFoundError
-from azure.identity import DefaultAzureCredential
+from azure.identity import AzureCliCredential, ManagedIdentityCredential
 from azure.storage.queue import QueueClient
 
 from src.api.config import get_settings
@@ -27,7 +27,13 @@ def __init__(self):
 
     def _get_credential(self):
         if self._credential is None:
-            self._credential = DefaultAzureCredential()
+            settings = get_settings()
+            if settings.app_env.lower() == "dev":
+                self._credential = AzureCliCredential()
+            else:
+                self._credential = ManagedIdentityCredential(
+                    client_id=settings.azure_client_id or None
+                )
         return self._credential
 
     @staticmethod
diff --git a/src/api/modules/rag/models.py b/src/api/modules/rag/models.py
index 4673c1652..88ab3f50e 100644
--- a/src/api/modules/rag/models.py
+++ b/src/api/modules/rag/models.py
@@ -27,18 +27,3 @@ class QAResponse(BaseModel):
     answer: str
     sources: list[Source] = []
     model: str
-
-
-class ConversationMessage(BaseModel):
-    role: str  # "user" or "assistant"
-    content: str
-
-
-class ConversationRequest(BaseModel):
-    messages: list[ConversationMessage]
-    top_k: int = 5
-    filters: Optional[dict] = None
-    chat_scope: Literal["all", "documents", "external"] = "all"
-    document_ids: Optional[list[str]] = None
-    external_index_id: Optional[str] = None
-    conversation_id: Optional[str] = None
diff --git a/src/api/modules/rag/router.py b/src/api/modules/rag/router.py
index 694c7be97..920e30ba3 100644
--- a/src/api/modules/rag/router.py
+++ b/src/api/modules/rag/router.py
@@ -5,7 +5,7 @@
 import logging
 
 from src.api.modules.rag.service import rag_service
-from src.api.modules.rag.models import QARequest, QAResponse, ConversationRequest
+from src.api.modules.rag.models import QARequest, QAResponse
 from src.api.auth.auth_utils import get_authenticated_user_details
 
 logger = logging.getLogger(__name__)
@@ -133,19 +133,3 @@ async def ask_question(request: QARequest):
     except Exception as e:
         logger.error(f"RAG query failed: {e}", exc_info=True)
         raise HTTPException(status_code=500, detail="An error occurred while processing your question. Please try again.")
-
-
-@router.post("/conversation", response_model=QAResponse)
-async def conversation(request: ConversationRequest):
-    """Multi-turn conversation with RAG retrieval."""
-    messages = [{"role": m.role, "content": m.content} for m in request.messages]
-    try:
-        doc_ids = request.document_ids if request.chat_scope == "documents" else None
-        return await asyncio.to_thread(
-            rag_service.answer_conversation,
-            messages=messages, top_k=request.top_k, filters=request.filters, document_ids=doc_ids,
-            conversation_id=request.conversation_id,
-        )
-    except Exception as e:
-        logger.error(f"Conversation failed: {e}", exc_info=True)
-        raise HTTPException(status_code=500, detail="An error occurred during the conversation. Please try again.")
diff --git a/src/api/modules/rag/service.py b/src/api/modules/rag/service.py
index 6ff73fb95..00bddb970 100644
--- a/src/api/modules/rag/service.py
+++ b/src/api/modules/rag/service.py
@@ -855,7 +855,15 @@ def _build_scope_preamble(
             )
 
         if filters:
-            filt_lines = "\n".join(f"- {dim}: {val}" for dim, val in filters.items() if val)
+            # 'source'/'source_type'/'source_name' select the active data source, not a
+            # content facet, so exclude them here — filtering an external BYOD index by a
+            # field it lacks returns 0 hits. analytics_engine/retrieval_engine drop them too.
+            source_keys = {"source", "source_type", "source_name"}
+            filt_lines = "\n".join(
+                f"- {dim}: {val}"
+                for dim, val in filters.items()
+                if val and dim not in source_keys
+            )
             if filt_lines:
                 lines.append(
                     "Only consider content matching these filters:\n" + filt_lines
@@ -903,92 +911,5 @@ def answer_question(
             model=settings.azure_openai_chat_deployment,
         )
 
-    def answer_conversation(
-        self,
-        messages: list[dict],
-        top_k: int = 5,
-        filters: Optional[dict] = None,
-        document_ids: Optional[list[str]] = None,
-        conversation_id: Optional[str] = None,
-    ) -> QAResponse:
-        """Multi-turn conversation with RAG context."""
-        settings = get_settings()
-
-        last_user_message = ""
-        for msg in reversed(messages):
-            if msg["role"] == "user":
-                last_user_message = msg["content"]
-                break
-
-        if not last_user_message:
-            return QAResponse(
-                question="", answer="No user message found.", sources=[], model=settings.azure_openai_chat_deployment
-            )
-
-        # Filter scoping
-        if filters and not document_ids:
-            from src.api.modules.ingestion.service import ingestion_service
-            matching_ids = self._filter_document_ids(filters, ingestion_service)
-            if matching_ids is not None:
-                document_ids = matching_ids
-
-        from src.api.modules.runtime.retrieval_engine import retrieval_engine
-        search_docs = retrieval_engine.retrieve(
-            query=last_user_message,
-            top_k=top_k,
-            filters=filters,
-            document_ids=document_ids,
-            source="all",
-        )
-
-        # Also inject blob text for 'extracted'-status files not yet in AI Search
-        if document_ids:
-            extracted_docs = self._build_extracted_context(document_ids, last_user_message)
-            indexed_ids = {d["doc_id"] for d in search_docs}
-            for doc in extracted_docs:
-                if doc["doc_id"] not in indexed_ids:
-                    search_docs.append(doc)
-        else:
-            from src.api.modules.ingestion.service import ingestion_service
-            ingestion_service._ensure_loaded()
-            extracted_ids = [
-                f.id for f in ingestion_service._uploaded_files.values()
-                if f.status == "extracted"
-            ]
-            if extracted_ids:
-                search_docs.extend(self._build_extracted_context(extracted_ids, last_user_message))
-
-        search_docs = self._filter_noise_docs(search_docs, "answer-conversation-post-merge")
-
-        sources = []
-        for i, doc in enumerate(search_docs):
-            text = doc["text"][:4000]
-            sources.append(Source(
-                doc_id=doc["doc_id"], score=round(doc.get("score", 0), 4),
-                text=text[:500],
-                source_file=doc.get("source_file", ""),
-            ))
-
-        all_messages = "\n".join(f"{m['role']}: {m['content']}" for m in messages)
-        try:
-            answer, agent_sources = self._run_agent(all_messages, conversation_id)
-        except Exception as e:
-            logger.warning(f"Agent call failed in answer_conversation, using fallback answer: {e}")
-            answer = self._build_fallback_answer(last_user_message, search_docs)
-            agent_sources = []
-
-        if not (answer or "").strip() or _is_unhelpful_answer(answer):
-            logger.warning("Agent answer was empty/unhelpful in answer_conversation, using grounded fallback")
-            answer = self._build_grounded_answer(last_user_message, search_docs)
-
-        combined_sources = self._merge_sources(agent_sources, sources)
-        combined_sources = self._filter_noise_sources(combined_sources, "answer-conversation-response")
-        return QAResponse(
-            question=last_user_message,
-            answer=_strip_links_from_answer(answer),
-            sources=combined_sources,
-            model=settings.azure_openai_chat_deployment,
-        )
-
 
 rag_service = RAGService()
diff --git a/src/api/requirements.txt b/src/api/requirements.txt
index e20c86ae7..255b78e8a 100644
--- a/src/api/requirements.txt
+++ b/src/api/requirements.txt
@@ -14,7 +14,7 @@ agent-framework-foundry==1.8.2
 cachetools==5.5.2
 aiohttp==3.14.3
 numpy==2.4.6
-azure-identity==1.19.0
+azure-identity==1.25.3
 azure-search-documents==11.6.0b8
 azure-storage-blob==12.24.1
 azure-storage-queue==12.12.0
diff --git a/src/app/WebApp.Dockerfile b/src/app/WebApp.Dockerfile
index 82483cdc7..80f5fcc0b 100644
--- a/src/app/WebApp.Dockerfile
+++ b/src/app/WebApp.Dockerfile
@@ -19,6 +19,9 @@ COPY --from=build /home/node/app/build /usr/share/nginx/html
 # SPA fallback for client-side routing (BrowserRouter) so deep-link refreshes don't 404
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 
+# Placeholder for the /api reverse-proxy include; startup.sh rewrites it per environment
+RUN touch /etc/nginx/conf.d/api-proxy.inc
+
 COPY public/startup.sh /usr/share/nginx/html/startup.sh
 RUN chmod +x /usr/share/nginx/html/startup.sh && sed -i 's/\r$//' /usr/share/nginx/html/startup.sh
 
diff --git a/src/app/nginx.conf b/src/app/nginx.conf
index a570e759c..1d92aca6c 100644
--- a/src/app/nginx.conf
+++ b/src/app/nginx.conf
@@ -20,6 +20,12 @@ server {
         add_header Cache-Control "public, immutable";
     }
 
+    # Reverse-proxy API calls to the backend App Service. Populated at container
+    # startup from BACKEND_API_HOST (private-networking mode, where the backend
+    # has no public endpoint); empty in public mode where the SPA calls the
+    # backend URL directly.
+    include /etc/nginx/conf.d/api-proxy.inc;
+
     # SPA fallback for client-side routing (React Router)
     location / {
         try_files $uri $uri/ /index.html;
diff --git a/src/app/package-lock.json b/src/app/package-lock.json
index 27da43681..41e7db397 100644
--- a/src/app/package-lock.json
+++ b/src/app/package-lock.json
@@ -16,6 +16,7 @@
         "axios": "^1.16.0",
         "chart.js": "^4.5.1",
         "d3": "^7.9.0",
+        "nanoid": "^3.3.18",
         "react": "^18.3.1",
         "react-chartjs-2": "^5.3.1",
         "react-dom": "^18.3.1",
@@ -33,8 +34,8 @@
     },
     "node_modules/@alloc/quick-lru": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
-      "integrity": "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
+      "integrity": "sha1-e/aLIMCjUPk2kV/K4G9Y4yAHzjA=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -45,8 +46,8 @@
     },
     "node_modules/@apideck/better-ajv-errors": {
       "version": "0.3.7",
-      "resolved": "https://registry.npmjs.org/@apideck/better-ajv-errors/-/better-ajv-errors-0.3.7.tgz",
-      "integrity": "sha512-TajUJwGWbDwkCx/CZi7tRE8PVB7simCvKJfHUsSdvps+aTM/PDPP4gkLmKnc+x3CE//y9i/nj74GqdL/hwk7Iw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@apideck/better-ajv-errors/-/better-ajv-errors-0.3.7.tgz",
+      "integrity": "sha1-iSOPaJ2BpkQTmkfg68LiNryh/yw=",
       "license": "MIT",
       "dependencies": {
         "jsonpointer": "^5.0.1",
@@ -61,8 +62,8 @@
     },
     "node_modules/@azure/msal-browser": {
       "version": "3.30.0",
-      "resolved": "https://registry.npmjs.org/@azure/msal-browser/-/msal-browser-3.30.0.tgz",
-      "integrity": "sha512-I0XlIGVdM4E9kYP5eTjgW8fgATdzwxJvQ6bm2PNiHaZhEuUz47NYw1xHthC9R+lXz4i9zbShS0VdLyxd7n0GGA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@azure/msal-browser/-/msal-browser-3.30.0.tgz",
+      "integrity": "sha1-iHxEF3ENN1UGvgQVVkmaDZL8YuA=",
       "license": "MIT",
       "dependencies": {
         "@azure/msal-common": "14.16.1"
@@ -73,8 +74,8 @@
     },
     "node_modules/@azure/msal-common": {
       "version": "14.16.1",
-      "resolved": "https://registry.npmjs.org/@azure/msal-common/-/msal-common-14.16.1.tgz",
-      "integrity": "sha512-nyxsA6NA4SVKh5YyRpbSXiMr7oQbwark7JU9LMeg6tJYTSPyAGkdx61wPT4gyxZfxlSxMMEyAsWaubBlNyIa1w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@azure/msal-common/-/msal-common-14.16.1.tgz",
+      "integrity": "sha1-0j7M5AgjpNA610Fg3IGdYuDAp4c=",
       "license": "MIT",
       "engines": {
         "node": ">=0.8.0"
@@ -82,8 +83,8 @@
     },
     "node_modules/@azure/msal-react": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@azure/msal-react/-/msal-react-2.2.0.tgz",
-      "integrity": "sha512-2V+9JXeXyyjYNF92y5u0tU4el9px/V1+vkRuN+DtoxyiMHCtYQpJoaFdGWArh43zhz5aqQqiGW/iajPDSu3QsQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@azure/msal-react/-/msal-react-2.2.0.tgz",
+      "integrity": "sha1-yJKODzO/eoiCehyUiLYqS9TJLjQ=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -95,8 +96,8 @@
     },
     "node_modules/@babel/code-frame": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
-      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha1-8vu/6ofESiFZDsUVt3iywm2IZuc=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-validator-identifier": "^7.29.7",
@@ -109,8 +110,8 @@
     },
     "node_modules/@babel/compat-data": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
-      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha1-bwI38PNtLlHAVwpjb67Z0tDv5ik=",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -118,8 +119,8 @@
     },
     "node_modules/@babel/core": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
-      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha1-gMELFySAgpaLV6hXuRZAlx8gcPc=",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.29.7",
@@ -148,8 +149,8 @@
     },
     "node_modules/@babel/core/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -157,8 +158,8 @@
     },
     "node_modules/@babel/eslint-parser": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/eslint-parser/-/eslint-parser-7.29.7.tgz",
-      "integrity": "sha512-zxt+UJTOMKvUt3yOg+D58MLuz334pHp93qifMFcjIIO+9hN6t+ufw2gi7vDPMpxvfnHRR+3VVXvIjineCcgyXw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/eslint-parser/-/eslint-parser-7.29.7.tgz",
+      "integrity": "sha1-JyzHUxly/0W8DblsRTSctzBNIeE=",
       "license": "MIT",
       "dependencies": {
         "@nicolo-ribaudo/eslint-scope-5-internals": "5.1.1-v1",
@@ -175,8 +176,8 @@
     },
     "node_modules/@babel/eslint-parser/node_modules/eslint-visitor-keys": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
-      "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
+      "integrity": "sha1-9lMoJZMFknOSyTjtROsKXJsr0wM=",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=10"
@@ -184,8 +185,8 @@
     },
     "node_modules/@babel/eslint-parser/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -193,8 +194,8 @@
     },
     "node_modules/@babel/generator": {
       "version": "7.29.8",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
-      "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/generator/-/generator-7.29.8.tgz",
+      "integrity": "sha1-SwuIeIVCJkMzngkCIUikxOuqSXk=",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.29.8",
@@ -209,8 +210,8 @@
     },
     "node_modules/@babel/helper-annotate-as-pure": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.29.7.tgz",
-      "integrity": "sha512-OoK6239jHPuSQOoS0kfTVKn0b/rVTk0seKq4Gd2UMLtmOVLjDC0ki3e+c90Trqv2gMfvJFqkiljrr568+qddiw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-annotate-as-pure/-/helper-annotate-as-pure-7.29.7.tgz",
+      "integrity": "sha1-xw/jxuy9w/0t0bD0mEKLiLgs5H8=",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.29.7"
@@ -221,8 +222,8 @@
     },
     "node_modules/@babel/helper-compilation-targets": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
-      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha1-eh3vcEMCQBxH9k+oVYnpdK4hcEI=",
       "license": "MIT",
       "dependencies": {
         "@babel/compat-data": "^7.29.7",
@@ -237,8 +238,8 @@
     },
     "node_modules/@babel/helper-compilation-targets/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -246,8 +247,8 @@
     },
     "node_modules/@babel/helper-create-class-features-plugin": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.29.7.tgz",
-      "integrity": "sha512-IY3ZD9Tmooqr3TUhc3DUWxiuo8xx1DWLhd5M7hQ+ZWJamqM2BbalrBJb2MisSLoYorOj75U03qULCxQTY9r3hg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-create-class-features-plugin/-/helper-create-class-features-plugin-7.29.7.tgz",
+      "integrity": "sha1-bt3yhvLsQY90DJHWCoM0fFWDjd0=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-annotate-as-pure": "^7.29.7",
@@ -267,8 +268,8 @@
     },
     "node_modules/@babel/helper-create-class-features-plugin/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -276,8 +277,8 @@
     },
     "node_modules/@babel/helper-create-regexp-features-plugin": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.29.7.tgz",
-      "integrity": "sha512-907Uymvqgg1dwUA+7IGwFAOSYzQOuzPXKNJ1yxzwPffzkYFg2q2eHi1fIOs6sXkG9NbIUMunnUlkYsfRFNvomg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-create-regexp-features-plugin/-/helper-create-regexp-features-plugin-7.29.7.tgz",
+      "integrity": "sha1-XUw/ko8xXPbEGE6i/DtbOHRbJDA=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-annotate-as-pure": "^7.29.7",
@@ -293,8 +294,8 @@
     },
     "node_modules/@babel/helper-create-regexp-features-plugin/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -302,8 +303,8 @@
     },
     "node_modules/@babel/helper-define-polyfill-provider": {
       "version": "0.6.8",
-      "resolved": "https://registry.npmjs.org/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.6.8.tgz",
-      "integrity": "sha512-47UwBLPpQi1NoWzLuHNjRoHlYXMwIJoBf7MFou6viC/sIHWYygpvr0B6IAyh5sBdA2nr2LPIRww8lfaUVQINBA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-define-polyfill-provider/-/helper-define-polyfill-provider-0.6.8.tgz",
+      "integrity": "sha1-zx5EYrYT8rVMQeb/dY1d/KoshdE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-compilation-targets": "^7.28.6",
@@ -318,8 +319,8 @@
     },
     "node_modules/@babel/helper-globals": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
-      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha1-8EqW+9hHMkGxB5JD9bPwOjAQq3s=",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -327,8 +328,8 @@
     },
     "node_modules/@babel/helper-member-expression-to-functions": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.29.7.tgz",
-      "integrity": "sha512-j+7JYmk1JYDtACIGj0QJqqWZjoUpMoEikQGADMaHgCMCSDqd2+P32rfcibUNrGOMWrlzK1WJBdxrB3JJQZwWtg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.29.7.tgz",
+      "integrity": "sha1-jb2zzgtcSH4a7BDhPJpDpQCBTfg=",
       "license": "MIT",
       "dependencies": {
         "@babel/traverse": "^7.29.7",
@@ -340,8 +341,8 @@
     },
     "node_modules/@babel/helper-module-imports": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
-      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha1-7yUEilGOgo1zk/rFiC3dc5Idc5Y=",
       "license": "MIT",
       "dependencies": {
         "@babel/traverse": "^7.29.7",
@@ -353,8 +354,8 @@
     },
     "node_modules/@babel/helper-module-transforms": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
-      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha1-sGJ0elmXuhOGNyATKLv/d5YFdK4=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-module-imports": "^7.29.7",
@@ -370,8 +371,8 @@
     },
     "node_modules/@babel/helper-optimise-call-expression": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.29.7.tgz",
-      "integrity": "sha512-+kmGVjcT9RGYzoDwdwEqEvGgKe3BYq+O1iGzjFubaNgZHwYHP6lsF2Yghf4kEuv9BV7tYDZ913aBW9am6YKong==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.29.7.tgz",
+      "integrity": "sha1-d7C1uU8Zl/qdbjEl9EUiex+vnYU=",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.29.7"
@@ -382,8 +383,8 @@
     },
     "node_modules/@babel/helper-plugin-utils": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
-      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
+      "integrity": "sha1-wKB2bxoTYX2KF0B9erj51IYiXqQ=",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -391,8 +392,8 @@
     },
     "node_modules/@babel/helper-remap-async-to-generator": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.29.7.tgz",
-      "integrity": "sha512-16AMiW26DbXWBbr3B8wNozKM0ydMLB892vaOaJW/fPJdnT8vJk5sdkQcU/isqUxyCE0cEoa8wZOcbgDuC4b6Og==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-remap-async-to-generator/-/helper-remap-async-to-generator-7.29.7.tgz",
+      "integrity": "sha1-NLH2jddbhtMd94GinD/y34jaguY=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-annotate-as-pure": "^7.29.7",
@@ -408,8 +409,8 @@
     },
     "node_modules/@babel/helper-replace-supers": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.29.7.tgz",
-      "integrity": "sha512-atfGXWSeCiF4DnKZIfmJfQRkSw9b9gNNXR1kqKjbhG4pGYCOnkp8OcTB8E3NXjBu8NpheSnOeNKz8KT7UNFTmQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-replace-supers/-/helper-replace-supers-7.29.7.tgz",
+      "integrity": "sha1-vDw5ZDKQQ8eREuUTwbGY8WWJrCE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-member-expression-to-functions": "^7.29.7",
@@ -425,8 +426,8 @@
     },
     "node_modules/@babel/helper-skip-transparent-expression-wrappers": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.29.7.tgz",
-      "integrity": "sha512-brcMGQaVzIeUb+6/bs1Av0f8YuNNjKY2JyvfRCsFuFsdKccEQ5Ges2y74D74NZ1Rz8lKJ9ksJkfqwQFJ/iNEyQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-skip-transparent-expression-wrappers/-/helper-skip-transparent-expression-wrappers-7.29.7.tgz",
+      "integrity": "sha1-UMlcfkxPVJNs+gEWQo7cVZhi1VE=",
       "license": "MIT",
       "dependencies": {
         "@babel/traverse": "^7.29.7",
@@ -438,8 +439,8 @@
     },
     "node_modules/@babel/helper-string-parser": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
-      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha1-fwhx2Zgk0jE31g+G/PYTD9WhtR8=",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -447,8 +448,8 @@
     },
     "node_modules/@babel/helper-validator-identifier": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
-      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha1-vYcITO0MeW7Ea9pJLeboPSnon8I=",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -456,8 +457,8 @@
     },
     "node_modules/@babel/helper-validator-option": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
-      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha1-zzFb6UAhOzVOtKvMC9Aevj9zvCo=",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -465,8 +466,8 @@
     },
     "node_modules/@babel/helper-wrap-function": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-wrap-function/-/helper-wrap-function-7.29.7.tgz",
-      "integrity": "sha512-iES0Skag9ERIF68aXadpO6dbXa03mNWK3sEqJaMnLNs/eC3l0lkImdfoy6Y09/SfkpawdAB4RjQ7PVA7TcVGdw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helper-wrap-function/-/helper-wrap-function-7.29.7.tgz",
+      "integrity": "sha1-7schYwRFSKCTXp0YK/LVR+xf9IM=",
       "license": "MIT",
       "dependencies": {
         "@babel/template": "^7.29.7",
@@ -479,8 +480,8 @@
     },
     "node_modules/@babel/helpers": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
-      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha1-Rav951SJl+NDdsPmn+tHXP+0pgc=",
       "license": "MIT",
       "dependencies": {
         "@babel/template": "^7.29.7",
@@ -492,8 +493,8 @@
     },
     "node_modules/@babel/parser": {
       "version": "7.29.8",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
-      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/parser/-/parser-7.29.8.tgz",
+      "integrity": "sha1-llNxai8Qxne5j7xj1L+wAMMCzxc=",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.29.8"
@@ -507,8 +508,8 @@
     },
     "node_modules/@babel/plugin-bugfix-firefox-class-in-computed-class-key": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-firefox-class-in-computed-class-key/-/plugin-bugfix-firefox-class-in-computed-class-key-7.29.7.tgz",
-      "integrity": "sha512-j8SrR0zLZrRsC09DlszEx8FpMiwukKffYXMK0d5LmOglO7vGG6sz/BR/20yHqWH+Lnn31JTt2PE3hIWNgM2J6w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-bugfix-firefox-class-in-computed-class-key/-/plugin-bugfix-firefox-class-in-computed-class-key-7.29.7.tgz",
+      "integrity": "sha1-K1NYltkzqFqpI3fqo9UaQ31UpOM=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -523,8 +524,8 @@
     },
     "node_modules/@babel/plugin-bugfix-safari-class-field-initializer-scope": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-class-field-initializer-scope/-/plugin-bugfix-safari-class-field-initializer-scope-7.29.7.tgz",
-      "integrity": "sha512-r8j8escF+U2FUHo0KOhPUdMzUO+jp9fInva6+ACVAF3Y97Ev+5iNZwiqTghmzNeWwDkOPlYuTcfb1vDaoZKmAQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-bugfix-safari-class-field-initializer-scope/-/plugin-bugfix-safari-class-field-initializer-scope-7.29.7.tgz",
+      "integrity": "sha1-sAcRqeUr9P5V735Usu9KiBv4BMg=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -538,8 +539,8 @@
     },
     "node_modules/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.29.7.tgz",
-      "integrity": "sha512-GE1TFSiuFeGsCxmYXZl8HwoPrVlwe4rHPFE8weieGKZqnDORK+Ar3vgWMgW+AOxQ6/2TgLSKx9p6W7O4rC6qgQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression/-/plugin-bugfix-safari-id-destructuring-collision-in-function-expression-7.29.7.tgz",
+      "integrity": "sha1-I3UyiFICajz2vAvPLefSNvLV5wE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -553,8 +554,8 @@
     },
     "node_modules/@babel/plugin-bugfix-safari-rest-destructuring-rhs-array": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-safari-rest-destructuring-rhs-array/-/plugin-bugfix-safari-rest-destructuring-rhs-array-7.29.7.tgz",
-      "integrity": "sha512-oBNVCvnO5tND+xSopWvV8WNGfpTfgP4Zr/YXXSj8zfmcPktp5Ku/aZlsIowgSD4fjmgHn6sGmB9APVsU5zOdhA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-bugfix-safari-rest-destructuring-rhs-array/-/plugin-bugfix-safari-rest-destructuring-rhs-array-7.29.7.tgz",
+      "integrity": "sha1-dZqFfEbE0qYZloXPcQcNga5fdDo=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -569,8 +570,8 @@
     },
     "node_modules/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.29.7.tgz",
-      "integrity": "sha512-QQt9qKHZ2sg/kivaLr7lnQr8HVrQDdBNSfCsTjiDxRuX/K5ORyKq+Bu8Xr0cDE3Dfkv0cw28Ve0EKyKMvulkOw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-bugfix-v8-spread-parameters-in-optional-chaining/-/plugin-bugfix-v8-spread-parameters-in-optional-chaining-7.29.7.tgz",
+      "integrity": "sha1-ht6Y3Y4Dg2F4Ix6pbCfasmAWpwU=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -586,8 +587,8 @@
     },
     "node_modules/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/-/plugin-bugfix-v8-static-class-fields-redefine-readonly-7.29.7.tgz",
-      "integrity": "sha512-pn6QacGLgvCcwc+syUhKE/qSjV2D1IHDB84RNxWYSt1mW3K/SCtjinZ2p0cETJxAWBjPy3K/1lHwG5BjjPxNlw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-bugfix-v8-static-class-fields-redefine-readonly/-/plugin-bugfix-v8-static-class-fields-redefine-readonly-7.29.7.tgz",
+      "integrity": "sha1-9diSaB2/Swh1NDal5VAA1bpyjW0=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -602,8 +603,8 @@
     },
     "node_modules/@babel/plugin-proposal-class-properties": {
       "version": "7.18.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.18.6.tgz",
-      "integrity": "sha512-cumfXOF0+nzZrrN8Rf0t7M+tF6sZc7vhQwYQck9q1/5w2OExlD+b4v4RpMJFaV1Z7WcDRgO6FqvxqxGlwo+RHQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-proposal-class-properties/-/plugin-proposal-class-properties-7.18.6.tgz",
+      "integrity": "sha1-sRD1l0GJX37CGm//aW7EYmXERqM=",
       "deprecated": "This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-class-properties instead.",
       "license": "MIT",
       "dependencies": {
@@ -619,8 +620,8 @@
     },
     "node_modules/@babel/plugin-proposal-decorators": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-decorators/-/plugin-proposal-decorators-7.29.7.tgz",
-      "integrity": "sha512-EtU0Hi3GvrTqD56xKmZvV/uCXK2ZbwVNPNLAquVItcAZpUhkXwWlo3Fmj0c2LxgSf2I8IDULeAepwNP1OefLXg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-proposal-decorators/-/plugin-proposal-decorators-7.29.7.tgz",
+      "integrity": "sha1-68V71NcR35IKVT3opFajoCDODXI=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-class-features-plugin": "^7.29.7",
@@ -636,8 +637,8 @@
     },
     "node_modules/@babel/plugin-proposal-nullish-coalescing-operator": {
       "version": "7.18.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.18.6.tgz",
-      "integrity": "sha512-wQxQzxYeJqHcfppzBDnm1yAY0jSRkUXR2z8RePZYrKwMKgMlE8+Z6LUno+bd6LvbGh8Gltvy74+9pIYkr+XkKA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-proposal-nullish-coalescing-operator/-/plugin-proposal-nullish-coalescing-operator-7.18.6.tgz",
+      "integrity": "sha1-/dlAqZp0Dld9bHU6tvu0P9uUZ+E=",
       "deprecated": "This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-nullish-coalescing-operator instead.",
       "license": "MIT",
       "dependencies": {
@@ -653,8 +654,8 @@
     },
     "node_modules/@babel/plugin-proposal-numeric-separator": {
       "version": "7.18.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.18.6.tgz",
-      "integrity": "sha512-ozlZFogPqoLm8WBr5Z8UckIoE4YQ5KESVcNudyXOR8uqIkliTEgJ3RoketfG6pmzLdeZF0H/wjE9/cCEitBl7Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-proposal-numeric-separator/-/plugin-proposal-numeric-separator-7.18.6.tgz",
+      "integrity": "sha1-iZsU+6/ofwU9LF/wWzYCnGLhPHU=",
       "deprecated": "This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-numeric-separator instead.",
       "license": "MIT",
       "dependencies": {
@@ -670,8 +671,8 @@
     },
     "node_modules/@babel/plugin-proposal-optional-chaining": {
       "version": "7.21.0",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.21.0.tgz",
-      "integrity": "sha512-p4zeefM72gpmEe2fkUr/OnOXpWEf8nAgk7ZYVqqfFiyIG7oFfVZcCrU64hWn5xp4tQ9LkV4bTIa5rD0KANpKNA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-proposal-optional-chaining/-/plugin-proposal-optional-chaining-7.21.0.tgz",
+      "integrity": "sha1-iG9ciXjet9MPZ4suJDRrKHI00+o=",
       "deprecated": "This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-optional-chaining instead.",
       "license": "MIT",
       "dependencies": {
@@ -688,8 +689,8 @@
     },
     "node_modules/@babel/plugin-proposal-private-methods": {
       "version": "7.18.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.18.6.tgz",
-      "integrity": "sha512-nutsvktDItsNn4rpGItSNV2sz1XwS+nfU0Rg8aCx3W3NOKVzdMjJRu0O5OkgDp3ZGICSTbgRpxZoWsxoKRvbeA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-proposal-private-methods/-/plugin-proposal-private-methods-7.18.6.tgz",
+      "integrity": "sha1-UgnefSE0V1SKmENvoogvUvS+a+o=",
       "deprecated": "This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-methods instead.",
       "license": "MIT",
       "dependencies": {
@@ -705,8 +706,8 @@
     },
     "node_modules/@babel/plugin-proposal-private-property-in-object": {
       "version": "7.21.0-placeholder-for-preset-env.2",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.21.0-placeholder-for-preset-env.2.tgz",
-      "integrity": "sha512-SOSkfJDddaM7mak6cPEpswyTRnuRltl429hMraQEglW+OkovnCzsiszTmsrlY//qLFjCpQDFRvjdm2wA5pPm9w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.21.0-placeholder-for-preset-env.2.tgz",
+      "integrity": "sha1-eET5KJVG76n+usLeTP41igUL1wM=",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -717,8 +718,8 @@
     },
     "node_modules/@babel/plugin-syntax-async-generators": {
       "version": "7.8.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
-      "integrity": "sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-async-generators/-/plugin-syntax-async-generators-7.8.4.tgz",
+      "integrity": "sha1-qYP7Gusuw/btBCohD2QOkOeG/g0=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.8.0"
@@ -729,8 +730,8 @@
     },
     "node_modules/@babel/plugin-syntax-bigint": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz",
-      "integrity": "sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-bigint/-/plugin-syntax-bigint-7.8.3.tgz",
+      "integrity": "sha1-TJpvZp9dDN8bkKFnHpoUa+UwDOo=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.8.0"
@@ -741,8 +742,8 @@
     },
     "node_modules/@babel/plugin-syntax-class-properties": {
       "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
-      "integrity": "sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-class-properties/-/plugin-syntax-class-properties-7.12.13.tgz",
+      "integrity": "sha1-tcmHJ0xKOoK4lxR5aTGmtTVErhA=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.12.13"
@@ -753,8 +754,8 @@
     },
     "node_modules/@babel/plugin-syntax-class-static-block": {
       "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
-      "integrity": "sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-class-static-block/-/plugin-syntax-class-static-block-7.14.5.tgz",
+      "integrity": "sha1-GV34mxRrS3izv4l/16JXyEZZ1AY=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.14.5"
@@ -768,8 +769,8 @@
     },
     "node_modules/@babel/plugin-syntax-decorators": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-decorators/-/plugin-syntax-decorators-7.29.7.tgz",
-      "integrity": "sha512-9MTTLbF39X6sqM92JPEsoI7++26hjZvzkxKZy64aMhWLH2mPkJ/Q3AV4QLmls3R14FpSpkOwQQfUh962JGQxxg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-decorators/-/plugin-syntax-decorators-7.29.7.tgz",
+      "integrity": "sha1-miOrkfuOYdFCaEEIvKbzQ87uiPY=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -783,8 +784,8 @@
     },
     "node_modules/@babel/plugin-syntax-flow": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-flow/-/plugin-syntax-flow-7.29.7.tgz",
-      "integrity": "sha512-ajMX6QPcyomotqwpzhkYGxcK2i/us0rs1Qo9QvUpa+Fca0FTmqrzKrctoIYLMxcOhGZldGT/BAVkRGTWBiR8gQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-flow/-/plugin-syntax-flow-7.29.7.tgz",
+      "integrity": "sha1-PzJ4wRyJbEO/gJglCBl4X9EjGIE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -798,8 +799,8 @@
     },
     "node_modules/@babel/plugin-syntax-import-assertions": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.29.7.tgz",
-      "integrity": "sha512-/An1OCBN93thpBAGyfsK2pcf0jvju1SAtKkL2Ny++B5Sy6sqgzXDQH1cZxWbF96Wuk+bn41MDA9bLd4VVAw6rw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-import-assertions/-/plugin-syntax-import-assertions-7.29.7.tgz",
+      "integrity": "sha1-xc2GhQUmkSbMGIguHwH3sODiS04=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -813,8 +814,8 @@
     },
     "node_modules/@babel/plugin-syntax-import-attributes": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.29.7.tgz",
-      "integrity": "sha512-zGYcYfq/WmZ4V+kBIXQon9dSSc8ircGZqw9ZaNhhGj9nZkeBu1jHLBDQqYYi5WA9uawvA2sIMbry2nCFhf5Djg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.29.7.tgz",
+      "integrity": "sha1-YRUmRRbpXq0PNaQXEJBmEuRH9gU=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -828,8 +829,8 @@
     },
     "node_modules/@babel/plugin-syntax-import-meta": {
       "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
-      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
+      "integrity": "sha1-7mATSMNw+jNNIge+FYd3SWUh/VE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.10.4"
@@ -840,8 +841,8 @@
     },
     "node_modules/@babel/plugin-syntax-json-strings": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
-      "integrity": "sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-json-strings/-/plugin-syntax-json-strings-7.8.3.tgz",
+      "integrity": "sha1-AcohtmjNghjJ5kDLbdiMVBKyyWo=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.8.0"
@@ -852,8 +853,8 @@
     },
     "node_modules/@babel/plugin-syntax-jsx": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.29.7.tgz",
-      "integrity": "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.29.7.tgz",
+      "integrity": "sha1-YiwW+a1jeC/m6D2tx+QDMHRLfx4=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -867,8 +868,8 @@
     },
     "node_modules/@babel/plugin-syntax-logical-assignment-operators": {
       "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
-      "integrity": "sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-logical-assignment-operators/-/plugin-syntax-logical-assignment-operators-7.10.4.tgz",
+      "integrity": "sha1-ypHvRjA1MESLkGZSusLp/plB9pk=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.10.4"
@@ -879,8 +880,8 @@
     },
     "node_modules/@babel/plugin-syntax-nullish-coalescing-operator": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
-      "integrity": "sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-nullish-coalescing-operator/-/plugin-syntax-nullish-coalescing-operator-7.8.3.tgz",
+      "integrity": "sha1-Fn7XA2iIYIH3S1w2xlqIwDtm0ak=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.8.0"
@@ -891,8 +892,8 @@
     },
     "node_modules/@babel/plugin-syntax-numeric-separator": {
       "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
-      "integrity": "sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-numeric-separator/-/plugin-syntax-numeric-separator-7.10.4.tgz",
+      "integrity": "sha1-ubBws+M1cM2f0Hun+pHA3Te5r5c=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.10.4"
@@ -903,8 +904,8 @@
     },
     "node_modules/@babel/plugin-syntax-object-rest-spread": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
-      "integrity": "sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-object-rest-spread/-/plugin-syntax-object-rest-spread-7.8.3.tgz",
+      "integrity": "sha1-YOIl7cvZimQDMqLnLdPmbxr1WHE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.8.0"
@@ -915,8 +916,8 @@
     },
     "node_modules/@babel/plugin-syntax-optional-catch-binding": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
-      "integrity": "sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-optional-catch-binding/-/plugin-syntax-optional-catch-binding-7.8.3.tgz",
+      "integrity": "sha1-YRGiZbz7Ag6579D9/X0mQCue1sE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.8.0"
@@ -927,8 +928,8 @@
     },
     "node_modules/@babel/plugin-syntax-optional-chaining": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
-      "integrity": "sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-optional-chaining/-/plugin-syntax-optional-chaining-7.8.3.tgz",
+      "integrity": "sha1-T2nCq5UWfgGAzVM2YT+MV4j31Io=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.8.0"
@@ -939,8 +940,8 @@
     },
     "node_modules/@babel/plugin-syntax-private-property-in-object": {
       "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
-      "integrity": "sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-private-property-in-object/-/plugin-syntax-private-property-in-object-7.14.5.tgz",
+      "integrity": "sha1-DcZnHsDqIrbpShEU+FeXDNOd4a0=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.14.5"
@@ -954,8 +955,8 @@
     },
     "node_modules/@babel/plugin-syntax-top-level-await": {
       "version": "7.14.5",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
-      "integrity": "sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-top-level-await/-/plugin-syntax-top-level-await-7.14.5.tgz",
+      "integrity": "sha1-wc/a3DWmRiQAAfBhOCR7dBw02Uw=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.14.5"
@@ -969,8 +970,8 @@
     },
     "node_modules/@babel/plugin-syntax-typescript": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.29.7.tgz",
-      "integrity": "sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.29.7.tgz",
+      "integrity": "sha1-fCk4iTIxPtWEE6A0MEjXXZL7WyQ=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -984,8 +985,8 @@
     },
     "node_modules/@babel/plugin-syntax-unicode-sets-regex": {
       "version": "7.18.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-unicode-sets-regex/-/plugin-syntax-unicode-sets-regex-7.18.6.tgz",
-      "integrity": "sha512-727YkEAPwSIQTv5im8QHz3upqp92JTWhidIC81Tdx4VJYIte/VndKf1qKrfnnhPLiPghStWfvC/iFaMCQu7Nqg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-syntax-unicode-sets-regex/-/plugin-syntax-unicode-sets-regex-7.18.6.tgz",
+      "integrity": "sha1-1Jo7PmtS5b5nQAIjF1gCNKakc1c=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-regexp-features-plugin": "^7.18.6",
@@ -1000,8 +1001,8 @@
     },
     "node_modules/@babel/plugin-transform-arrow-functions": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.29.7.tgz",
-      "integrity": "sha512-N7zArUXWzAMzm+/N0uPBeVB3Fam5lMxtUwMmDK5f/IBBS7a7p1qeUoxd/6CckXoxUdgsntq1Dh8xNW06maZbDQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-arrow-functions/-/plugin-transform-arrow-functions-7.29.7.tgz",
+      "integrity": "sha1-1lE0P1YsA/R5Ub0YAhldDhBgXyc=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1015,8 +1016,8 @@
     },
     "node_modules/@babel/plugin-transform-async-generator-functions": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-generator-functions/-/plugin-transform-async-generator-functions-7.29.7.tgz",
-      "integrity": "sha512-d98gXZkgswvkyohMBABkhm3GeXhYj8psWfwQ2C7gtfrKGTykQa/iOIi+JJhwMjPlZ6Vm2XN+DCf3Es1EoG4ZLA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-async-generator-functions/-/plugin-transform-async-generator-functions-7.29.7.tgz",
+      "integrity": "sha1-pTZWF5IdgqH+4zEkoRArs4oeZ30=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -1032,8 +1033,8 @@
     },
     "node_modules/@babel/plugin-transform-async-to-generator": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.29.7.tgz",
-      "integrity": "sha512-pcUb2SS+RMo9TWVBwKGI5ShtoG7R+zBsFmCKDa6fe8c+hPr3XJlZgoE5j6i8W7gDjhyvy+85vmYexanvXh3d1w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-async-to-generator/-/plugin-transform-async-to-generator-7.29.7.tgz",
+      "integrity": "sha1-O16PH7WBM89wG88LqvbwG/0aiIk=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-module-imports": "^7.29.7",
@@ -1049,8 +1050,8 @@
     },
     "node_modules/@babel/plugin-transform-block-scoped-functions": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.29.7.tgz",
-      "integrity": "sha512-cUSmjh72N+rN4PrkFlN1dJwNCwjVp5d38/CQrEsFggkD10UiFlBFgdH3tv5dNsLuHY+3S8db2xCHjhZcv5WgvA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-block-scoped-functions/-/plugin-transform-block-scoped-functions-7.29.7.tgz",
+      "integrity": "sha1-ltKSY0Q0CC1mh7zbgROa/+33fow=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1064,8 +1065,8 @@
     },
     "node_modules/@babel/plugin-transform-block-scoping": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.29.7.tgz",
-      "integrity": "sha512-ONyr4+AZhKh8yKWInVxU9AXA9EbsyeLcL6V0dJy6M2/62vuvpGm29zzuymbTpdc451GEpDIdAyPLP3r+P61yKQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-block-scoping/-/plugin-transform-block-scoping-7.29.7.tgz",
+      "integrity": "sha1-uqN2aRrhYkTNFDNUIvymkA9U4X0=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1079,8 +1080,8 @@
     },
     "node_modules/@babel/plugin-transform-class-properties": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-class-properties/-/plugin-transform-class-properties-7.29.7.tgz",
-      "integrity": "sha512-GtcpjFvanPfzNQi3eTitsCqtRRmmqzpy/A+yhTR1HaZo1Ly3EA8ZXxlPyHdR8/IuRMYc3E4wdGBewB2QKQjAaA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-class-properties/-/plugin-transform-class-properties-7.29.7.tgz",
+      "integrity": "sha1-A0iXuKIb7sFjMy+sLeI1sUQJq98=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-class-features-plugin": "^7.29.7",
@@ -1095,8 +1096,8 @@
     },
     "node_modules/@babel/plugin-transform-class-static-block": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-class-static-block/-/plugin-transform-class-static-block-7.29.7.tgz",
-      "integrity": "sha512-kibJgmEdX2iMwsHY2tSZNDgj8PwIlCQz7FK9KuGKO8zsuoUwSEhoNnNVp/emKWrbY4HeO6kkXfdMqRKKKXBm2A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-class-static-block/-/plugin-transform-class-static-block-7.29.7.tgz",
+      "integrity": "sha1-/tjv0Z890+ERTuOQcHxwkSd4/Xw=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-class-features-plugin": "^7.29.7",
@@ -1111,8 +1112,8 @@
     },
     "node_modules/@babel/plugin-transform-classes": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-classes/-/plugin-transform-classes-7.29.7.tgz",
-      "integrity": "sha512-qV0OGGBVacduzQHE649JyCneOFI/maT+YKsO+K4Yi3xv2wTPNjM/W2o2gdzMwEAZz7fXNTHAe0NcSg30bIN69g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-classes/-/plugin-transform-classes-7.29.7.tgz",
+      "integrity": "sha1-YdPlqq4Mg4rMMgTZ23yNwFwlgVs=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-annotate-as-pure": "^7.29.7",
@@ -1131,8 +1132,8 @@
     },
     "node_modules/@babel/plugin-transform-computed-properties": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.29.7.tgz",
-      "integrity": "sha512-RK7/IyU5phpuCdBAuig5VkzG/EnbDaui5SQGdU9BFrHdV+mV4cUjLMQ9lJDjLNtWHsqtiefpGZUXQP2BiTYMsA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-computed-properties/-/plugin-transform-computed-properties-7.29.7.tgz",
+      "integrity": "sha1-lQKHh8oxkBuaILXG2WBcMjRvVa0=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -1147,8 +1148,8 @@
     },
     "node_modules/@babel/plugin-transform-destructuring": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.29.7.tgz",
-      "integrity": "sha512-iPX8aD6H9zV5s7ZsqTdNocPN/MGQ5sSMnElKrktxjJRMnB2jN/1p2+R7GkfD6CAYoVFqy5A4XnSIUeGgJzIWpg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-destructuring/-/plugin-transform-destructuring-7.29.7.tgz",
+      "integrity": "sha1-V4HsaUeFLie2TBFl8NtDH0CAkOQ=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -1163,8 +1164,8 @@
     },
     "node_modules/@babel/plugin-transform-dotall-regex": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.29.7.tgz",
-      "integrity": "sha512-3qc18hsD2RdZiyJNDNc7HQpv6xbncwh8FYtxNFFzclSyh/trPD9KkVR9BDECUjDLvb7yJVF15GfYUuC+LMkkiQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-dotall-regex/-/plugin-transform-dotall-regex-7.29.7.tgz",
+      "integrity": "sha1-sgPel0Dkx/9rVc5DbtUxO4jXCvg=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-regexp-features-plugin": "^7.29.7",
@@ -1179,8 +1180,8 @@
     },
     "node_modules/@babel/plugin-transform-duplicate-keys": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.29.7.tgz",
-      "integrity": "sha512-6IvRRriEMqnBwD6chtxdLpMYCHWEzN+oL5cyQtjykya19UgzbmKhxmhZgKC/LHxS2nYr9Q/qYPZ5Lr6jOL9+yQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-duplicate-keys/-/plugin-transform-duplicate-keys-7.29.7.tgz",
+      "integrity": "sha1-jz/nIYNct6QzQghB2ukK/JYup64=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1194,8 +1195,8 @@
     },
     "node_modules/@babel/plugin-transform-duplicate-named-capturing-groups-regex": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-duplicate-named-capturing-groups-regex/-/plugin-transform-duplicate-named-capturing-groups-regex-7.29.7.tgz",
-      "integrity": "sha512-2wiIyo2BjtgU7HufSeDnL9L2O7zr8jmhFKuSr65VpRkUiRKRNpb0mdlk56+XPPKoIrfHqzbMuglDvZun0RISsA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-duplicate-named-capturing-groups-regex/-/plugin-transform-duplicate-named-capturing-groups-regex-7.29.7.tgz",
+      "integrity": "sha1-3GxAXlXAG3ZX4YJ6JTMsSsF+nKw=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-regexp-features-plugin": "^7.29.7",
@@ -1210,8 +1211,8 @@
     },
     "node_modules/@babel/plugin-transform-dynamic-import": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-dynamic-import/-/plugin-transform-dynamic-import-7.29.7.tgz",
-      "integrity": "sha512-giOlEm/EFjfjr+te9NsdjkUo2v4f8rS/SXPumRVHAtbNcyNlvtREkU1dZzaIDclNpnaVhlCqRdFKhJBjBikzLg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-dynamic-import/-/plugin-transform-dynamic-import-7.29.7.tgz",
+      "integrity": "sha1-qDpvrsW6tbYZrfnQ6sbBwnASPCo=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1225,8 +1226,8 @@
     },
     "node_modules/@babel/plugin-transform-explicit-resource-management": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-explicit-resource-management/-/plugin-transform-explicit-resource-management-7.29.7.tgz",
-      "integrity": "sha512-Rstj7coNz8sE+7Ju7ihpHLI564lsK5pUpNNlvptCIC/16E/S5hbl6n3kESPKdNRmqEWlpn5xpS5Q2dvXBsySLw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-explicit-resource-management/-/plugin-transform-explicit-resource-management-7.29.7.tgz",
+      "integrity": "sha1-Zci5927JFbAqDh33AxJaD8pYq6o=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -1241,8 +1242,8 @@
     },
     "node_modules/@babel/plugin-transform-exponentiation-operator": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.29.7.tgz",
-      "integrity": "sha512-zFpMOTLZBdW5LfObqcSbL6kefg4R4eLdmvS0wbN9M6D5Mym/sKm9toOoWyVOa+xDjvCnuWcHls2YonXwHvH3CQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-exponentiation-operator/-/plugin-transform-exponentiation-operator-7.29.7.tgz",
+      "integrity": "sha1-AL8AL96HlDVhcfXU3yAPa8DVowM=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1256,8 +1257,8 @@
     },
     "node_modules/@babel/plugin-transform-export-namespace-from": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-export-namespace-from/-/plugin-transform-export-namespace-from-7.29.7.tgz",
-      "integrity": "sha512-24B2nOy2TeJSMheqwPD4DDQOV/elLSIlKxjZt4i05H5AgdPdWR3n18HnNrcJ+j76WJd9gbwb9jPjNYUy6RautA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-export-namespace-from/-/plugin-transform-export-namespace-from-7.29.7.tgz",
+      "integrity": "sha1-1gFPRc7GHXaRM1xsmAQgS+6AHVE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1271,8 +1272,8 @@
     },
     "node_modules/@babel/plugin-transform-flow-strip-types": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-flow-strip-types/-/plugin-transform-flow-strip-types-7.29.7.tgz",
-      "integrity": "sha512-wRHeUjUjCZnMHmiO5bRgjFLcoEh7JyTdByOW11ahhwNa4V0bmeGEaIvt51yq0zQp2yWIpqfxXXPyUP6GFJZHOQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-flow-strip-types/-/plugin-transform-flow-strip-types-7.29.7.tgz",
+      "integrity": "sha1-kRvLMWCMNXZRDX4Mlcz2T54YEtA=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -1287,8 +1288,8 @@
     },
     "node_modules/@babel/plugin-transform-for-of": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.29.7.tgz",
-      "integrity": "sha512-zeSIHh0+E1Um1WJRXCFlHQYu2ieJNdivLLjlBEp+dIBu3S51n+SZZmIXjxnItw6pz56Cn+KvK68BIBVsxq2JiQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-for-of/-/plugin-transform-for-of-7.29.7.tgz",
+      "integrity": "sha1-xlpnhZIRdxeqzbEMG3Opy4XoML4=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -1303,8 +1304,8 @@
     },
     "node_modules/@babel/plugin-transform-function-name": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.29.7.tgz",
-      "integrity": "sha512-otRWaHXE6fbAGkePvaj/kvs3HsqXfPhlnzwSOlnFgbqCPMd975dW+4wZ00WFBt+/YlBGcJwNrARQTOJOb4ZrIg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-function-name/-/plugin-transform-function-name-7.29.7.tgz",
+      "integrity": "sha1-i4f4p1BNvNlhNRZ+P8T2ESanvYY=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-compilation-targets": "^7.29.7",
@@ -1320,8 +1321,8 @@
     },
     "node_modules/@babel/plugin-transform-json-strings": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-json-strings/-/plugin-transform-json-strings-7.29.7.tgz",
-      "integrity": "sha512-RRnE2+eon1rJAq8MnoF1b5kTpY1vU88twHcvcKMrsqP/jxIRqDVs9iJB5fqPuqyeFAW0wJo4MlUIPpQCq/aRsg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-json-strings/-/plugin-transform-json-strings-7.29.7.tgz",
+      "integrity": "sha1-9X1j3MBbRIHCgaztzY/E4+Q5odQ=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1335,8 +1336,8 @@
     },
     "node_modules/@babel/plugin-transform-literals": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-literals/-/plugin-transform-literals-7.29.7.tgz",
-      "integrity": "sha512-DZ/oLP21ZuWx1vKqnoNv6/tvEK48AQOBRai40CX9dTjGluvT/YZCyY3rryDtyUqCEoyNroy5KKPwX2iQCiRvyw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-literals/-/plugin-transform-literals-7.29.7.tgz",
+      "integrity": "sha1-uQvUdGMybCqdd54b1eH4i59CGSE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1350,8 +1351,8 @@
     },
     "node_modules/@babel/plugin-transform-logical-assignment-operators": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-logical-assignment-operators/-/plugin-transform-logical-assignment-operators-7.29.7.tgz",
-      "integrity": "sha512-A0H91hh6W8MFRkp5TqJmMr39jzGD1A1E1Ysiv2O06Sfbhkapm+XyIzxWCEh5kqwOZ1/8QZ0dY3SeQ7XBqfJd5Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-logical-assignment-operators/-/plugin-transform-logical-assignment-operators-7.29.7.tgz",
+      "integrity": "sha1-mylCWt9ceUlnqr5LBGoEahZ7rC8=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1365,8 +1366,8 @@
     },
     "node_modules/@babel/plugin-transform-member-expression-literals": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.29.7.tgz",
-      "integrity": "sha512-hl1kwFZCCiDyfH25Xmco9jTrkPgnS9pmOzSG7W5I4SaGbLeqKv417hcU2RKmaxoPEgsoJh7ZPOrnPGq99bHoUg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-member-expression-literals/-/plugin-transform-member-expression-literals-7.29.7.tgz",
+      "integrity": "sha1-EoFon6L+/BexENIeuv0P6UAtUwk=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1380,8 +1381,8 @@
     },
     "node_modules/@babel/plugin-transform-modules-amd": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.29.7.tgz",
-      "integrity": "sha512-fxtQoH3m5ywUSIfaH0FGCzWu4McsYon5bD3K4XnskC7f+OyQMj7rsOMi4NvvmJ83WwBAg4UCe+ov4VZlqEvyew==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-modules-amd/-/plugin-transform-modules-amd-7.29.7.tgz",
+      "integrity": "sha1-8FymYsih3Evi8zevnH6ANpyULWw=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-module-transforms": "^7.29.7",
@@ -1396,8 +1397,8 @@
     },
     "node_modules/@babel/plugin-transform-modules-commonjs": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.29.7.tgz",
-      "integrity": "sha512-j0vCldybPC5b5dwCQOJ21uKtHzt7hxLygJTg9eF1ScfaikEDNfzn94XoW5Fi+seBR0nCyL23xaBFFkq7dTM8XQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.29.7.tgz",
+      "integrity": "sha1-cOaDWr8mY9r76UuO8fUd5zUe8TU=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-module-transforms": "^7.29.7",
@@ -1412,8 +1413,8 @@
     },
     "node_modules/@babel/plugin-transform-modules-systemjs": {
       "version": "7.29.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.4.tgz",
-      "integrity": "sha512-N7QmZ0xRZfjHOfZeQLJjwgX2zS9pdGHSVl/cjSGlo4dXMqvurfxXDMKY4RqEKzPozV78VMcd0lxyG13mlbKc4w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-modules-systemjs/-/plugin-transform-modules-systemjs-7.29.4.tgz",
+      "integrity": "sha1-9iEQXamZGcFc9L3m/Mc0bvleeyA=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-module-transforms": "^7.28.6",
@@ -1430,8 +1431,8 @@
     },
     "node_modules/@babel/plugin-transform-modules-umd": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.29.7.tgz",
-      "integrity": "sha512-B4UkaTK3QpgCwJnrxKfMPKdo92CN7OKXAlpAAnM3UPu0Q0lCCk57ylA9AJbRy2v8dDKOPAAWcoR6CMyeoHwRCA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-modules-umd/-/plugin-transform-modules-umd-7.29.7.tgz",
+      "integrity": "sha1-OR0cAhWspjByV/L2CFmN/lX+ts8=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-module-transforms": "^7.29.7",
@@ -1446,8 +1447,8 @@
     },
     "node_modules/@babel/plugin-transform-named-capturing-groups-regex": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.29.7.tgz",
-      "integrity": "sha512-vuFoLwr4qnv2xbZ16SQd6uPcH5FNrLHhk/Jzo++0XJFcaDsr4gjJVg6j398oMHiC+83k/GiBzviwF5KBJkPUtQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-named-capturing-groups-regex/-/plugin-transform-named-capturing-groups-regex-7.29.7.tgz",
+      "integrity": "sha1-IeddhHsxGJhC+np3cDci7UtD0n0=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-regexp-features-plugin": "^7.29.7",
@@ -1462,8 +1463,8 @@
     },
     "node_modules/@babel/plugin-transform-new-target": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.29.7.tgz",
-      "integrity": "sha512-fEo41GmsOUhOBlw8ioo6zvjX5Xc2Lqkzlyfqbpsk3eB6TReV18uhxZ0esfEokVbY2+PVJAQHNKxER6lGrzNd3A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-new-target/-/plugin-transform-new-target-7.29.7.tgz",
+      "integrity": "sha1-cUFHznlH4bScvYQTfKLnXpKyoGc=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1477,8 +1478,8 @@
     },
     "node_modules/@babel/plugin-transform-nullish-coalescing-operator": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-nullish-coalescing-operator/-/plugin-transform-nullish-coalescing-operator-7.29.7.tgz",
-      "integrity": "sha512-idmp1dFaekP9GbcMvG24Kvw2BfhFZjHnNJCkV4WuIY4PskJzwI3f1N5OdgYke38T7rftO6ERulFRn2cFeZwRkg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-nullish-coalescing-operator/-/plugin-transform-nullish-coalescing-operator-7.29.7.tgz",
+      "integrity": "sha1-ilTN+Iw/UEM6YXMReihhlbZ3FMw=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1492,8 +1493,8 @@
     },
     "node_modules/@babel/plugin-transform-numeric-separator": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-numeric-separator/-/plugin-transform-numeric-separator-7.29.7.tgz",
-      "integrity": "sha512-zR7fv/z14OjgHl4AgRtkDBvBMhIzCxqV/qN/2BCRC7LjFwvuzjYe7gDWxC4Wl/SNsLM6SE1IWvRPYMgSJaUvNw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-numeric-separator/-/plugin-transform-numeric-separator-7.29.7.tgz",
+      "integrity": "sha1-AmbVzUKrh+xA/uRaTjZIPP3Lxmo=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1507,8 +1508,8 @@
     },
     "node_modules/@babel/plugin-transform-object-rest-spread": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-rest-spread/-/plugin-transform-object-rest-spread-7.29.7.tgz",
-      "integrity": "sha512-Ld98jn4c0smUywL57m7SgsHq3OpThOa6LqZJif3G6jYOovPleoFhVrBJ1WegRApSFB2wu4+RelAj9AC9G08Z4A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-object-rest-spread/-/plugin-transform-object-rest-spread-7.29.7.tgz",
+      "integrity": "sha1-4NUGAkGAOSLFRWdmE8yKy72g0mY=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-compilation-targets": "^7.29.7",
@@ -1526,8 +1527,8 @@
     },
     "node_modules/@babel/plugin-transform-object-super": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.29.7.tgz",
-      "integrity": "sha512-Ea/diGcw0twB5IlZPO5sgET6fJsLJqPABqTuFWIR+iMPGPZJkATEIWx0wa+aEQ5UY1CBQyP/gkAiLEqn1vBiQA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-object-super/-/plugin-transform-object-super-7.29.7.tgz",
+      "integrity": "sha1-6JKD0U+jw1gX1Ek//GvGSaoQ5Os=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -1542,8 +1543,8 @@
     },
     "node_modules/@babel/plugin-transform-optional-catch-binding": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-optional-catch-binding/-/plugin-transform-optional-catch-binding-7.29.7.tgz",
-      "integrity": "sha512-sLsyndxK2VwX6yNUOakMb7Sh553ZTe/vVM1XJ+9Z5aW1ytsc8xOIwmyk05NNjN60vkc5/KqoTH6hB4V41LJhng==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-optional-catch-binding/-/plugin-transform-optional-catch-binding-7.29.7.tgz",
+      "integrity": "sha1-cpZk95mFvlBOuhEsUd6fcdAJAws=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1557,8 +1558,8 @@
     },
     "node_modules/@babel/plugin-transform-optional-chaining": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-optional-chaining/-/plugin-transform-optional-chaining-7.29.7.tgz",
-      "integrity": "sha512-6GM1dhvK3gNODkXcEcMCOLEDCLSoZ/sBbro2Ax8HURyasQ4NshagQixkRFdh5niI6E4gmA/jYI/4aT7rRos3ZQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-optional-chaining/-/plugin-transform-optional-chaining-7.29.7.tgz",
+      "integrity": "sha1-uEobV0s8cwAQIwklZ+FsSStyDlE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -1573,8 +1574,8 @@
     },
     "node_modules/@babel/plugin-transform-parameters": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.29.7.tgz",
-      "integrity": "sha512-ZDOBqV/qLYJI0YElr8DcENEyARsFQeESqWXH6gZlghYXuPPjvweuDhP4VyEi4BlUBlLRFZVjxoZDMjxhLW766g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-parameters/-/plugin-transform-parameters-7.29.7.tgz",
+      "integrity": "sha1-pd3Dub+1NIFMuDNMvrpH2c+dsJA=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1588,8 +1589,8 @@
     },
     "node_modules/@babel/plugin-transform-private-methods": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-methods/-/plugin-transform-private-methods-7.29.7.tgz",
-      "integrity": "sha512-/6Rz4DK1ETDEM/bWHsPHcaEe7ZaT1EqSXjtSP/L0DijOYuaUhiRiOKcwpZ8P7zR4xXEHc2ITdiCgBm9Tpyv9ug==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-private-methods/-/plugin-transform-private-methods-7.29.7.tgz",
+      "integrity": "sha1-zqi9OrmVM4kol6ApmdW3UlhK0UU=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-class-features-plugin": "^7.29.7",
@@ -1604,8 +1605,8 @@
     },
     "node_modules/@babel/plugin-transform-private-property-in-object": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-private-property-in-object/-/plugin-transform-private-property-in-object-7.29.7.tgz",
-      "integrity": "sha512-+BNo06dnrzdNNqCm1X6YUaVv0DKk8Q+JYcoZfOkLhYWNCXzlwTSRq8zGWayT1csjcpNXV9CQTBRRbmTLZac5cA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-private-property-in-object/-/plugin-transform-private-property-in-object-7.29.7.tgz",
+      "integrity": "sha1-Si9r5auke+evvbTNeQPEbt86dmE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-annotate-as-pure": "^7.29.7",
@@ -1621,8 +1622,8 @@
     },
     "node_modules/@babel/plugin-transform-property-literals": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.29.7.tgz",
-      "integrity": "sha512-bOMRLQuI0A5ZqHq3OWJ89/rXpJ/NJrbVhXiP4zwPGMs6kpcVsuTUNjwoE30K0Qm3mf48a/TnRYYD6vPNqcg6jA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-property-literals/-/plugin-transform-property-literals-7.29.7.tgz",
+      "integrity": "sha1-1FgXzXL54TSrH3+7eSZM/Lhc9jY=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1636,8 +1637,8 @@
     },
     "node_modules/@babel/plugin-transform-react-constant-elements": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-constant-elements/-/plugin-transform-react-constant-elements-7.29.7.tgz",
-      "integrity": "sha512-J0wGhKan+rIiE2OhfhRptySLrJ6SjQYM6b6N1FMlhyhCcw1Mig8vQjWchyB+bgHGDvaWo6Diu6CLRMra2uMtmg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-react-constant-elements/-/plugin-transform-react-constant-elements-7.29.7.tgz",
+      "integrity": "sha1-gmREDqL/xexAWuvX6sB0gV1uKLE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1651,8 +1652,8 @@
     },
     "node_modules/@babel/plugin-transform-react-display-name": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-display-name/-/plugin-transform-react-display-name-7.29.7.tgz",
-      "integrity": "sha512-+1wdDMGNb4UPeY3Q4L5yLiYe6TXPXubs4NjrgRFw13hPRLJfEMw2Q5OXkee6/IfdqePIeW4Jjwe3aBh7SdKz4Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-react-display-name/-/plugin-transform-react-display-name-7.29.7.tgz",
+      "integrity": "sha1-vxYabXUCZ7edt/9vj7icM2mwLfM=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1666,8 +1667,8 @@
     },
     "node_modules/@babel/plugin-transform-react-jsx": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx/-/plugin-transform-react-jsx-7.29.7.tgz",
-      "integrity": "sha512-WsZulLVBUHXVj2cUcPVx6UE21TpalB6bHbSFErKT0Ib++ax24jjXe73FqlWvdylFOjiuPHYi6VCcgRad1ItN+A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-react-jsx/-/plugin-transform-react-jsx-7.29.7.tgz",
+      "integrity": "sha1-PRag5Xc/B5QAqMgqGQcJzfku4gQ=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-annotate-as-pure": "^7.29.7",
@@ -1685,8 +1686,8 @@
     },
     "node_modules/@babel/plugin-transform-react-jsx-development": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-jsx-development/-/plugin-transform-react-jsx-development-7.29.7.tgz",
-      "integrity": "sha512-Xfy3UVMF04+ypnFbkhvfqtmvwfe92qwQdbGZVonhE+6v35GzlofmOnA1szaZqzb9xYWr0nl1e5EMmzi0DNON1g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-react-jsx-development/-/plugin-transform-react-jsx-development-7.29.7.tgz",
+      "integrity": "sha1-ZOaqy1y0O56A09Xxnd78FYpiTwk=",
       "license": "MIT",
       "dependencies": {
         "@babel/plugin-transform-react-jsx": "^7.29.7"
@@ -1700,8 +1701,8 @@
     },
     "node_modules/@babel/plugin-transform-react-pure-annotations": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-react-pure-annotations/-/plugin-transform-react-pure-annotations-7.29.7.tgz",
-      "integrity": "sha512-H5E+HBgDpr6Q5t+Aj11tL7XkIui1jhbIoArVQnqjgXo5/3YxkN7ZEBcWF4RQlB0T4rrxJQbXS6kiFV6B7XTqUA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-react-pure-annotations/-/plugin-transform-react-pure-annotations-7.29.7.tgz",
+      "integrity": "sha1-dkRckBEt0Kc3G2MmRWO/qaT81uM=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-annotate-as-pure": "^7.29.7",
@@ -1716,8 +1717,8 @@
     },
     "node_modules/@babel/plugin-transform-regenerator": {
       "version": "7.29.8",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.29.8.tgz",
-      "integrity": "sha512-0UpIXPtdDtMXfnV2OJAVMLpj3H/92vmkA6lpSRakmycJvj3VUy6Xs1dM8tXRugupykr5WB+LpiVl0J8LMVg2mg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-regenerator/-/plugin-transform-regenerator-7.29.8.tgz",
+      "integrity": "sha1-OkpN1yFK+dUk8FA7uXyZr19KvyY=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1731,8 +1732,8 @@
     },
     "node_modules/@babel/plugin-transform-regexp-modifiers": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-regexp-modifiers/-/plugin-transform-regexp-modifiers-7.29.7.tgz",
-      "integrity": "sha512-mB5Fs0VWrJ42ZCmc8114v60qetdaUVNkj9PmSZRmanCZM3S9hm0CFRLjRmYIsuXav14l2jvZ+4T8iiCGnhj3nQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-regexp-modifiers/-/plugin-transform-regexp-modifiers-7.29.7.tgz",
+      "integrity": "sha1-aDEcDBCvIZghJSiGP4VChD5CQCU=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-regexp-features-plugin": "^7.29.7",
@@ -1747,8 +1748,8 @@
     },
     "node_modules/@babel/plugin-transform-reserved-words": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.29.7.tgz",
-      "integrity": "sha512-5+YhdpVgmfSmwZyLMftfaiffLRMHjzIRHFHHLdibcSyJm2pasMrKHrO3Ptrt2DRshjvpgjEJJ1zVW14WPq/6QA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-reserved-words/-/plugin-transform-reserved-words-7.29.7.tgz",
+      "integrity": "sha1-pv7rF5s2pfH8bjFUwetye9vjWHY=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1762,8 +1763,8 @@
     },
     "node_modules/@babel/plugin-transform-runtime": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-runtime/-/plugin-transform-runtime-7.29.7.tgz",
-      "integrity": "sha512-xmAscdE/AsqRW7vutbPNoUmu/nF5SrLKPs7aoJgEjo35lLKA/Bc0i2rMv/hr1+Y0o1bQCiVtith3u2vdgRL39Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-runtime/-/plugin-transform-runtime-7.29.7.tgz",
+      "integrity": "sha1-fH+24qRtzmfieLbMhEIcHRbaVpU=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-module-imports": "^7.29.7",
@@ -1782,8 +1783,8 @@
     },
     "node_modules/@babel/plugin-transform-runtime/node_modules/babel-plugin-polyfill-corejs3": {
       "version": "0.13.0",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.13.0.tgz",
-      "integrity": "sha512-U+GNwMdSFgzVmfhNm8GJUX88AadB3uo9KpJqS3FaqNIPKgySuvMb+bHPsOmmuWyIcuqZj/pzt1RUIUZns4y2+A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.13.0.tgz",
+      "integrity": "sha1-u39q7vet3/F/dgKgim0ZoSjDAWQ=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-define-polyfill-provider": "^0.6.5",
@@ -1795,8 +1796,8 @@
     },
     "node_modules/@babel/plugin-transform-runtime/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -1804,8 +1805,8 @@
     },
     "node_modules/@babel/plugin-transform-shorthand-properties": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.29.7.tgz",
-      "integrity": "sha512-I+WYbGBAiCn7nA6xBrlgPH+MB7HWb4u8pv5S0Pv7OtwNvIFvCCb24YlttKEeUFVurfBCEaOTnuhlqsb7f0Z5Dg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-shorthand-properties/-/plugin-transform-shorthand-properties-7.29.7.tgz",
+      "integrity": "sha1-JcBDa5j0vZykuY4fvWYnQ7uqub8=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1819,8 +1820,8 @@
     },
     "node_modules/@babel/plugin-transform-spread": {
       "version": "7.29.8",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-spread/-/plugin-transform-spread-7.29.8.tgz",
-      "integrity": "sha512-4S9ksMGVWUshvgK0mKfvZky7leuG5/uoFVwMpAomJ8bMoDJiNHRVmc1EglwW/CmGVSqqWpEbXm9FmbRit22qoA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-spread/-/plugin-transform-spread-7.29.8.tgz",
+      "integrity": "sha1-yJTP84VWpdr+tBLhP8AStt9LlaI=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -1835,8 +1836,8 @@
     },
     "node_modules/@babel/plugin-transform-sticky-regex": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.29.7.tgz",
-      "integrity": "sha512-BCHzNYJGe9l7EpwwDBN/ztlL2NYFFq8hp9ddjtUEM9f2O7S7kKV/lL6Fwo7IF7NSkYhPK2vO+86nIGltA90MsA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-sticky-regex/-/plugin-transform-sticky-regex-7.29.7.tgz",
+      "integrity": "sha1-pCwP0fpC9+mOHgx3V/cqG7yjoBU=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1850,8 +1851,8 @@
     },
     "node_modules/@babel/plugin-transform-template-literals": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.29.7.tgz",
-      "integrity": "sha512-NCSEJ4sLFU2gqAub45HYh4fus2yQ36rr6ei6vpU7NdoJqCpxvEG8E6eJpscGyXP3VHD2Ny+fSXr04k1hoUrFqA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-template-literals/-/plugin-transform-template-literals-7.29.7.tgz",
+      "integrity": "sha1-ral9jggyvKjtsxWIiqZUsVcPODU=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1865,8 +1866,8 @@
     },
     "node_modules/@babel/plugin-transform-typeof-symbol": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.29.7.tgz",
-      "integrity": "sha512-223mNGoTkBiTEWFoK+Q6Go3tueMRclO8vxxxxquNCYuNI4jWOofFKJRRDu6SDrB8Sgo1UEGW9T4GAQ8ZyRso1A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-typeof-symbol/-/plugin-transform-typeof-symbol-7.29.7.tgz",
+      "integrity": "sha1-2EikZ3we40hasBf0AY8EWXeYkRw=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1880,8 +1881,8 @@
     },
     "node_modules/@babel/plugin-transform-typescript": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.29.7.tgz",
-      "integrity": "sha512-jK52h8LaLc7JarhQV2ofeFMts4H7vnOXnqZNA6fYglBTZewRBE51KWt3BUltW1P+KoPsYkHoJeXePuz4zo2LMw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-typescript/-/plugin-transform-typescript-7.29.7.tgz",
+      "integrity": "sha1-8EScPfcDe74jIENHaFHDj15KdhU=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-annotate-as-pure": "^7.29.7",
@@ -1899,8 +1900,8 @@
     },
     "node_modules/@babel/plugin-transform-unicode-escapes": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.29.7.tgz",
-      "integrity": "sha512-jCfXxSjf94lf4E0hKE0AByxF6F3/pVFqRdUUNkDJhsY0m1ZKjnN6ZYyMeHNpzflxb/0q5b7t3p+BE+SLF1WOtA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-unicode-escapes/-/plugin-transform-unicode-escapes-7.29.7.tgz",
+      "integrity": "sha1-HplVSwzd/WUNZJqfK5lgSYk+VyA=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7"
@@ -1914,8 +1915,8 @@
     },
     "node_modules/@babel/plugin-transform-unicode-property-regex": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-property-regex/-/plugin-transform-unicode-property-regex-7.29.7.tgz",
-      "integrity": "sha512-OgZ+zoAJgZLUCunsTRQ5LAjOywDv5zzZ2/hQ5aMw1pGXyY2rtE8/chXYUmu3AlVHKpm10KEdG9aMwbI/K76ZGw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-unicode-property-regex/-/plugin-transform-unicode-property-regex-7.29.7.tgz",
+      "integrity": "sha1-RERK/HN2jCGQ+sTZX3cWgXt/IEo=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-regexp-features-plugin": "^7.29.7",
@@ -1930,8 +1931,8 @@
     },
     "node_modules/@babel/plugin-transform-unicode-regex": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.29.7.tgz",
-      "integrity": "sha512-7D/x/23/d/3VqZ0QA+LGbZMlGwZjztBygSWWWsfTPoQ1oQ6Q1P6Mr3d0kk42XabyUVw+fha3LqdRsFqeKqvCyA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-unicode-regex/-/plugin-transform-unicode-regex-7.29.7.tgz",
+      "integrity": "sha1-wwZLKT/38XlLcfdlDuyNuYltPlk=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-regexp-features-plugin": "^7.29.7",
@@ -1946,8 +1947,8 @@
     },
     "node_modules/@babel/plugin-transform-unicode-sets-regex": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-unicode-sets-regex/-/plugin-transform-unicode-sets-regex-7.29.7.tgz",
-      "integrity": "sha512-BLOhLht9DOJwIxlmp91wHvkXv1lguuHS3/FwUO8HL1H0u8s4hR1gASVFyilu9iGtcTRYqjTZmlsFFeQletntEg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-transform-unicode-sets-regex/-/plugin-transform-unicode-sets-regex-7.29.7.tgz",
+      "integrity": "sha1-sDrJ8nMm9hl+jldK3YO78z/DTs0=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-create-regexp-features-plugin": "^7.29.7",
@@ -1962,8 +1963,8 @@
     },
     "node_modules/@babel/preset-env": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/preset-env/-/preset-env-7.29.7.tgz",
-      "integrity": "sha512-GYzX36n1nsciIb0uyH0GHwxwtNwPQIcpxSeiVLDtG/B7jB5xXgchnmL1f/jCX5o+pwnaDBtO60ONSJhEBJfxYA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/preset-env/-/preset-env-7.29.7.tgz",
+      "integrity": "sha1-Xiq152S0k/3vyZxDrqpwqVM6N/0=",
       "license": "MIT",
       "dependencies": {
         "@babel/compat-data": "^7.29.7",
@@ -2047,8 +2048,8 @@
     },
     "node_modules/@babel/preset-env/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -2056,8 +2057,8 @@
     },
     "node_modules/@babel/preset-modules": {
       "version": "0.1.6-no-external-plugins",
-      "resolved": "https://registry.npmjs.org/@babel/preset-modules/-/preset-modules-0.1.6-no-external-plugins.tgz",
-      "integrity": "sha512-HrcgcIESLm9aIR842yhJ5RWan/gebQUJ6E/E5+rf0y9o6oj7w0Br+sWuL6kEQ/o/AdfvR1Je9jG18/gnpwjEyA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/preset-modules/-/preset-modules-0.1.6-no-external-plugins.tgz",
+      "integrity": "sha1-zLiKLEnIFyNoYf7ngmCAVzuKkjo=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.0.0",
@@ -2070,8 +2071,8 @@
     },
     "node_modules/@babel/preset-react": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/preset-react/-/preset-react-7.29.7.tgz",
-      "integrity": "sha512-C+PV1TFUPTmBQGoPBL8j2QmLpZ117YTCwxIZeJOM96GbYMFSc7/pOXU5lVykwnZxyTqQxRsvoRk6f2FktZgGHA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/preset-react/-/preset-react-7.29.7.tgz",
+      "integrity": "sha1-LtGDZuOMIIG78XYNwB6I+lZ06xc=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -2090,8 +2091,8 @@
     },
     "node_modules/@babel/preset-typescript": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/preset-typescript/-/preset-typescript-7.29.7.tgz",
-      "integrity": "sha512-/Foi8vKY2EVbed/1eZx0gJEEwHAIxogrySI7rULcRIvhZzbvoE/b5qG5Ghc0WKAFKOHA9SD1x7RsFlOYdutIiQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/preset-typescript/-/preset-typescript-7.29.7.tgz",
+      "integrity": "sha1-3pvh9Ht4XJeex7OnH0zYuuUme2I=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.29.7",
@@ -2109,8 +2110,8 @@
     },
     "node_modules/@babel/runtime": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
-      "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/runtime/-/runtime-7.29.7.tgz",
+      "integrity": "sha1-EgIkUMRaTabY2Ch7GKT/Ldsj92g=",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -2118,8 +2119,8 @@
     },
     "node_modules/@babel/template": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
-      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha1-TZ1ABPZFzdME3pWMclFieE7KxwA=",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.29.7",
@@ -2132,8 +2133,8 @@
     },
     "node_modules/@babel/traverse": {
       "version": "7.29.8",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz",
-      "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/traverse/-/traverse-7.29.8.tgz",
+      "integrity": "sha1-QREBTNxxoPldlHGQdZC6oLimsoo=",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.29.7",
@@ -2150,8 +2151,8 @@
     },
     "node_modules/@babel/types": {
       "version": "7.29.8",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
-      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha1-Einu8x2FFW1w+j9M2Fk3bQ6vaGM=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-string-parser": "^7.29.7",
@@ -2163,20 +2164,20 @@
     },
     "node_modules/@bcoe/v8-coverage": {
       "version": "0.2.3",
-      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
-      "integrity": "sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz",
+      "integrity": "sha1-daLotRy3WKdVPWgEpZMteqznXDk=",
       "license": "MIT"
     },
     "node_modules/@csstools/normalize.css": {
       "version": "12.1.1",
-      "resolved": "https://registry.npmjs.org/@csstools/normalize.css/-/normalize.css-12.1.1.tgz",
-      "integrity": "sha512-YAYeJ+Xqh7fUou1d1j9XHl44BmsuThiTr4iNrgCQ3J27IbhXsxXDGZ1cXv8Qvs99d4rBbLiSKy3+WZiet32PcQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/normalize.css/-/normalize.css-12.1.1.tgz",
+      "integrity": "sha1-8K0iG3KA8/yBRol4b9nuCSd2748=",
       "license": "CC0-1.0"
     },
     "node_modules/@csstools/postcss-cascade-layers": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-cascade-layers/-/postcss-cascade-layers-1.1.1.tgz",
-      "integrity": "sha512-+KdYrpKC5TgomQr2DlZF4lDEpHcoxnj5IGddYYfBWJAKfj1JtuHUIqMa+E1pJJ+z3kvDViWMqyqPlG4Ja7amQA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-cascade-layers/-/postcss-cascade-layers-1.1.1.tgz",
+      "integrity": "sha1-ipl+35fTQHHdLjfqYCJEfdnnla0=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/selector-specificity": "^2.0.2",
@@ -2195,8 +2196,8 @@
     },
     "node_modules/@csstools/postcss-color-function": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-color-function/-/postcss-color-function-1.1.1.tgz",
-      "integrity": "sha512-Bc0f62WmHdtRDjf5f3e2STwRAl89N2CLb+9iAwzrv4L2hncrbDwnQD9PCq0gtAt7pOI2leIV08HIBUd4jxD8cw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-color-function/-/postcss-color-function-1.1.1.tgz",
+      "integrity": "sha1-K9Nqs0+C0El8+s3JsY00teb2S2s=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/postcss-progressive-custom-properties": "^1.1.0",
@@ -2215,8 +2216,8 @@
     },
     "node_modules/@csstools/postcss-font-format-keywords": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-font-format-keywords/-/postcss-font-format-keywords-1.0.1.tgz",
-      "integrity": "sha512-ZgrlzuUAjXIOc2JueK0X5sZDjCtgimVp/O5CEqTcs5ShWBa6smhWYbS0x5cVc/+rycTDbjjzoP0KTDnUneZGOg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-font-format-keywords/-/postcss-font-format-keywords-1.0.1.tgz",
+      "integrity": "sha1-Z3s06eiK6ZemcoMxFleXMVDosWo=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -2234,8 +2235,8 @@
     },
     "node_modules/@csstools/postcss-hwb-function": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-hwb-function/-/postcss-hwb-function-1.0.2.tgz",
-      "integrity": "sha512-YHdEru4o3Rsbjmu6vHy4UKOXZD+Rn2zmkAmLRfPet6+Jz4Ojw8cbWxe1n42VaXQhD3CQUXXTooIy8OkVbUcL+w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-hwb-function/-/postcss-hwb-function-1.0.2.tgz",
+      "integrity": "sha1-q1Sp/OCsECx1SFR2mWLyQiroqos=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -2253,8 +2254,8 @@
     },
     "node_modules/@csstools/postcss-ic-unit": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-ic-unit/-/postcss-ic-unit-1.0.1.tgz",
-      "integrity": "sha512-Ot1rcwRAaRHNKC9tAqoqNZhjdYBzKk1POgWfhN4uCOE47ebGcLRqXjKkApVDpjifL6u2/55ekkpnFcp+s/OZUw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-ic-unit/-/postcss-ic-unit-1.0.1.tgz",
+      "integrity": "sha1-KCN9gSoSTRoWpazFw4MrBAswPlg=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/postcss-progressive-custom-properties": "^1.1.0",
@@ -2273,8 +2274,8 @@
     },
     "node_modules/@csstools/postcss-is-pseudo-class": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-is-pseudo-class/-/postcss-is-pseudo-class-2.0.7.tgz",
-      "integrity": "sha512-7JPeVVZHd+jxYdULl87lvjgvWldYu+Bc62s9vD/ED6/QTGjy0jy0US/f6BG53sVMTBJ1lzKZFpYmofBN9eaRiA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-is-pseudo-class/-/postcss-is-pseudo-class-2.0.7.tgz",
+      "integrity": "sha1-hGrmwNWh6qh4/ONSxUT5wpVQnNE=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/selector-specificity": "^2.0.0",
@@ -2293,8 +2294,8 @@
     },
     "node_modules/@csstools/postcss-nested-calc": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-nested-calc/-/postcss-nested-calc-1.0.0.tgz",
-      "integrity": "sha512-JCsQsw1wjYwv1bJmgjKSoZNvf7R6+wuHDAbi5f/7MbFhl2d/+v+TvBTU4BJH3G1X1H87dHl0mh6TfYogbT/dJQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-nested-calc/-/postcss-nested-calc-1.0.0.tgz",
+      "integrity": "sha1-1+nR0NPRXPWsiRsWAoryoQRNDCY=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -2312,8 +2313,8 @@
     },
     "node_modules/@csstools/postcss-normalize-display-values": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-normalize-display-values/-/postcss-normalize-display-values-1.0.1.tgz",
-      "integrity": "sha512-jcOanIbv55OFKQ3sYeFD/T0Ti7AMXc9nM1hZWu8m/2722gOTxFg7xYu4RDLJLeZmPUVQlGzo4jhzvTUq3x4ZUw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-normalize-display-values/-/postcss-normalize-display-values-1.0.1.tgz",
+      "integrity": "sha1-FdpUo26GezrFFj7hLB1/gtTWEsM=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -2331,8 +2332,8 @@
     },
     "node_modules/@csstools/postcss-oklab-function": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-oklab-function/-/postcss-oklab-function-1.1.1.tgz",
-      "integrity": "sha512-nJpJgsdA3dA9y5pgyb/UfEzE7W5Ka7u0CX0/HIMVBNWzWemdcTH3XwANECU6anWv/ao4vVNLTMxhiPNZsTK6iA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-oklab-function/-/postcss-oklab-function-1.1.1.tgz",
+      "integrity": "sha1-iM7g+8jW3ycHnr0voBbuJh7s+EQ=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/postcss-progressive-custom-properties": "^1.1.0",
@@ -2351,8 +2352,8 @@
     },
     "node_modules/@csstools/postcss-progressive-custom-properties": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-progressive-custom-properties/-/postcss-progressive-custom-properties-1.3.0.tgz",
-      "integrity": "sha512-ASA9W1aIy5ygskZYuWams4BzafD12ULvSypmaLJT2jvQ8G0M3I8PRQhC0h7mG0Z3LI05+agZjqSR9+K9yaQQjA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-progressive-custom-properties/-/postcss-progressive-custom-properties-1.3.0.tgz",
+      "integrity": "sha1-VCKSVYOENhd2tFyFImuaOjTydvo=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -2366,8 +2367,8 @@
     },
     "node_modules/@csstools/postcss-stepped-value-functions": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-stepped-value-functions/-/postcss-stepped-value-functions-1.0.1.tgz",
-      "integrity": "sha512-dz0LNoo3ijpTOQqEJLY8nyaapl6umbmDcgj4AD0lgVQ572b2eqA1iGZYTTWhrcrHztWDDRAX2DGYyw2VBjvCvQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-stepped-value-functions/-/postcss-stepped-value-functions-1.0.1.tgz",
+      "integrity": "sha1-+HcsNoHMK+/taV4rCx1o4i8IxPQ=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -2385,8 +2386,8 @@
     },
     "node_modules/@csstools/postcss-text-decoration-shorthand": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-text-decoration-shorthand/-/postcss-text-decoration-shorthand-1.0.0.tgz",
-      "integrity": "sha512-c1XwKJ2eMIWrzQenN0XbcfzckOLLJiczqy+YvfGmzoVXd7pT9FfObiSEfzs84bpE/VqfpEuAZ9tCRbZkZxxbdw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-text-decoration-shorthand/-/postcss-text-decoration-shorthand-1.0.0.tgz",
+      "integrity": "sha1-6pbPvIfZIeypFNOtKTQNm8xMlT8=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -2404,8 +2405,8 @@
     },
     "node_modules/@csstools/postcss-trigonometric-functions": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-trigonometric-functions/-/postcss-trigonometric-functions-1.0.2.tgz",
-      "integrity": "sha512-woKaLO///4bb+zZC2s80l+7cm07M7268MsyG3M0ActXXEFi6SuhvriQYcb58iiKGbjwwIU7n45iRLEHypB47Og==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-trigonometric-functions/-/postcss-trigonometric-functions-1.0.2.tgz",
+      "integrity": "sha1-lNPkd0w2013NyIzgkTNst3DTJ1Y=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -2423,8 +2424,8 @@
     },
     "node_modules/@csstools/postcss-unset-value": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@csstools/postcss-unset-value/-/postcss-unset-value-1.0.2.tgz",
-      "integrity": "sha512-c8J4roPBILnelAsdLr4XOAR/GsTm0GJi4XpcfvoWk3U6KiTCqiFYc63KhRMQQX35jYMp4Ao8Ij9+IZRgMfJp1g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/postcss-unset-value/-/postcss-unset-value-1.0.2.tgz",
+      "integrity": "sha1-yZu3DizccxKUjR60HfJBIzC4H3c=",
       "license": "CC0-1.0",
       "engines": {
         "node": "^12 || ^14 || >=16"
@@ -2439,8 +2440,8 @@
     },
     "node_modules/@csstools/selector-specificity": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@csstools/selector-specificity/-/selector-specificity-2.2.0.tgz",
-      "integrity": "sha512-+OJ9konv95ClSTOJCmMZqpd5+YGsB2S+x6w3E1oaM8UuR5j8nTNHYSz8c9BEPGDOCMQYIEEGlVPj/VY64iTbGw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@csstools/selector-specificity/-/selector-specificity-2.2.0.tgz",
+      "integrity": "sha1-LLz4Ir83ZMlljE0uVovQwMt0gBY=",
       "license": "CC0-1.0",
       "engines": {
         "node": "^14 || ^16 || >=18"
@@ -2453,25 +2454,16 @@
         "postcss-selector-parser": "^6.0.10"
       }
     },
-    "node_modules/@ctrl/tinycolor": {
-      "version": "3.6.1",
-      "resolved": "https://registry.npmjs.org/@ctrl/tinycolor/-/tinycolor-3.6.1.tgz",
-      "integrity": "sha512-SITSV6aIXsuVNV3f3O0f2n/cgyEDWoSqtZMYiAmcsYHydcKrOz3gUxB/iXd/Qf08+IZX4KpgNbvUdMBmWz+kcA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=10"
-      }
-    },
     "node_modules/@emotion/hash": {
       "version": "0.9.2",
-      "resolved": "https://registry.npmjs.org/@emotion/hash/-/hash-0.9.2.tgz",
-      "integrity": "sha512-MyqliTZGuOm3+5ZRSaaBGP3USLw6+EGykkwZns2EPC5g8jJ4z9OrdZY9apkl3+UP9+sdz76YYkwCKP5gh8iY3g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@emotion/hash/-/hash-0.9.2.tgz",
+      "integrity": "sha1-/5IhufWLTf5h5hmneIc0vWP2iYs=",
       "license": "MIT"
     },
     "node_modules/@eslint-community/eslint-utils": {
       "version": "4.10.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz",
-      "integrity": "sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz",
+      "integrity": "sha1-iRG9crLDZApUNgngQAuMTS5+fLY=",
       "license": "MIT",
       "dependencies": {
         "eslint-visitor-keys": "^3.4.3"
@@ -2488,8 +2480,8 @@
     },
     "node_modules/@eslint-community/regexpp": {
       "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
-      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
+      "integrity": "sha1-vM32Fbz3tujbgw7AuNIcmiXeWXs=",
       "license": "MIT",
       "engines": {
         "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
@@ -2497,8 +2489,8 @@
     },
     "node_modules/@eslint/eslintrc": {
       "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-2.1.4.tgz",
-      "integrity": "sha512-269Z39MS6wVJtsoUl10L60WdkhJVdPG24Q4eZTH3nnF6lpvSShEK3wQjDX9JRWAUPvPh7COouPpU9IrqaZFvtQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@eslint/eslintrc/-/eslintrc-2.1.4.tgz",
+      "integrity": "sha1-OIomnw8lwbatwxe1osVXFIlMcK0=",
       "license": "MIT",
       "dependencies": {
         "ajv": "^6.12.4",
@@ -2520,8 +2512,8 @@
     },
     "node_modules/@eslint/eslintrc/node_modules/ajv": {
       "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha1-B+mCx0YmFnqnoklcU4F4ktcTlJI=",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
@@ -2536,14 +2528,14 @@
     },
     "node_modules/@eslint/eslintrc/node_modules/argparse": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha1-JG9Q88p4oyQPbJl+ipvR6sSeSzg=",
       "license": "Python-2.0"
     },
     "node_modules/@eslint/eslintrc/node_modules/js-yaml": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha1-ASFsAB1n9I4s1WDXCMevIQkKOEg=",
       "funding": [
         {
           "type": "github",
@@ -2564,14 +2556,14 @@
     },
     "node_modules/@eslint/eslintrc/node_modules/json-schema-traverse": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha1-afaofZUTq4u4/mO9sJecRI5oRmA=",
       "license": "MIT"
     },
     "node_modules/@eslint/js": {
       "version": "8.57.1",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.1.tgz",
-      "integrity": "sha512-d9zaMRSTIKDLhctzH12MtXvJKSSUhaHcjV+2Z+GK+EEY7XKpP5yR4x+N3TAcHTcu963nIr+TMcCb4DBCYX1z6Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@eslint/js/-/js-8.57.1.tgz",
+      "integrity": "sha1-3mM9s+wu9qPIni8ZA4Bj6KEi4sI=",
       "license": "MIT",
       "engines": {
         "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
@@ -2579,8 +2571,8 @@
     },
     "node_modules/@floating-ui/core": {
       "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@floating-ui/core/-/core-1.8.0.tgz",
-      "integrity": "sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@floating-ui/core/-/core-1.8.0.tgz",
+      "integrity": "sha1-0BwLvqAuSlf2/X1d5vwsXH3KQOE=",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/utils": "^0.2.12"
@@ -2588,8 +2580,8 @@
     },
     "node_modules/@floating-ui/devtools": {
       "version": "0.2.3",
-      "resolved": "https://registry.npmjs.org/@floating-ui/devtools/-/devtools-0.2.3.tgz",
-      "integrity": "sha512-ZTcxTvgo9CRlP7vJV62yCxdqmahHTGpSTi5QaTDgGoyQq0OyjaVZhUhXv/qdkQFOI3Sxlfmz0XGG4HaZMsDf8Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@floating-ui/devtools/-/devtools-0.2.3.tgz",
+      "integrity": "sha1-Bx8Gnlol5vKmPtaFhKEf98kpiUc=",
       "license": "MIT",
       "peerDependencies": {
         "@floating-ui/dom": "^1.0.0"
@@ -2597,8 +2589,8 @@
     },
     "node_modules/@floating-ui/dom": {
       "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@floating-ui/dom/-/dom-1.8.0.tgz",
-      "integrity": "sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@floating-ui/dom/-/dom-1.8.0.tgz",
+      "integrity": "sha1-iiDm+sviRWr9vrbIuWinLfaJz2M=",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/core": "^1.8.0",
@@ -2607,44 +2599,44 @@
     },
     "node_modules/@floating-ui/utils": {
       "version": "0.2.12",
-      "resolved": "https://registry.npmjs.org/@floating-ui/utils/-/utils-0.2.12.tgz",
-      "integrity": "sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@floating-ui/utils/-/utils-0.2.12.tgz",
+      "integrity": "sha1-r+/nhZSfFqxM3R5pWTWjIVct1Wo=",
       "license": "MIT"
     },
     "node_modules/@fluentui/keyboard-keys": {
-      "version": "9.0.8",
-      "resolved": "https://registry.npmjs.org/@fluentui/keyboard-keys/-/keyboard-keys-9.0.8.tgz",
-      "integrity": "sha512-iUSJUUHAyTosnXK8O2Ilbfxma+ZyZPMua5vB028Ys96z80v+LFwntoehlFsdH3rMuPsA8GaC1RE7LMezwPBPdw==",
+      "version": "9.0.9",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/keyboard-keys/-/keyboard-keys-9.0.9.tgz",
+      "integrity": "sha1-7sHNAloH0tUAsMo/maeO/NY8ABQ=",
       "license": "MIT",
       "dependencies": {
         "@swc/helpers": "^0.5.1"
       }
     },
     "node_modules/@fluentui/priority-overflow": {
-      "version": "9.4.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/priority-overflow/-/priority-overflow-9.4.1.tgz",
-      "integrity": "sha512-w/cO/mtqWd/ly4fhrbfCPLwdEAVmuifemnhl1SZm8IN7dMWv22pumsIuiH67T4YRLbhHtHXDAKp0HLXNR3z7lA==",
+      "version": "9.4.2",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/priority-overflow/-/priority-overflow-9.4.2.tgz",
+      "integrity": "sha1-Ji840iLnXJlv4JdXwBOskMY7a0g=",
       "license": "MIT",
       "dependencies": {
         "@swc/helpers": "^0.5.1"
       }
     },
     "node_modules/@fluentui/react-accordion": {
-      "version": "9.12.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-accordion/-/react-accordion-9.12.1.tgz",
-      "integrity": "sha512-F7xVaP0OR7JMCxrBwI3ryNhKof9Yi2c6RhYPsQy7rh2+KMGLGgYLsrDJyHmSejjxp4Bs11plXGdU38SN5j1hgw==",
+      "version": "9.12.2",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-accordion/-/react-accordion-9.12.2.tgz",
+      "integrity": "sha1-5tnkUQVgiOm9VazNT4vbKeOk/Ng=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-context-selector": "^9.2.18",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-context-selector": "^9.2.19",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-motion-components-preview": "^0.15.6",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-motion-components-preview": "^0.15.7",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2656,18 +2648,18 @@
       }
     },
     "node_modules/@fluentui/react-alert": {
-      "version": "9.0.0-beta.142",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-alert/-/react-alert-9.0.0-beta.142.tgz",
-      "integrity": "sha512-YrbMX1wF7huOByxP2J+2aUWatpODd1MXhqam95oeLUnoJUViBK6ZZuBYba7m0OTsRMUA4pB1WfjvuIGsnSQKtw==",
+      "version": "9.0.1-0",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-alert/-/react-alert-9.0.1-0.tgz",
+      "integrity": "sha1-jxNI4Lat6bxHFODSBHc0ITLNnuA=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-avatar": "^9.11.3",
-        "@fluentui/react-button": "^9.10.1",
+        "@fluentui/react-avatar": "^9.11.5",
+        "@fluentui/react-button": "^9.11.0",
         "@fluentui/react-icons": "^2.0.239",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2679,16 +2671,16 @@
       }
     },
     "node_modules/@fluentui/react-aria": {
-      "version": "9.17.13",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-aria/-/react-aria-9.17.13.tgz",
-      "integrity": "sha512-f5qSP5aD2ZbYgQn4hCjQzqh8mHJNeN/vsC9Nwth5uJlGNdIAPbPO+dXVC18DkYqNU8O9A5Ae/uJPRbxoH23zbA==",
+      "version": "9.17.14",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-aria/-/react-aria-9.17.14.tgz",
+      "integrity": "sha1-6ajfh3H7w7k8hr8jU1iF5Xjxwrc=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-utilities": "^9.26.6",
         "@swc/helpers": "^0.5.1"
       },
       "peerDependencies": {
@@ -2699,21 +2691,21 @@
       }
     },
     "node_modules/@fluentui/react-avatar": {
-      "version": "9.11.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-avatar/-/react-avatar-9.11.3.tgz",
-      "integrity": "sha512-O8PoDUf1OUXDviECFvxdxo88kCEJLlP4TtCXyE58PKuAywrVeqmOA7eNy6/xhaGVuyDO8l9YJh05sYkyLiNLIQ==",
+      "version": "9.11.5",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-avatar/-/react-avatar-9.11.5.tgz",
+      "integrity": "sha1-KBIAVT20cckbBZxryn4h80hFAwI=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-badge": "^9.5.4",
-        "@fluentui/react-context-selector": "^9.2.18",
+        "@fluentui/react-badge": "^9.5.5",
+        "@fluentui/react-context-selector": "^9.2.19",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-popover": "^9.14.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-tooltip": "^9.10.3",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-popover": "^9.14.6",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-tooltip": "^9.10.5",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2725,16 +2717,16 @@
       }
     },
     "node_modules/@fluentui/react-badge": {
-      "version": "9.5.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-badge/-/react-badge-9.5.4.tgz",
-      "integrity": "sha512-jxS6H6+KCk62MeueCf7cT2fRbdnN6h/lCOIyXWJLpPf9Mx+LWWP3KAfKik3BuDY28oy1pDYIuvFucDL+OMAb/Q==",
+      "version": "9.5.5",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-badge/-/react-badge-9.5.5.tgz",
+      "integrity": "sha1-3zAcLTWKlB5LWeNcJeuKAN4RUg8=",
       "license": "MIT",
       "dependencies": {
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2746,20 +2738,20 @@
       }
     },
     "node_modules/@fluentui/react-breadcrumb": {
-      "version": "9.4.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-breadcrumb/-/react-breadcrumb-9.4.4.tgz",
-      "integrity": "sha512-KcxyQAC+xTO/n2BMBj2lLKgQL2/eyTlkUhElHv9SKqP29Ks8EPYSovYpDtSfbtx8Dle+8NSUnhAvnO1kE/+fMQ==",
+      "version": "9.4.5",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-breadcrumb/-/react-breadcrumb-9.4.5.tgz",
+      "integrity": "sha1-umUesGdRWutY9g9aeX3EGvRfAQM=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-button": "^9.10.1",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-button": "^9.11.0",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-link": "^9.8.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-link": "^9.8.4",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2771,19 +2763,19 @@
       }
     },
     "node_modules/@fluentui/react-button": {
-      "version": "9.10.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-button/-/react-button-9.10.1.tgz",
-      "integrity": "sha512-8Ow/ck9a/RLh3cJ6ZPF4asmGnNfqXr/Kengk+zTkMuppk+pFL3X6WEMrJLSOUKKZtx0Tp1UBuUPA6RL6Ive5WQ==",
+      "version": "9.11.0",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-button/-/react-button-9.11.0.tgz",
+      "integrity": "sha1-9G/zidvSMQs/meDP8/thji+StyQ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2795,18 +2787,18 @@
       }
     },
     "node_modules/@fluentui/react-card": {
-      "version": "9.7.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-card/-/react-card-9.7.1.tgz",
-      "integrity": "sha512-4t65Y9pRW9W7kf/Yyc7S796le2WFKfXFTCuzfkFS+AHUM7JlrmMUOnQLA0i24WDNS6ArA0vo6EbMDnUcjgV9Yg==",
-      "license": "MIT",
-      "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-text": "^9.6.18",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+      "version": "9.7.2",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-card/-/react-card-9.7.2.tgz",
+      "integrity": "sha1-1KXZZgZTHRac1aObB02rZOYwvgw=",
+      "license": "MIT",
+      "dependencies": {
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-text": "^9.6.19",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2818,21 +2810,21 @@
       }
     },
     "node_modules/@fluentui/react-carousel": {
-      "version": "9.9.10",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-carousel/-/react-carousel-9.9.10.tgz",
-      "integrity": "sha512-Ml3Vqi9KNA+mRG1FUiIjk/HCYqEjRZKSE8jQviMSQDLe4Rb6EO16FhtuFuIOz/ls47y/Sx6zTnb1t+HiFatpJg==",
+      "version": "9.9.12",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-carousel/-/react-carousel-9.9.12.tgz",
+      "integrity": "sha1-McIwOEPRQhfzZP2m+vUP36LHgs0=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-button": "^9.10.1",
-        "@fluentui/react-context-selector": "^9.2.18",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-button": "^9.11.0",
+        "@fluentui/react-context-selector": "^9.2.19",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-tooltip": "^9.10.3",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-tooltip": "^9.10.5",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1",
         "embla-carousel": "^8.5.1",
@@ -2847,19 +2839,19 @@
       }
     },
     "node_modules/@fluentui/react-checkbox": {
-      "version": "9.6.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-checkbox/-/react-checkbox-9.6.3.tgz",
-      "integrity": "sha512-VzePhN5Nz3D69Fu7SnPUCrMfkrbhfqGpNJDis85+W7dvOo9cyUou6yRreHsSzxVkRyE9swcA1LnsKJS6oVn9ew==",
+      "version": "9.6.4",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-checkbox/-/react-checkbox-9.6.4.tgz",
+      "integrity": "sha1-GU0I9EWi0erC2um7ddRiSq9SFeg=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-field": "^9.5.3",
+        "@fluentui/react-field": "^9.5.4",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-label": "^9.4.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-label": "^9.4.4",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2871,18 +2863,17 @@
       }
     },
     "node_modules/@fluentui/react-color-picker": {
-      "version": "9.2.18",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-color-picker/-/react-color-picker-9.2.18.tgz",
-      "integrity": "sha512-zbsQ+hVJeGwXVTjneA42i4UuHRACfcTnBs3BUcDT22lBDQjJxhYYZzmj5ksM92M2ZU0fMHV8K5OfSyCnZU5mqQ==",
-      "license": "MIT",
-      "dependencies": {
-        "@ctrl/tinycolor": "^3.3.4",
-        "@fluentui/react-context-selector": "^9.2.18",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+      "version": "9.3.0",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-color-picker/-/react-color-picker-9.3.0.tgz",
+      "integrity": "sha1-lkOdsi1ikj45HyvCU8rzOninWH4=",
+      "license": "MIT",
+      "dependencies": {
+        "@fluentui/react-context-selector": "^9.2.19",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2894,23 +2885,23 @@
       }
     },
     "node_modules/@fluentui/react-combobox": {
-      "version": "9.17.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-combobox/-/react-combobox-9.17.3.tgz",
-      "integrity": "sha512-QuWcM6fvqnfUzpkJApQbXfbIQ6iQkMGgrsdwmJHkB4Q/E6zT0aLZoEjEx2P5QkMz9m5D7LzeZWmFIOEFq8SzFQ==",
+      "version": "9.17.5",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-combobox/-/react-combobox-9.17.5.tgz",
+      "integrity": "sha1-XAFpJfp/AObuvh9dnZy6nRFBTxQ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-context-selector": "^9.2.18",
-        "@fluentui/react-field": "^9.5.3",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-context-selector": "^9.2.19",
+        "@fluentui/react-field": "^9.5.4",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-portal": "^9.8.14",
-        "@fluentui/react-positioning": "^9.22.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-portal": "^9.8.15",
+        "@fluentui/react-positioning": "^9.23.1",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2922,71 +2913,71 @@
       }
     },
     "node_modules/@fluentui/react-components": {
-      "version": "9.74.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-components/-/react-components-9.74.4.tgz",
-      "integrity": "sha512-/8IxyJiQ7J0R3rF/T6InuVffT72dJjt506WaAFt1ndnpEAu2zpjYD6Vjhv4+Xvye20ix2j4dHDs6OUXS/vlrpg==",
-      "license": "MIT",
-      "dependencies": {
-        "@fluentui/react-accordion": "^9.12.1",
-        "@fluentui/react-alert": "9.0.0-beta.142",
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-avatar": "^9.11.3",
-        "@fluentui/react-badge": "^9.5.4",
-        "@fluentui/react-breadcrumb": "^9.4.4",
-        "@fluentui/react-button": "^9.10.1",
-        "@fluentui/react-card": "^9.7.1",
-        "@fluentui/react-carousel": "^9.9.10",
-        "@fluentui/react-checkbox": "^9.6.3",
-        "@fluentui/react-color-picker": "^9.2.18",
-        "@fluentui/react-combobox": "^9.17.3",
-        "@fluentui/react-dialog": "^9.18.2",
-        "@fluentui/react-divider": "^9.7.3",
-        "@fluentui/react-drawer": "^9.13.1",
-        "@fluentui/react-field": "^9.5.3",
-        "@fluentui/react-image": "^9.4.3",
-        "@fluentui/react-infobutton": "9.0.0-beta.117",
-        "@fluentui/react-infolabel": "^9.4.22",
-        "@fluentui/react-input": "^9.8.4",
-        "@fluentui/react-label": "^9.4.3",
-        "@fluentui/react-link": "^9.8.3",
-        "@fluentui/react-list": "^9.6.16",
-        "@fluentui/react-menu": "^9.25.1",
-        "@fluentui/react-message-bar": "^9.7.3",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-nav": "^9.4.2",
-        "@fluentui/react-overflow": "^9.9.1",
-        "@fluentui/react-persona": "^9.7.5",
-        "@fluentui/react-popover": "^9.14.4",
-        "@fluentui/react-portal": "^9.8.14",
-        "@fluentui/react-positioning": "^9.22.3",
-        "@fluentui/react-progress": "^9.5.3",
-        "@fluentui/react-provider": "^9.22.18",
-        "@fluentui/react-radio": "^9.6.4",
-        "@fluentui/react-rating": "^9.4.3",
-        "@fluentui/react-search": "^9.4.4",
-        "@fluentui/react-select": "^9.5.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-skeleton": "^9.7.4",
-        "@fluentui/react-slider": "^9.6.4",
-        "@fluentui/react-spinbutton": "^9.6.4",
-        "@fluentui/react-spinner": "^9.8.4",
-        "@fluentui/react-swatch-picker": "^9.5.4",
-        "@fluentui/react-switch": "^9.7.4",
-        "@fluentui/react-table": "^9.19.17",
-        "@fluentui/react-tabs": "^9.12.3",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-tag-picker": "^9.10.0",
-        "@fluentui/react-tags": "^9.9.2",
-        "@fluentui/react-teaching-popover": "^9.7.2",
-        "@fluentui/react-text": "^9.6.18",
-        "@fluentui/react-textarea": "^9.7.4",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-toast": "^9.8.1",
-        "@fluentui/react-toolbar": "^9.8.3",
-        "@fluentui/react-tooltip": "^9.10.3",
-        "@fluentui/react-tree": "^9.16.3",
-        "@fluentui/react-utilities": "^9.26.5",
-        "@fluentui/react-virtualizer": "9.0.0-alpha.114",
+      "version": "9.74.6",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-components/-/react-components-9.74.6.tgz",
+      "integrity": "sha1-aCBpGhCNrZgSGEHoI1L6yahSrk8=",
+      "license": "MIT",
+      "dependencies": {
+        "@fluentui/react-accordion": "^9.12.2",
+        "@fluentui/react-alert": "9.0.1-0",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-avatar": "^9.11.5",
+        "@fluentui/react-badge": "^9.5.5",
+        "@fluentui/react-breadcrumb": "^9.4.5",
+        "@fluentui/react-button": "^9.11.0",
+        "@fluentui/react-card": "^9.7.2",
+        "@fluentui/react-carousel": "^9.9.12",
+        "@fluentui/react-checkbox": "^9.6.4",
+        "@fluentui/react-color-picker": "^9.3.0",
+        "@fluentui/react-combobox": "^9.17.5",
+        "@fluentui/react-dialog": "^9.18.3",
+        "@fluentui/react-divider": "^9.7.4",
+        "@fluentui/react-drawer": "^9.13.2",
+        "@fluentui/react-field": "^9.5.4",
+        "@fluentui/react-image": "^9.4.4",
+        "@fluentui/react-infobutton": "9.0.0-beta.119",
+        "@fluentui/react-infolabel": "^9.4.24",
+        "@fluentui/react-input": "^9.8.6",
+        "@fluentui/react-label": "^9.4.4",
+        "@fluentui/react-link": "^9.8.4",
+        "@fluentui/react-list": "^9.6.17",
+        "@fluentui/react-menu": "^9.25.3",
+        "@fluentui/react-message-bar": "^9.7.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-nav": "^9.4.4",
+        "@fluentui/react-overflow": "^9.9.2",
+        "@fluentui/react-persona": "^9.7.7",
+        "@fluentui/react-popover": "^9.14.6",
+        "@fluentui/react-portal": "^9.8.15",
+        "@fluentui/react-positioning": "^9.23.1",
+        "@fluentui/react-progress": "^9.5.4",
+        "@fluentui/react-provider": "^9.22.20",
+        "@fluentui/react-radio": "^9.6.5",
+        "@fluentui/react-rating": "^9.4.4",
+        "@fluentui/react-search": "^9.4.6",
+        "@fluentui/react-select": "^9.5.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-skeleton": "^9.7.5",
+        "@fluentui/react-slider": "^9.6.5",
+        "@fluentui/react-spinbutton": "^9.6.5",
+        "@fluentui/react-spinner": "^9.8.5",
+        "@fluentui/react-swatch-picker": "^9.6.0",
+        "@fluentui/react-switch": "^9.7.5",
+        "@fluentui/react-table": "^9.19.19",
+        "@fluentui/react-tabs": "^9.12.4",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-tag-picker": "^9.10.2",
+        "@fluentui/react-tags": "^9.9.4",
+        "@fluentui/react-teaching-popover": "^9.7.4",
+        "@fluentui/react-text": "^9.6.19",
+        "@fluentui/react-textarea": "^9.7.6",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-toast": "^9.8.2",
+        "@fluentui/react-toolbar": "^9.8.4",
+        "@fluentui/react-tooltip": "^9.10.5",
+        "@fluentui/react-tree": "^9.16.5",
+        "@fluentui/react-utilities": "^9.26.6",
+        "@fluentui/react-virtualizer": "9.0.0-alpha.115",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -2998,12 +2989,12 @@
       }
     },
     "node_modules/@fluentui/react-context-selector": {
-      "version": "9.2.18",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-context-selector/-/react-context-selector-9.2.18.tgz",
-      "integrity": "sha512-A9YdkKonDlNSTnD8SCcSMhj0O6mAyMtXMERWH5mA1UqdtVxzJ4Y/muNd3Nk5rwAaLPUZ5HWMabtt2Ewa/BxARA==",
+      "version": "9.2.19",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-context-selector/-/react-context-selector-9.2.19.tgz",
+      "integrity": "sha1-bWHNmAuKFehB3WbPVw+/9O6LNVQ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-utilities": "^9.26.6",
         "@swc/helpers": "^0.5.1"
       },
       "peerDependencies": {
@@ -3015,23 +3006,23 @@
       }
     },
     "node_modules/@fluentui/react-dialog": {
-      "version": "9.18.2",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-dialog/-/react-dialog-9.18.2.tgz",
-      "integrity": "sha512-acW70/CxibJC19bQVbrJyxYiuIP9nX593O/Tya4x9wMEEcnTHZ6RW8liS6kbYYEL/AERYRuOYkLJ++TNniTxSA==",
+      "version": "9.18.3",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-dialog/-/react-dialog-9.18.3.tgz",
+      "integrity": "sha1-PD6awtl+uiDfk6zjRb80ZJEbZfQ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-context-selector": "^9.2.18",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-context-selector": "^9.2.19",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-motion-components-preview": "^0.15.6",
-        "@fluentui/react-portal": "^9.8.14",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-motion-components-preview": "^0.15.7",
+        "@fluentui/react-portal": "^9.8.15",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3043,15 +3034,15 @@
       }
     },
     "node_modules/@fluentui/react-divider": {
-      "version": "9.7.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-divider/-/react-divider-9.7.3.tgz",
-      "integrity": "sha512-uhqpu+JfSaLEqFNtDQFYFo/gM1QoRV2I1iUYTMsO2iqEis4zZmMsQETti7lTv29SITWIky3e8pkRoC6xyQBLsg==",
+      "version": "9.7.4",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-divider/-/react-divider-9.7.4.tgz",
+      "integrity": "sha1-14OPvM1MQXcH/R/jBfCBx2K5occ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3063,20 +3054,20 @@
       }
     },
     "node_modules/@fluentui/react-drawer": {
-      "version": "9.13.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-drawer/-/react-drawer-9.13.1.tgz",
-      "integrity": "sha512-nZBWG0290IcCshpt2wjORDD8fLOsccSPdp0EW45CxK09/JR+4hkGbbIj8x14GW7GYu4RsGzk18OYga0kY+4j2Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@fluentui/react-dialog": "^9.18.2",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-motion-components-preview": "^0.15.6",
-        "@fluentui/react-portal": "^9.8.14",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+      "version": "9.13.2",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-drawer/-/react-drawer-9.13.2.tgz",
+      "integrity": "sha1-GxSa0iPZTvq27ESM+Kx/M8D/I2Y=",
+      "license": "MIT",
+      "dependencies": {
+        "@fluentui/react-dialog": "^9.18.3",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-motion-components-preview": "^0.15.7",
+        "@fluentui/react-portal": "^9.8.15",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3088,18 +3079,18 @@
       }
     },
     "node_modules/@fluentui/react-field": {
-      "version": "9.5.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-field/-/react-field-9.5.3.tgz",
-      "integrity": "sha512-5PJXFTGS9W4CBJW6Nh2Tqe5p8RxMMCPbsIyIcYUXIxCZTXDGrx1jZ+af8lWKJFlcfWOlFxyK+QE14UXl+lqzqw==",
+      "version": "9.5.4",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-field/-/react-field-9.5.4.tgz",
+      "integrity": "sha1-6jn04iOwHYhaJqlo434imkWf8F4=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-context-selector": "^9.2.18",
+        "@fluentui/react-context-selector": "^9.2.19",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-label": "^9.4.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-label": "^9.4.4",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3111,9 +3102,9 @@
       }
     },
     "node_modules/@fluentui/react-icons": {
-      "version": "2.0.334",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-icons/-/react-icons-2.0.334.tgz",
-      "integrity": "sha512-6A2boRTWkn7qOSX6kgLPVqCMZ9WQg6babIx14LKrwpsRGPOYx7QaqgGs+XE671wiJqNQX0JjuIGhvRRGL5zD+A==",
+      "version": "2.0.335",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-icons/-/react-icons-2.0.335.tgz",
+      "integrity": "sha1-XEPelRupLDV1KWaOyE3a3lRsiXs=",
       "license": "MIT",
       "dependencies": {
         "@griffel/react": "^1.6.1",
@@ -3124,15 +3115,15 @@
       }
     },
     "node_modules/@fluentui/react-image": {
-      "version": "9.4.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-image/-/react-image-9.4.3.tgz",
-      "integrity": "sha512-BQSsT3kVdpR3s02Zq9zpqj0NjaijWOVKPLBchp9XqWlygO15dkykNt2LRoHAkZRgpnlh2D8zBCw9qQ4ubzYNaA==",
+      "version": "9.4.4",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-image/-/react-image-9.4.4.tgz",
+      "integrity": "sha1-DZVhHFrY2kKfYFS9m9h4+hpDej4=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3144,18 +3135,18 @@
       }
     },
     "node_modules/@fluentui/react-infobutton": {
-      "version": "9.0.0-beta.117",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-infobutton/-/react-infobutton-9.0.0-beta.117.tgz",
-      "integrity": "sha512-h01PQzH736I/7mhjNcYi8cFjspCqgSmQukXbzCsESzB1VnAkx8djqy5A8f/mV1HmHw7vBAIX8VdH+ddtx8WyXQ==",
+      "version": "9.0.0-beta.119",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-infobutton/-/react-infobutton-9.0.0-beta.119.tgz",
+      "integrity": "sha1-qht3KUOsImLKSSHLS8kVw50OT0I=",
       "license": "MIT",
       "dependencies": {
         "@fluentui/react-icons": "^2.0.237",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-label": "^9.4.3",
-        "@fluentui/react-popover": "^9.14.4",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-label": "^9.4.4",
+        "@fluentui/react-popover": "^9.14.6",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3167,19 +3158,19 @@
       }
     },
     "node_modules/@fluentui/react-infolabel": {
-      "version": "9.4.22",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-infolabel/-/react-infolabel-9.4.22.tgz",
-      "integrity": "sha512-K5W+g+HfGu5ltl5BGekZJB2z0ACLidIW7KFQ5Qj+UG1kpoB3G4q10HTm5gY74VjXP/GrM5RVx8IcnHRqyAfR1Q==",
+      "version": "9.4.24",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-infolabel/-/react-infolabel-9.4.24.tgz",
+      "integrity": "sha1-il559cfazk575Tu8lGwU6SFY9JA=",
       "license": "MIT",
       "dependencies": {
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-label": "^9.4.3",
-        "@fluentui/react-popover": "^9.14.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-label": "^9.4.4",
+        "@fluentui/react-popover": "^9.14.6",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3191,16 +3182,16 @@
       }
     },
     "node_modules/@fluentui/react-input": {
-      "version": "9.8.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-input/-/react-input-9.8.4.tgz",
-      "integrity": "sha512-Lpdu0TBBSbv3VasaCz3blNeEgQS7XhtLTmiYXZj5g8Hrk7gNDJORDPYRrXcRjOUPGkV/InB4JY+GeXy2cYfOaA==",
+      "version": "9.8.6",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-input/-/react-input-9.8.6.tgz",
+      "integrity": "sha1-6yjTgOs4wIZ+FcdYkqHR3xmTVqI=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-field": "^9.5.3",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-field": "^9.5.4",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3212,12 +3203,12 @@
       }
     },
     "node_modules/@fluentui/react-jsx-runtime": {
-      "version": "9.4.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-jsx-runtime/-/react-jsx-runtime-9.4.4.tgz",
-      "integrity": "sha512-npqPWSJ2qciCRB4B/cyWyrTbf8V8Z2Kfr9HnZqrUBDgEvq72rRGb+gml6naxGNzhaT4NBLQLZmdPZqt+1wZ4ig==",
+      "version": "9.4.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-jsx-runtime/-/react-jsx-runtime-9.4.5.tgz",
+      "integrity": "sha1-VutbDTMaVT9kzZ/KtbV1LZgVmss=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-utilities": "^9.26.6",
         "@swc/helpers": "^0.5.1"
       },
       "peerDependencies": {
@@ -3226,15 +3217,15 @@
       }
     },
     "node_modules/@fluentui/react-label": {
-      "version": "9.4.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-label/-/react-label-9.4.3.tgz",
-      "integrity": "sha512-/tYFciaorFym7Q2yDCdRYeP3JzLtw5eYt2yCvRlmBsugtKmn2f/kOu+b2cB37kWizbXjSdOGhCrTL8J1EUlIZg==",
+      "version": "9.4.4",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-label/-/react-label-9.4.4.tgz",
+      "integrity": "sha1-HAa1t68/i96EoP2vU8mrF2Pi5JQ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3246,17 +3237,17 @@
       }
     },
     "node_modules/@fluentui/react-link": {
-      "version": "9.8.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-link/-/react-link-9.8.3.tgz",
-      "integrity": "sha512-3Cd+UWgLpP6E6/NZaomCqZd965gruWXz2+gqUDfP7nBTLaCgOIuFQe0HAgSYi0ys4xli3cDtKeytqZJ7ReA6gg==",
+      "version": "9.8.4",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-link/-/react-link-9.8.4.tgz",
+      "integrity": "sha1-XZkOR4CuDc7RuK53T56+BllDne4=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3268,19 +3259,19 @@
       }
     },
     "node_modules/@fluentui/react-list": {
-      "version": "9.6.16",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-list/-/react-list-9.6.16.tgz",
-      "integrity": "sha512-ZWsLxr1ZDe6hmvGLGlHQIPt1E70xsWHaHn+QGxB0XUxjq64SnxCDm4HCSPZ40MS3Hqgd4eQdnmPUS9d6odcYUA==",
-      "license": "MIT",
-      "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-checkbox": "^9.6.3",
-        "@fluentui/react-context-selector": "^9.2.18",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+      "version": "9.6.17",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-list/-/react-list-9.6.17.tgz",
+      "integrity": "sha1-3inVufBf93K1jJG7t0NP7QV9+Os=",
+      "license": "MIT",
+      "dependencies": {
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-checkbox": "^9.6.4",
+        "@fluentui/react-context-selector": "^9.2.19",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3292,24 +3283,24 @@
       }
     },
     "node_modules/@fluentui/react-menu": {
-      "version": "9.25.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-menu/-/react-menu-9.25.1.tgz",
-      "integrity": "sha512-nP2bUB0Blrz5cqG6JnaHKznD2zGv134vuiCStk0op1/IErIPoU6wJj6H+unYVhFwyHCReyPZcp/pQZWkSWErJQ==",
+      "version": "9.25.3",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-menu/-/react-menu-9.25.3.tgz",
+      "integrity": "sha1-fTbgjRw4xIXTGz7CJaRov4bLldU=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-context-selector": "^9.2.18",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-context-selector": "^9.2.19",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-motion-components-preview": "^0.15.6",
-        "@fluentui/react-portal": "^9.8.14",
-        "@fluentui/react-positioning": "^9.22.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-motion-components-preview": "^0.15.7",
+        "@fluentui/react-portal": "^9.8.15",
+        "@fluentui/react-positioning": "^9.23.1",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3321,20 +3312,20 @@
       }
     },
     "node_modules/@fluentui/react-message-bar": {
-      "version": "9.7.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-message-bar/-/react-message-bar-9.7.3.tgz",
-      "integrity": "sha512-LxcoTatsPPYj8Y5fx9QeJYOlXs6C4HIgmXTUaqNTCnFquNrcBHU4RtzUEq/6ssJ8jP/dy8Z03Bk4dE31RCV5MA==",
+      "version": "9.7.5",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-message-bar/-/react-message-bar-9.7.5.tgz",
+      "integrity": "sha1-Jl2SB3Oy7RrhagSlCENbyiXTfN0=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-button": "^9.10.1",
+        "@fluentui/react-button": "^9.11.0",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-link": "^9.8.3",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-motion-components-preview": "^0.15.6",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-link": "^9.8.4",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-motion-components-preview": "^0.15.7",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3346,13 +3337,13 @@
       }
     },
     "node_modules/@fluentui/react-motion": {
-      "version": "9.16.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-motion/-/react-motion-9.16.1.tgz",
-      "integrity": "sha512-sbrNuauwI5uw20XOAqPjXBfgBqPreHc5AxU7bJ6yoLUHL2gDKo7KGAIvLEd216GX37mgPkb3dx9rarIVGx3uvA==",
+      "version": "9.16.2",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-motion/-/react-motion-9.16.2.tgz",
+      "integrity": "sha1-/WO9K2Y7KUDI5/KNhfXtRSMrAWI=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-utilities": "^9.26.6",
         "@swc/helpers": "^0.5.1"
       },
       "peerDependencies": {
@@ -3363,9 +3354,9 @@
       }
     },
     "node_modules/@fluentui/react-motion-components-preview": {
-      "version": "0.15.6",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-motion-components-preview/-/react-motion-components-preview-0.15.6.tgz",
-      "integrity": "sha512-9aNzHAHNdfbH/8/mYGy5YVrUOGnpiru3YrqQ7KhCRWXvlce7yV3WF5CzN1g/uNh3MFmKGwQeW4ui6xJOfEaI4Q==",
+      "version": "0.15.7",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-motion-components-preview/-/react-motion-components-preview-0.15.7.tgz",
+      "integrity": "sha1-iCLPaMOnEI395rz9nf1/+iqHfZI=",
       "license": "MIT",
       "dependencies": {
         "@fluentui/react-motion": "*",
@@ -3380,25 +3371,25 @@
       }
     },
     "node_modules/@fluentui/react-nav": {
-      "version": "9.4.2",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-nav/-/react-nav-9.4.2.tgz",
-      "integrity": "sha512-1nZgZwZHgJ1P73E0Aw4UrTqri9BMSShI7otuktdATB5iHolDHE+9JtQjr3OQJ0QR+YyXgD8bMWiKvSa6p/Pdlw==",
+      "version": "9.4.4",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-nav/-/react-nav-9.4.4.tgz",
+      "integrity": "sha1-hYNb+V3RAr/TKpW/ezW4UICg7YY=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-button": "^9.10.1",
-        "@fluentui/react-context-selector": "^9.2.18",
-        "@fluentui/react-divider": "^9.7.3",
-        "@fluentui/react-drawer": "^9.13.1",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-button": "^9.11.0",
+        "@fluentui/react-context-selector": "^9.2.19",
+        "@fluentui/react-divider": "^9.7.4",
+        "@fluentui/react-drawer": "^9.13.2",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-motion-components-preview": "^0.15.6",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-tooltip": "^9.10.3",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-motion-components-preview": "^0.15.7",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-tooltip": "^9.10.5",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3410,15 +3401,15 @@
       }
     },
     "node_modules/@fluentui/react-overflow": {
-      "version": "9.9.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-overflow/-/react-overflow-9.9.1.tgz",
-      "integrity": "sha512-C5JP1zZ71Z1qtDAZSQ+/dMYiEqhQOrNSz3qNloRLYb7G5ywaBUp+vOLbETEe7QUiaDNtViYtxR1TI9nX2pPOUA==",
+      "version": "9.9.2",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-overflow/-/react-overflow-9.9.2.tgz",
+      "integrity": "sha1-Bw1i69Y0sqMgtS7MnFH4YCWHbmU=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/priority-overflow": "^9.4.1",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/priority-overflow": "^9.4.2",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3430,17 +3421,17 @@
       }
     },
     "node_modules/@fluentui/react-persona": {
-      "version": "9.7.5",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-persona/-/react-persona-9.7.5.tgz",
-      "integrity": "sha512-5MlVpl3+l+UW7vTf/d1qKP6EANBkxoXjmxmbNZpiuXjIE2QJFcVRBplWXwEPgt3GAOGnix1wPVkUgHElUJOCEw==",
+      "version": "9.7.7",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-persona/-/react-persona-9.7.7.tgz",
+      "integrity": "sha1-/IKMBjEnvbfHkvcJgYqftyxrTls=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-avatar": "^9.11.3",
-        "@fluentui/react-badge": "^9.5.4",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-avatar": "^9.11.5",
+        "@fluentui/react-badge": "^9.5.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3452,23 +3443,23 @@
       }
     },
     "node_modules/@fluentui/react-popover": {
-      "version": "9.14.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-popover/-/react-popover-9.14.4.tgz",
-      "integrity": "sha512-Ofn4kh+WfC647n9ap0mtoN47eP0FsP/ZIjoZf1GfW6Co+A3zAZN+V7z6AayCPvbvdv8vKFQ0diHeUBrIu9Pz3Q==",
-      "license": "MIT",
-      "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-context-selector": "^9.2.18",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-motion-components-preview": "^0.15.6",
-        "@fluentui/react-portal": "^9.8.14",
-        "@fluentui/react-positioning": "^9.22.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+      "version": "9.14.6",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-popover/-/react-popover-9.14.6.tgz",
+      "integrity": "sha1-gHPfvuZxkMhTN/yl5ImP4TvPuZ0=",
+      "license": "MIT",
+      "dependencies": {
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-context-selector": "^9.2.19",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-motion-components-preview": "^0.15.7",
+        "@fluentui/react-portal": "^9.8.15",
+        "@fluentui/react-positioning": "^9.23.1",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3480,14 +3471,14 @@
       }
     },
     "node_modules/@fluentui/react-portal": {
-      "version": "9.8.14",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-portal/-/react-portal-9.8.14.tgz",
-      "integrity": "sha512-od8RN6dny6N/qGFm2uv5UV+ugGOKupFeCIF+R0rU5SimSvix6o+wv5rPrH9JHRHFqjDIi5kRh9hk/rZfgsnuaA==",
+      "version": "9.8.15",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-portal/-/react-portal-9.8.15.tgz",
+      "integrity": "sha1-FsLXz4CxYvGuZbdY0FD2GsQFbVw=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3499,16 +3490,16 @@
       }
     },
     "node_modules/@fluentui/react-positioning": {
-      "version": "9.22.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-positioning/-/react-positioning-9.22.3.tgz",
-      "integrity": "sha512-2j2k87k7yVX8LYd9q3SniXYVGqED6JFRdTNeyamDf4DTk9/ECxTl2nKTmKedkDodddR5RRXpAtJXv874Mi9eyw==",
+      "version": "9.23.1",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-positioning/-/react-positioning-9.23.1.tgz",
+      "integrity": "sha1-gaMHfEHlzxCXyvcNoOZMZnKhzlY=",
       "license": "MIT",
       "dependencies": {
         "@floating-ui/devtools": "^0.2.3",
         "@floating-ui/dom": "^1.6.12",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1",
         "use-sync-external-store": "^1.2.0"
@@ -3521,17 +3512,17 @@
       }
     },
     "node_modules/@fluentui/react-progress": {
-      "version": "9.5.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-progress/-/react-progress-9.5.3.tgz",
-      "integrity": "sha512-GVrZzo9QCBOyMZC/K8Q4VTbD76hgG/Xuvhr8gyqOxnuHS9lTfnPJyEZ+T+F36LmpDb6d/XmDcwKjIcyg359ieg==",
+      "version": "9.5.4",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-progress/-/react-progress-9.5.4.tgz",
+      "integrity": "sha1-lbyI7EDi9NvXrI6NOzVHEn6aIAg=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-field": "^9.5.3",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-field": "^9.5.4",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3543,17 +3534,17 @@
       }
     },
     "node_modules/@fluentui/react-provider": {
-      "version": "9.22.18",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-provider/-/react-provider-9.22.18.tgz",
-      "integrity": "sha512-kLtBaw6WIzyJJCmzeublw1ifidVPnpzGS39lYjzWdO6vHwuizs5ARCgwlGXxkB+kAlG2Mma/cPFUdYOa0J2f2w==",
+      "version": "9.22.20",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-provider/-/react-provider-9.22.20.tgz",
+      "integrity": "sha1-l3E6WXba6Tux1lwHK3FqzyGGwe8=",
       "license": "MIT",
       "dependencies": {
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/core": "^1.16.0",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
@@ -3566,18 +3557,18 @@
       }
     },
     "node_modules/@fluentui/react-radio": {
-      "version": "9.6.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-radio/-/react-radio-9.6.4.tgz",
-      "integrity": "sha512-punC09igeQT+3Fc67lteh4ibzi8kIAQyKJSh8gdYj9mA4WlAIAcdUIQ4cnqT57hRoz0zuUtZGXpP1y2Kbr8M+A==",
-      "license": "MIT",
-      "dependencies": {
-        "@fluentui/react-field": "^9.5.3",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-label": "^9.4.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+      "version": "9.6.5",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-radio/-/react-radio-9.6.5.tgz",
+      "integrity": "sha1-pFle+lP0jajijh64pW5rdGpPl4s=",
+      "license": "MIT",
+      "dependencies": {
+        "@fluentui/react-field": "^9.5.4",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-label": "^9.4.4",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3589,17 +3580,17 @@
       }
     },
     "node_modules/@fluentui/react-rating": {
-      "version": "9.4.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-rating/-/react-rating-9.4.3.tgz",
-      "integrity": "sha512-kolMzzTl9/fg54jY1iy8w54BktkKFKGLaEeiESXAbtSZiUyNIj1BADMbIG3kysbVnhkYK8Q5h0kxZPsblrL/ow==",
+      "version": "9.4.4",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-rating/-/react-rating-9.4.4.tgz",
+      "integrity": "sha1-/BB/fB+8fAgQqj3VpqPTtE8OS5c=",
       "license": "MIT",
       "dependencies": {
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3611,17 +3602,17 @@
       }
     },
     "node_modules/@fluentui/react-search": {
-      "version": "9.4.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-search/-/react-search-9.4.4.tgz",
-      "integrity": "sha512-mLDqzL00XkSfJrtIZN34tQO2eBrjlPr33HuD9m3zUUQTq5g7wvA0LomT7m3RQPCJfV6FcOcMDmVfotqDUmttzA==",
+      "version": "9.4.6",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-search/-/react-search-9.4.6.tgz",
+      "integrity": "sha1-BYiIty+NYvlX5Yd07iowO8okBJ8=",
       "license": "MIT",
       "dependencies": {
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-input": "^9.8.4",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-input": "^9.8.6",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3633,17 +3624,17 @@
       }
     },
     "node_modules/@fluentui/react-select": {
-      "version": "9.5.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-select/-/react-select-9.5.3.tgz",
-      "integrity": "sha512-Qt4ovfXQRx11ou7OaoD0O1CNawfIzTS+Q39fX+wwLwL2yfn15oWnQGGVuQD3hWh0dh7k9cmOErRIrOKeI2wmXg==",
+      "version": "9.5.5",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-select/-/react-select-9.5.5.tgz",
+      "integrity": "sha1-dqc2ytJiqWsapDJZz5OUXjDw9jM=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-field": "^9.5.3",
+        "@fluentui/react-field": "^9.5.4",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3655,12 +3646,12 @@
       }
     },
     "node_modules/@fluentui/react-shared-contexts": {
-      "version": "9.26.2",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-shared-contexts/-/react-shared-contexts-9.26.2.tgz",
-      "integrity": "sha512-upKXkwlIp5oIhELr4clAZXQkuCd4GDXM6GZEz8BOmRO+PnxyqmycCXvxDxsmi6XN+0vkGM4joiIgkB14o/FctQ==",
+      "version": "9.26.3",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-shared-contexts/-/react-shared-contexts-9.26.3.tgz",
+      "integrity": "sha1-ItU/q0BGhK2Ot8GF21EDCgzEJrU=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-theme": "^9.2.1",
+        "@fluentui/react-theme": "^9.2.2",
         "@swc/helpers": "^0.5.1"
       },
       "peerDependencies": {
@@ -3669,16 +3660,16 @@
       }
     },
     "node_modules/@fluentui/react-skeleton": {
-      "version": "9.7.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-skeleton/-/react-skeleton-9.7.4.tgz",
-      "integrity": "sha512-lIDvfFDldqOkmiwQU0ZEdnKnj/xxnNOGeuciuPz7ao+RyvDYf87Uo1RvTpMTveRCmpPC9z5rOX0EZZK+PhX7Dg==",
+      "version": "9.7.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-skeleton/-/react-skeleton-9.7.5.tgz",
+      "integrity": "sha1-T6hxis60oMxlewYVpv0uJkVmn5g=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-field": "^9.5.3",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-field": "^9.5.4",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3690,17 +3681,17 @@
       }
     },
     "node_modules/@fluentui/react-slider": {
-      "version": "9.6.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-slider/-/react-slider-9.6.4.tgz",
-      "integrity": "sha512-hPpbAe6pT00FG717A7wV6QCx4+WizhvT9AI/IbEifjKTQ9uxKhodDQNk8WqEXA1ziFoSifDHGAKbcOn/kdr4Ww==",
+      "version": "9.6.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-slider/-/react-slider-9.6.5.tgz",
+      "integrity": "sha1-ovEq66qvjjInyjhe1/SoDBiX/B4=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-field": "^9.5.3",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-field": "^9.5.4",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3712,18 +3703,18 @@
       }
     },
     "node_modules/@fluentui/react-spinbutton": {
-      "version": "9.6.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-spinbutton/-/react-spinbutton-9.6.4.tgz",
-      "integrity": "sha512-+t4B6anAWSXFJgmnNXOvC7S/ZWU23MOCDWrvRXKz3fki9fENN85HiRmlnx4fR8akYItVDscqQacRQRxAL8F0oA==",
+      "version": "9.6.5",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-spinbutton/-/react-spinbutton-9.6.5.tgz",
+      "integrity": "sha1-NKq9UOg7ZTNsz7gaRn95+qioVE8=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-field": "^9.5.3",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-field": "^9.5.4",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3735,16 +3726,16 @@
       }
     },
     "node_modules/@fluentui/react-spinner": {
-      "version": "9.8.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-spinner/-/react-spinner-9.8.4.tgz",
-      "integrity": "sha512-vgfsJosM6hMixFCR7mP856xKx0xXa5Vz4Y95t37Xne2yzJ47bTfqQ62kof7U1AyvaSEeDIp76cwKMyv3lQUD3A==",
+      "version": "9.8.5",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-spinner/-/react-spinner-9.8.5.tgz",
+      "integrity": "sha1-4rC06eDi56Xi73SQt/WT3WrhitA=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-label": "^9.4.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-label": "^9.4.4",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3756,19 +3747,19 @@
       }
     },
     "node_modules/@fluentui/react-swatch-picker": {
-      "version": "9.5.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-swatch-picker/-/react-swatch-picker-9.5.4.tgz",
-      "integrity": "sha512-UwrtK3vP2Ruo2nAI+bbu56XhtpEIwi1XvHFXpVyRWGNQI9362lMS3F4CjwDlyPR24GeF+kEgZeF7QaruTVmagQ==",
+      "version": "9.6.0",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-swatch-picker/-/react-swatch-picker-9.6.0.tgz",
+      "integrity": "sha1-WGm8y/jnxp/wxXQbnkriDHp+0gQ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-context-selector": "^9.2.18",
-        "@fluentui/react-field": "^9.5.3",
+        "@fluentui/react-context-selector": "^9.2.19",
+        "@fluentui/react-field": "^9.5.4",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3780,19 +3771,19 @@
       }
     },
     "node_modules/@fluentui/react-switch": {
-      "version": "9.7.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-switch/-/react-switch-9.7.4.tgz",
-      "integrity": "sha512-P4Xh+zrEOXO7mUmHDPo2G/yfQYwXWArrBOBKCLKOw6qI7KjuzBJxmy1Zqm94/drRr1EKVpBaZckSiT8X8N0TNQ==",
+      "version": "9.7.5",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-switch/-/react-switch-9.7.5.tgz",
+      "integrity": "sha1-HXAztEi9WVsKytinxOsiBtDqsDQ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-field": "^9.5.3",
+        "@fluentui/react-field": "^9.5.4",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-label": "^9.4.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-label": "^9.4.4",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3804,23 +3795,23 @@
       }
     },
     "node_modules/@fluentui/react-table": {
-      "version": "9.19.17",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-table/-/react-table-9.19.17.tgz",
-      "integrity": "sha512-SPhAlS6yQ/53GB/1XUzCum63ktzmNaZVWswshr6SCo7oUERxdszr6xHJ5bSvgNczlApuLzZVz6Vnxe2s7+bsCw==",
+      "version": "9.19.19",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-table/-/react-table-9.19.19.tgz",
+      "integrity": "sha1-c1d1S2a0syLlxUQ1B3cOcpz96l4=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-avatar": "^9.11.3",
-        "@fluentui/react-checkbox": "^9.6.3",
-        "@fluentui/react-context-selector": "^9.2.18",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-avatar": "^9.11.5",
+        "@fluentui/react-checkbox": "^9.6.4",
+        "@fluentui/react-context-selector": "^9.2.19",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-radio": "^9.6.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-radio": "^9.6.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3832,17 +3823,17 @@
       }
     },
     "node_modules/@fluentui/react-tabs": {
-      "version": "9.12.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-tabs/-/react-tabs-9.12.3.tgz",
-      "integrity": "sha512-CkQmrErImxvGDgrNIh+v0GbXzTKx1YSiBXYuFIhjdFaTnTk5CE79xwZp3mIkZK4SUns0HcH5wchjuO1L5LfcRg==",
+      "version": "9.12.4",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-tabs/-/react-tabs-9.12.4.tgz",
+      "integrity": "sha1-MV7mQK+HZrX9+LVzvDedj1+sF3U=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-context-selector": "^9.2.18",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-context-selector": "^9.2.19",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3854,14 +3845,14 @@
       }
     },
     "node_modules/@fluentui/react-tabster": {
-      "version": "9.26.16",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-tabster/-/react-tabster-9.26.16.tgz",
-      "integrity": "sha512-napGx7dGdLoKoUpKlzc2Til43UMUTtr9J1GWrOFvCT6aZLTox5GjtoxQM/IPhcZ09jJOOUMbVF8ScA5u3/uyTA==",
+      "version": "9.26.17",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-tabster/-/react-tabster-9.26.17.tgz",
+      "integrity": "sha1-GNsjhnPeAck7OBtI8dvLQHK/vfs=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1",
         "keyborg": "^2.14.1",
@@ -3875,25 +3866,25 @@
       }
     },
     "node_modules/@fluentui/react-tag-picker": {
-      "version": "9.10.0",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-tag-picker/-/react-tag-picker-9.10.0.tgz",
-      "integrity": "sha512-GV358puRbq4W/2nR3g0AQ43VxGHSXrocQY5szJwrneO7JJqhqp9qcMrK4b3eV5Fwo9X1V0e4grWDKbBPwlUGVw==",
+      "version": "9.10.2",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-tag-picker/-/react-tag-picker-9.10.2.tgz",
+      "integrity": "sha1-UKzPGU/3/CLSxEPDpkYgf7FjvW8=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-combobox": "^9.17.3",
-        "@fluentui/react-context-selector": "^9.2.18",
-        "@fluentui/react-field": "^9.5.3",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-combobox": "^9.17.5",
+        "@fluentui/react-context-selector": "^9.2.19",
+        "@fluentui/react-field": "^9.5.4",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-portal": "^9.8.14",
-        "@fluentui/react-positioning": "^9.22.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-tags": "^9.9.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-portal": "^9.8.15",
+        "@fluentui/react-positioning": "^9.23.1",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-tags": "^9.9.4",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3905,20 +3896,20 @@
       }
     },
     "node_modules/@fluentui/react-tags": {
-      "version": "9.9.2",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-tags/-/react-tags-9.9.2.tgz",
-      "integrity": "sha512-yJmUrx3b1m4OYoXGt1+hUgZzghoTuHGGHkXyTwmCUCKX7BKAXQBbOu0VHyxmG+VDkPhpO3773ObQCFXCdTavrw==",
+      "version": "9.9.4",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-tags/-/react-tags-9.9.4.tgz",
+      "integrity": "sha1-RMgMOd+vLzEF7z8OHhMdTjVd8lE=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-avatar": "^9.11.3",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-avatar": "^9.11.5",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3930,21 +3921,21 @@
       }
     },
     "node_modules/@fluentui/react-teaching-popover": {
-      "version": "9.7.2",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-teaching-popover/-/react-teaching-popover-9.7.2.tgz",
-      "integrity": "sha512-984lSUplfBiLTKpNSGvzPaBMmQ8pSM0u/Ucv4QoB2QB9U771pu8NtuNvtiuhQe5f6yC3wblIFHnTVrlZW66TWQ==",
+      "version": "9.7.4",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-teaching-popover/-/react-teaching-popover-9.7.4.tgz",
+      "integrity": "sha1-H0MZPYmpA8omXaIMVY8dGt1hbao=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-button": "^9.10.1",
-        "@fluentui/react-context-selector": "^9.2.18",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-button": "^9.11.0",
+        "@fluentui/react-context-selector": "^9.2.19",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-popover": "^9.14.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-popover": "^9.14.6",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1",
         "use-sync-external-store": "^1.2.0"
@@ -3957,15 +3948,15 @@
       }
     },
     "node_modules/@fluentui/react-text": {
-      "version": "9.6.18",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-text/-/react-text-9.6.18.tgz",
-      "integrity": "sha512-iED0KJPtU44M5kByfg93n/Zwwky0BhyRHaWFcIeB6jsCVAeCf8kUSS2Nr+7zQocf60DFHgMF7y4XEl0rRe+PHw==",
+      "version": "9.6.19",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-text/-/react-text-9.6.19.tgz",
+      "integrity": "sha1-p72dYo+UuhOTc/OVjqB/BywrR+A=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3977,16 +3968,16 @@
       }
     },
     "node_modules/@fluentui/react-textarea": {
-      "version": "9.7.4",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-textarea/-/react-textarea-9.7.4.tgz",
-      "integrity": "sha512-Zq2D8u2ssneLVY4OuvMWYT5Er3yAo3OKmTWmPNsJ6F9dISIc7UullDwuBoKYES943EBzSfNyKZQwCY7Bo1BGuQ==",
+      "version": "9.7.6",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-textarea/-/react-textarea-9.7.6.tgz",
+      "integrity": "sha1-6DhUWxhKO+FMYIx7ij9FWW7ykOk=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-field": "^9.5.3",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-field": "^9.5.4",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -3998,32 +3989,32 @@
       }
     },
     "node_modules/@fluentui/react-theme": {
-      "version": "9.2.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-theme/-/react-theme-9.2.1.tgz",
-      "integrity": "sha512-lJxfz7LmmglFz+c9C41qmMqaRRZZUPtPPl9DWQ79vH+JwZd4dkN7eA78OTRwcGCOTPEKoLTX72R+EFaWEDlX+w==",
+      "version": "9.2.2",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-theme/-/react-theme-9.2.2.tgz",
+      "integrity": "sha1-XJwhq80rSQc6sl9zb0HDhs/84KQ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/tokens": "1.0.0-alpha.23",
+        "@fluentui/tokens": "1.0.0-alpha.24",
         "@swc/helpers": "^0.5.1"
       }
     },
     "node_modules/@fluentui/react-toast": {
-      "version": "9.8.1",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-toast/-/react-toast-9.8.1.tgz",
-      "integrity": "sha512-J9nKVwbwmBxDNrArgJ9GHypWH43WW0XJhNWvC6ED4dGrvgc8Rnw7bKxI7swG46OTMJNCkwrOnGNEu5YGkMigfw==",
+      "version": "9.8.2",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-toast/-/react-toast-9.8.2.tgz",
+      "integrity": "sha1-JpGTmMY8tIv2etleQB80DzoqLRY=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-motion-components-preview": "^0.15.6",
-        "@fluentui/react-portal": "^9.8.14",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-motion-components-preview": "^0.15.7",
+        "@fluentui/react-portal": "^9.8.15",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -4035,20 +4026,20 @@
       }
     },
     "node_modules/@fluentui/react-toolbar": {
-      "version": "9.8.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-toolbar/-/react-toolbar-9.8.3.tgz",
-      "integrity": "sha512-/R12jBM1cllfvim9x+NxL4/5ObDdih42yHsswecVGhwK/rituz37UEWWr1MkapMCDnr/gVRVb4QEsbFXX3lpNA==",
-      "license": "MIT",
-      "dependencies": {
-        "@fluentui/react-button": "^9.10.1",
-        "@fluentui/react-context-selector": "^9.2.18",
-        "@fluentui/react-divider": "^9.7.3",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-radio": "^9.6.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+      "version": "9.8.4",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-toolbar/-/react-toolbar-9.8.4.tgz",
+      "integrity": "sha1-UMgKyrsVYWKnvtqdO63g3GjdPBw=",
+      "license": "MIT",
+      "dependencies": {
+        "@fluentui/react-button": "^9.11.0",
+        "@fluentui/react-context-selector": "^9.2.19",
+        "@fluentui/react-divider": "^9.7.4",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-radio": "^9.6.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -4060,19 +4051,19 @@
       }
     },
     "node_modules/@fluentui/react-tooltip": {
-      "version": "9.10.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-tooltip/-/react-tooltip-9.10.3.tgz",
-      "integrity": "sha512-QDc5XQyODm0BIQ5VCbM59n0pEXNCMk2a9OQ7B5eDWoqnvTxj++ul1XQb6EF0libbkjFl7zTsaaHnhIOzsVEq0w==",
-      "license": "MIT",
-      "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-portal": "^9.8.14",
-        "@fluentui/react-positioning": "^9.22.3",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+      "version": "9.10.5",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-tooltip/-/react-tooltip-9.10.5.tgz",
+      "integrity": "sha1-fqrVn3TYgcwfrLwdQ0/ApXodhG0=",
+      "license": "MIT",
+      "dependencies": {
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-portal": "^9.8.15",
+        "@fluentui/react-positioning": "^9.23.1",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -4084,26 +4075,26 @@
       }
     },
     "node_modules/@fluentui/react-tree": {
-      "version": "9.16.3",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-tree/-/react-tree-9.16.3.tgz",
-      "integrity": "sha512-Uf4ero9GhHoe8B6ZONKTIriPnd8cuyPFGXbPo+AG4t4vB5QO8qSZmwrR89btd2Xbr1zWQoMmJJFDn83S+3Te8w==",
+      "version": "9.16.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-tree/-/react-tree-9.16.5.tgz",
+      "integrity": "sha1-icPocENERiBe0sly58RiHQ+MkIQ=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-aria": "^9.17.13",
-        "@fluentui/react-avatar": "^9.11.3",
-        "@fluentui/react-button": "^9.10.1",
-        "@fluentui/react-checkbox": "^9.6.3",
-        "@fluentui/react-context-selector": "^9.2.18",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-aria": "^9.17.14",
+        "@fluentui/react-avatar": "^9.11.5",
+        "@fluentui/react-button": "^9.11.0",
+        "@fluentui/react-checkbox": "^9.6.4",
+        "@fluentui/react-context-selector": "^9.2.19",
         "@fluentui/react-icons": "^2.0.245",
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-motion": "^9.16.1",
-        "@fluentui/react-motion-components-preview": "^0.15.6",
-        "@fluentui/react-radio": "^9.6.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-tabster": "^9.26.16",
-        "@fluentui/react-theme": "^9.2.1",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-motion": "^9.16.2",
+        "@fluentui/react-motion-components-preview": "^0.15.7",
+        "@fluentui/react-radio": "^9.6.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-tabster": "^9.26.17",
+        "@fluentui/react-theme": "^9.2.2",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -4115,13 +4106,13 @@
       }
     },
     "node_modules/@fluentui/react-utilities": {
-      "version": "9.26.5",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-utilities/-/react-utilities-9.26.5.tgz",
-      "integrity": "sha512-lLWhnfMVEu+cWx3o9uTA5sDwo4U9PnpDJGVtheZ1bOCdh1YiQsJxeFM7n6nLE72UK2w+ATkGZQPYZA4QW1JLPQ==",
+      "version": "9.26.6",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-utilities/-/react-utilities-9.26.6.tgz",
+      "integrity": "sha1-jAu6VUfiyESQ7pLVjusKFJhnJEo=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/keyboard-keys": "^9.0.8",
-        "@fluentui/react-shared-contexts": "^9.26.2",
+        "@fluentui/keyboard-keys": "^9.0.9",
+        "@fluentui/react-shared-contexts": "^9.26.3",
         "@swc/helpers": "^0.5.1"
       },
       "peerDependencies": {
@@ -4130,14 +4121,14 @@
       }
     },
     "node_modules/@fluentui/react-virtualizer": {
-      "version": "9.0.0-alpha.114",
-      "resolved": "https://registry.npmjs.org/@fluentui/react-virtualizer/-/react-virtualizer-9.0.0-alpha.114.tgz",
-      "integrity": "sha512-hD44CrZh84P1Rsd+ACPdmre3j20OevkoMKxMRzMXWlSIYKbT+m5I5yM3XxxSvKb1Qr77LeBPTTJs6apvMcfRiA==",
+      "version": "9.0.0-alpha.115",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/react-virtualizer/-/react-virtualizer-9.0.0-alpha.115.tgz",
+      "integrity": "sha1-ya8FGfYCm/5jLkEdwCKOFSI04z8=",
       "license": "MIT",
       "dependencies": {
-        "@fluentui/react-jsx-runtime": "^9.4.4",
-        "@fluentui/react-shared-contexts": "^9.26.2",
-        "@fluentui/react-utilities": "^9.26.5",
+        "@fluentui/react-jsx-runtime": "^9.4.5",
+        "@fluentui/react-shared-contexts": "^9.26.3",
+        "@fluentui/react-utilities": "^9.26.6",
         "@griffel/react": "^1.5.32",
         "@swc/helpers": "^0.5.1"
       },
@@ -4149,9 +4140,9 @@
       }
     },
     "node_modules/@fluentui/tokens": {
-      "version": "1.0.0-alpha.23",
-      "resolved": "https://registry.npmjs.org/@fluentui/tokens/-/tokens-1.0.0-alpha.23.tgz",
-      "integrity": "sha512-uxrzF9Z+J10naP0pGS7zPmzSkspSS+3OJDmYIK3o1nkntQrgBXq3dBob4xSlTDm5aOQ0kw6EvB9wQgtlyy4eKQ==",
+      "version": "1.0.0-alpha.24",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@fluentui/tokens/-/tokens-1.0.0-alpha.24.tgz",
+      "integrity": "sha1-hljrx2qm8lBm0Z5Yw98+jreUWPE=",
       "license": "MIT",
       "dependencies": {
         "@swc/helpers": "^0.5.1"
@@ -4159,8 +4150,8 @@
     },
     "node_modules/@griffel/core": {
       "version": "1.21.3",
-      "resolved": "https://registry.npmjs.org/@griffel/core/-/core-1.21.3.tgz",
-      "integrity": "sha512-FMnlwhtmCRWvXEg2j/6W90wzvW+PFqdrsWFslfmxwS6l9X73gO0dnndKphht9ZOsJODvmLdqlnU1Lh8igg2mKw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@griffel/core/-/core-1.21.3.tgz",
+      "integrity": "sha1-fhN+aJYuYq2OwVVj/TBRzH4elX0=",
       "license": "MIT",
       "dependencies": {
         "@emotion/hash": "^0.9.0",
@@ -4172,9 +4163,9 @@
       }
     },
     "node_modules/@griffel/react": {
-      "version": "1.7.6",
-      "resolved": "https://registry.npmjs.org/@griffel/react/-/react-1.7.6.tgz",
-      "integrity": "sha512-hqkbKRfSN/jKvPFzMoaA+gzoA9INfDyDqt7ypHOJP3KjZWp+n5f/QxLpmvqE3ssqDDS7YsFKN6qPmYBRC2SA7w==",
+      "version": "1.7.7",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@griffel/react/-/react-1.7.7.tgz",
+      "integrity": "sha1-iQiFJzS/aqAnZ2NDAxoHkTFm/QM=",
       "license": "MIT",
       "dependencies": {
         "@griffel/core": "^1.21.3",
@@ -4186,8 +4177,8 @@
     },
     "node_modules/@griffel/style-types": {
       "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/@griffel/style-types/-/style-types-1.4.2.tgz",
-      "integrity": "sha512-MsSghfpyxR2MpTrYdcCozISsSLkmFjNw94wNPi4bDBRLW8W43718W/ZjmUdVkoM0KXMtJPYuEkx8Mzibqb03qA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@griffel/style-types/-/style-types-1.4.2.tgz",
+      "integrity": "sha1-T2aXpznqvCzteNK/9POMN+SOkRU=",
       "license": "MIT",
       "dependencies": {
         "csstype": "^3.2.3"
@@ -4195,8 +4186,8 @@
     },
     "node_modules/@humanwhocodes/config-array": {
       "version": "0.13.0",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.13.0.tgz",
-      "integrity": "sha512-DZLEEqFWQFiyK6h5YIeynKx7JlvCYWL0cImfSRXZ9l4Sg2efkFGTuFf6vzXjK1cq6IYkU+Eg/JizXw+TD2vRNw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@humanwhocodes/config-array/-/config-array-0.13.0.tgz",
+      "integrity": "sha1-+5B2JN8yVtBLmqLfUNeql+xkh0g=",
       "deprecated": "Use @eslint/config-array instead",
       "license": "Apache-2.0",
       "dependencies": {
@@ -4210,8 +4201,8 @@
     },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
+      "integrity": "sha1-r1smkaIrRL6EewyoFkHF+2rQFyw=",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=12.22"
@@ -4223,15 +4214,15 @@
     },
     "node_modules/@humanwhocodes/object-schema": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.3.tgz",
-      "integrity": "sha512-93zYdMES/c1D69yZiKDBj0V24vqNzB/koF26KPaagAfd3P/4gUlh3Dys5ogAK+Exi9QyzlD8x/08Zt7wIKcDcA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@humanwhocodes/object-schema/-/object-schema-2.0.3.tgz",
+      "integrity": "sha1-Siho111taWPkI7z5C3/RvjQ0CdM=",
       "deprecated": "Use @eslint/object-schema instead",
       "license": "BSD-3-Clause"
     },
     "node_modules/@istanbuljs/load-nyc-config": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
-      "integrity": "sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
+      "integrity": "sha1-/T2x1Z7PfPEh6AZQu4ZxL5tV7O0=",
       "license": "ISC",
       "dependencies": {
         "camelcase": "^5.3.1",
@@ -4246,30 +4237,17 @@
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/camelcase": {
       "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
-      "integrity": "sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/camelcase/-/camelcase-5.3.1.tgz",
+      "integrity": "sha1-48mzFWnhBoEd8kL3FXJaH0xJQyA=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
       }
     },
-    "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.15.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.1.tgz",
-      "integrity": "sha512-S99WuO3HlhO3XN41EtYUNl9zzXjoJx7QvmipxsJVxtCBT0YHEFy+iOJhjSvrmV12nYhWpZaM8lPHkJm0yUMbag==",
-      "license": "MIT",
-      "dependencies": {
-        "argparse": "^1.0.7",
-        "esprima": "^4.0.0"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
-      }
-    },
     "node_modules/@istanbuljs/schema": {
       "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/@istanbuljs/schema/-/schema-0.1.6.tgz",
-      "integrity": "sha512-+Sg6GCR/wy1oSmQDFq4LQDAhm3ETKnorxN+y5nbLULOR3P0c14f2Wurzj3/xqPXtasLFfHd5iRFQ7AJt4KH2cw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@istanbuljs/schema/-/schema-0.1.6.tgz",
+      "integrity": "sha1-jcmvoqwVBssaWPiZQPHBJERsjfM=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -4277,8 +4255,8 @@
     },
     "node_modules/@jest/console": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/console/-/console-27.5.1.tgz",
-      "integrity": "sha512-kZ/tNpS3NXn0mlXXXPNuDZnb4c0oZ20r4K5eemM2k30ZC3G0T02nXUvyhf5YdbXWHPEJLc9qGLxEZ216MdL+Zg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/console/-/console-27.5.1.tgz",
+      "integrity": "sha1-Jg/nI5YC/lEwqU8ao4bv9UsBS7o=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -4294,8 +4272,8 @@
     },
     "node_modules/@jest/core": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/core/-/core-27.5.1.tgz",
-      "integrity": "sha512-AK6/UTrvQD0Cd24NSqmIA6rKsu0tKIxfiCducZvqxYdmMisOYAsdItspT+fQDQYARPf8XgjAFZi0ogW2agH5nQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/core/-/core-27.5.1.tgz",
+      "integrity": "sha1-JnrF9wTgncUt4pIsvzr57c1ktiY=",
       "license": "MIT",
       "dependencies": {
         "@jest/console": "^27.5.1",
@@ -4341,8 +4319,8 @@
     },
     "node_modules/@jest/environment": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-27.5.1.tgz",
-      "integrity": "sha512-/WQjhPJe3/ghaol/4Bq480JKXV/Rfw8nQdN7f41fM8VDHLcxKXou6QyXAh3EFr9/bVG3x74z1NWDkP87EiY8gA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/environment/-/environment-27.5.1.tgz",
+      "integrity": "sha1-10JYIFEf5xWKu+zAEBQMP9O+nHQ=",
       "license": "MIT",
       "dependencies": {
         "@jest/fake-timers": "^27.5.1",
@@ -4356,8 +4334,8 @@
     },
     "node_modules/@jest/fake-timers": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-27.5.1.tgz",
-      "integrity": "sha512-/aPowoolwa07k7/oM3aASneNeBGCmGQsc3ugN4u6s4C/+s5M64MFo/+djTdiwcbQlRfFElGuDXWzaWj6QgKObQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/fake-timers/-/fake-timers-27.5.1.tgz",
+      "integrity": "sha1-dpeXRc4FecipSkZ4r3p0jtqK2nQ=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -4373,8 +4351,8 @@
     },
     "node_modules/@jest/globals": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-27.5.1.tgz",
-      "integrity": "sha512-ZEJNB41OBQQgGzgyInAv0UUfDDj3upmHydjieSxFvTRuZElrx7tXg/uVQ5hYVEwiXs3+aMsAeEc9X7xiSKCm4Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/globals/-/globals-27.5.1.tgz",
+      "integrity": "sha1-esBs5Xq5ZlZseWNDHO9FhDRgGys=",
       "license": "MIT",
       "dependencies": {
         "@jest/environment": "^27.5.1",
@@ -4387,8 +4365,8 @@
     },
     "node_modules/@jest/reporters": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-27.5.1.tgz",
-      "integrity": "sha512-cPXh9hWIlVJMQkVk84aIvXuBB4uQQmFqZiacloFuGiP3ah1sbCxCosidXFDfqG8+6fO1oR2dTJTlsOy4VFmUfw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/reporters/-/reporters-27.5.1.tgz",
+      "integrity": "sha1-ztp76WFwsDySPDeYe2QBWBL/7AQ=",
       "license": "MIT",
       "dependencies": {
         "@bcoe/v8-coverage": "^0.2.3",
@@ -4431,8 +4409,8 @@
     },
     "node_modules/@jest/reporters/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -4440,8 +4418,8 @@
     },
     "node_modules/@jest/schemas": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-28.1.3.tgz",
-      "integrity": "sha512-/l/VWsdt/aBXgjshLWOFyFt3IVdYypu5y2Wn2rOO1un6nkqIn8SLXzgIMYXFyYsRWDyF5EthmKJMIdJvk08grg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/schemas/-/schemas-28.1.3.tgz",
+      "integrity": "sha1-rYuGpm8R8zYZ49fh3N3X8tQP+QU=",
       "license": "MIT",
       "dependencies": {
         "@sinclair/typebox": "^0.24.1"
@@ -4452,8 +4430,8 @@
     },
     "node_modules/@jest/source-map": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-27.5.1.tgz",
-      "integrity": "sha512-y9NIHUYF3PJRlHk98NdC/N1gl88BL08aQQgu4k4ZopQkCw9t9cV8mtl3TV8b/YCB8XaVTFrmUTAJvjsntDireg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/source-map/-/source-map-27.5.1.tgz",
+      "integrity": "sha1-Zgg5HkZa3UIF6uBztV5/J54E6M8=",
       "license": "MIT",
       "dependencies": {
         "callsites": "^3.0.0",
@@ -4466,8 +4444,8 @@
     },
     "node_modules/@jest/source-map/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -4475,8 +4453,8 @@
     },
     "node_modules/@jest/test-result": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-27.5.1.tgz",
-      "integrity": "sha512-EW35l2RYFUcUQxFJz5Cv5MTOxlJIQs4I7gxzi2zVU7PJhOwfYq1MdC5nhSmYjX1gmMmLPvB3sIaC+BkcHRBfag==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/test-result/-/test-result-27.5.1.tgz",
+      "integrity": "sha1-VqZYX6gPfNq3K4xfwuhx0Dgy9bs=",
       "license": "MIT",
       "dependencies": {
         "@jest/console": "^27.5.1",
@@ -4490,8 +4468,8 @@
     },
     "node_modules/@jest/test-sequencer": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-27.5.1.tgz",
-      "integrity": "sha512-LCheJF7WB2+9JuCS7VB/EmGIdQuhtqjRNI9A43idHv3E4KltCTsPsLxvdaubFHSYwY/fNjMWjl6vNRhDiN7vpQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/test-sequencer/-/test-sequencer-27.5.1.tgz",
+      "integrity": "sha1-QFfg6c6kQ55UTGNTxq/+WNCVdFs=",
       "license": "MIT",
       "dependencies": {
         "@jest/test-result": "^27.5.1",
@@ -4505,8 +4483,8 @@
     },
     "node_modules/@jest/transform": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-27.5.1.tgz",
-      "integrity": "sha512-ipON6WtYgl/1329g5AIJVbUuEh0wZVbdpGwC99Jw4LwuoBNS95MVphU6zOeD9pDkon+LLbFL7lOQRapbB8SCHw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/transform/-/transform-27.5.1.tgz",
+      "integrity": "sha1-bDUB3MAMTAiRXykqYA7OXs/h9Ak=",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.1.0",
@@ -4531,14 +4509,14 @@
     },
     "node_modules/@jest/transform/node_modules/convert-source-map": {
       "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
-      "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/convert-source-map/-/convert-source-map-1.9.0.tgz",
+      "integrity": "sha1-f6rmI1P7QhM2bQypg1jSLoNosF8=",
       "license": "MIT"
     },
     "node_modules/@jest/transform/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -4546,8 +4524,8 @@
     },
     "node_modules/@jest/types": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-27.5.1.tgz",
-      "integrity": "sha512-Cx46iJ9QpwQTjIdq5VJu2QTMMs3QlEjI0x1QbBP5W1+nMzyc2XmimiRR/CbX9TO0cPTeUlxWMOu8mslYsJ8DEw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/types/-/types-27.5.1.tgz",
+      "integrity": "sha1-PHnsSoumHBcL+Te8+emKnfF17IA=",
       "license": "MIT",
       "dependencies": {
         "@types/istanbul-lib-coverage": "^2.0.0",
@@ -4562,8 +4540,8 @@
     },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha1-Y0Khn0Q0dRjJPkOxrGnes8Rlah8=",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.5.0",
@@ -4572,8 +4550,8 @@
     },
     "node_modules/@jridgewell/remapping": {
       "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha1-N1xHbRlylHhRuh4Vro8SMEdEWqE=",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/gen-mapping": "^0.3.5",
@@ -4582,8 +4560,8 @@
     },
     "node_modules/@jridgewell/resolve-uri": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha1-eg7mAfYPmaIMfHxf8MgDiMEYm9Y=",
       "license": "MIT",
       "engines": {
         "node": ">=6.0.0"
@@ -4591,8 +4569,8 @@
     },
     "node_modules/@jridgewell/source-map": {
       "version": "0.3.11",
-      "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.11.tgz",
-      "integrity": "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jridgewell/source-map/-/source-map-0.3.11.tgz",
+      "integrity": "sha1-shg1y9Nttla4V8KtAuvUE8wTqbo=",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/gen-mapping": "^0.3.5",
@@ -4601,14 +4579,14 @@
     },
     "node_modules/@jridgewell/sourcemap-codec": {
       "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha1-aRKwDSxjHA0Vzhp6tXzWV/Ko+Lo=",
       "license": "MIT"
     },
     "node_modules/@jridgewell/trace-mapping": {
       "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha1-2xXWeByTHzolGj2sOVAcmKYIL9A=",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/resolve-uri": "^3.1.0",
@@ -4617,20 +4595,20 @@
     },
     "node_modules/@kurkle/color": {
       "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/@kurkle/color/-/color-0.3.4.tgz",
-      "integrity": "sha512-M5UknZPHRu3DEDWoipU6sE8PdkZ6Z/S+v4dD+Ke8IaNlpdSQah50lz1KtcFBa2vsdOnwbbnxJwVM4wty6udA5w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@kurkle/color/-/color-0.3.4.tgz",
+      "integrity": "sha1-TU/2d+FgkhT8ccWAEl3d3Yaryr8=",
       "license": "MIT"
     },
     "node_modules/@leichtgewicht/ip-codec": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@leichtgewicht/ip-codec/-/ip-codec-2.0.5.tgz",
-      "integrity": "sha512-Vo+PSpZG2/fmgmiNzYK9qWRh8h/CHrwD0mo1h1DzL4yzHNSfWYujGTYsWGreD000gcgmZ7K4Ys6Tx9TxtsKdDw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@leichtgewicht/ip-codec/-/ip-codec-2.0.5.tgz",
+      "integrity": "sha1-T8VsFcWAua233DwzOhNOVAtEv7E=",
       "license": "MIT"
     },
     "node_modules/@nicolo-ribaudo/eslint-scope-5-internals": {
       "version": "5.1.1-v1",
-      "resolved": "https://registry.npmjs.org/@nicolo-ribaudo/eslint-scope-5-internals/-/eslint-scope-5-internals-5.1.1-v1.tgz",
-      "integrity": "sha512-54/JRvkLIzzDWshCWfuhadfrfZVPiElY8Fcgmg1HroEly/EDSszzhBAsarCux+D/kOslTRquNzuyGSmUSTTHGg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@nicolo-ribaudo/eslint-scope-5-internals/-/eslint-scope-5-internals-5.1.1-v1.tgz",
+      "integrity": "sha1-2/czqWXKR7GXMXfcC7bIie3PsSk=",
       "license": "MIT",
       "dependencies": {
         "eslint-scope": "5.1.1"
@@ -4638,8 +4616,8 @@
     },
     "node_modules/@nicolo-ribaudo/eslint-scope-5-internals/node_modules/eslint-scope": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
-      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-scope/-/eslint-scope-5.1.1.tgz",
+      "integrity": "sha1-54blmmbLkrP2wfsNUIqrF0hI9Iw=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "esrecurse": "^4.3.0",
@@ -4651,8 +4629,8 @@
     },
     "node_modules/@nicolo-ribaudo/eslint-scope-5-internals/node_modules/estraverse": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/estraverse/-/estraverse-4.3.0.tgz",
+      "integrity": "sha1-OYrT88WiSUi+dyXoPRGn3ijNvR0=",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=4.0"
@@ -4660,8 +4638,8 @@
     },
     "node_modules/@nodelib/fs.scandir": {
       "version": "2.1.5",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
-      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha1-dhnC6yGyVIP20WdUi0z9WnSIw9U=",
       "license": "MIT",
       "dependencies": {
         "@nodelib/fs.stat": "2.0.5",
@@ -4673,8 +4651,8 @@
     },
     "node_modules/@nodelib/fs.stat": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
-      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha1-W9Jir5Tp0lvR5xsF3u1Eh2oiLos=",
       "license": "MIT",
       "engines": {
         "node": ">= 8"
@@ -4682,8 +4660,8 @@
     },
     "node_modules/@nodelib/fs.walk": {
       "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
-      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha1-6Vc36LtnRt3t9pxVaVNJTxlv5po=",
       "license": "MIT",
       "dependencies": {
         "@nodelib/fs.scandir": "2.1.5",
@@ -4695,8 +4673,8 @@
     },
     "node_modules/@pmmmwh/react-refresh-webpack-plugin": {
       "version": "0.5.17",
-      "resolved": "https://registry.npmjs.org/@pmmmwh/react-refresh-webpack-plugin/-/react-refresh-webpack-plugin-0.5.17.tgz",
-      "integrity": "sha512-tXDyE1/jzFsHXjhRZQ3hMl0IVhYe5qula43LDWIhVfjp9G/nT5OQY5AORVOrkEGAUltBJOfOWeETbmhm6kHhuQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@pmmmwh/react-refresh-webpack-plugin/-/react-refresh-webpack-plugin-0.5.17.tgz",
+      "integrity": "sha1-jC80yoZR33SJVCIEbhHOWhIOeTA=",
       "license": "MIT",
       "dependencies": {
         "ansi-html": "^0.0.9",
@@ -4743,8 +4721,8 @@
     },
     "node_modules/@rollup/plugin-babel": {
       "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-babel/-/plugin-babel-5.3.1.tgz",
-      "integrity": "sha512-WFfdLWU/xVWKeRQnKmIAQULUI7Il0gZnBIH/ZFO069wYIfPu+8zrfp/KMW0atmELoRDq8FbiP3VCss9MhCut7Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rollup/plugin-babel/-/plugin-babel-5.3.1.tgz",
+      "integrity": "sha1-BLwGCPSqSy5LGuvyhDRND2j9ooM=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-module-imports": "^7.10.4",
@@ -4766,8 +4744,8 @@
     },
     "node_modules/@rollup/plugin-node-resolve": {
       "version": "11.2.1",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-11.2.1.tgz",
-      "integrity": "sha512-yc2n43jcqVyGE2sqV5/YCmocy9ArjVAP/BeXyTtADTBBX6V0e5UMqwO8CdQ0kzjb6zu5P1qMzsScCMRvE9OlVg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rollup/plugin-node-resolve/-/plugin-node-resolve-11.2.1.tgz",
+      "integrity": "sha1-gqpZOXopzU4TJIsQbmpKGIA2KmA=",
       "license": "MIT",
       "dependencies": {
         "@rollup/pluginutils": "^3.1.0",
@@ -4786,8 +4764,8 @@
     },
     "node_modules/@rollup/plugin-replace": {
       "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-replace/-/plugin-replace-2.4.2.tgz",
-      "integrity": "sha512-IGcu+cydlUMZ5En85jxHH4qj2hta/11BHq95iHEyb2sbgiN0eCdzvUcHw5gt9pBL5lTi4JDYJ1acCoMGpTvEZg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rollup/plugin-replace/-/plugin-replace-2.4.2.tgz",
+      "integrity": "sha1-otU5MU+8d8JEhY+qUjASglBoUQo=",
       "license": "MIT",
       "dependencies": {
         "@rollup/pluginutils": "^3.1.0",
@@ -4799,8 +4777,8 @@
     },
     "node_modules/@rollup/pluginutils": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-3.1.0.tgz",
-      "integrity": "sha512-GksZ6pr6TpIjHm8h9lSQ8pi8BE9VeubNT0OMJ3B5uZJ8pz73NPiqOtCog/x2/QzM1ENChPKxMDhiQuRHsqc+lg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rollup/pluginutils/-/pluginutils-3.1.0.tgz",
+      "integrity": "sha1-cGtFJO5tyLEDs8mVUz5a1oDAK5s=",
       "license": "MIT",
       "dependencies": {
         "@types/estree": "0.0.39",
@@ -4816,32 +4794,32 @@
     },
     "node_modules/@rollup/pluginutils/node_modules/@types/estree": {
       "version": "0.0.39",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-0.0.39.tgz",
-      "integrity": "sha512-EYNwp3bU+98cpU4lAWYYL7Zz+2gryWH1qbdDTidVd6hkiR6weksdbMadyXKXNPEkQFhXM+hVO9ZygomHXp+AIw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/estree/-/estree-0.0.39.tgz",
+      "integrity": "sha1-4Xfmme4bjCLSMXTKqnQiZEOJUJ8=",
       "license": "MIT"
     },
     "node_modules/@rtsao/scc": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@rtsao/scc/-/scc-1.1.0.tgz",
-      "integrity": "sha512-zt6OdqaDoOnJ1ZYsCYGt9YmWzDXl4vQdKTyJev62gFhRGKdx7mcT54V9KIjg+d2wi9EXsPvAPKe7i7WjfVWB8g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rtsao/scc/-/scc-1.1.0.tgz",
+      "integrity": "sha1-kn3S+um8M2FAOsLHoAwy3c6a1+g=",
       "license": "MIT"
     },
     "node_modules/@rushstack/eslint-patch": {
       "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/@rushstack/eslint-patch/-/eslint-patch-1.16.1.tgz",
-      "integrity": "sha512-TvZbIpeKqGQQ7X0zSCvPH9riMSFQFSggnfBjFZ1mEoILW+UuXCKwOoPcgjMwiUtRqFZ8jWhPJc4um14vC6I4ag==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@rushstack/eslint-patch/-/eslint-patch-1.16.1.tgz",
+      "integrity": "sha1-T5dYHhFPx58kbO43I6XE7dO2JBU=",
       "license": "MIT"
     },
     "node_modules/@sinclair/typebox": {
       "version": "0.24.52",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.24.52.tgz",
-      "integrity": "sha512-DNKwjDaMLKWXvjs/zCkSzA3rBzZVv4tuLCEV8ArRyHAqCtPtbUcQj0XS4h7y/CqL9pI6VpCmcH5A6oPOBAD9+Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@sinclair/typebox/-/typebox-0.24.52.tgz",
+      "integrity": "sha1-eDkKIT5bQvtXDxpZ6S+WoC370RQ=",
       "license": "MIT"
     },
     "node_modules/@sinonjs/commons": {
       "version": "1.8.6",
-      "resolved": "https://registry.npmjs.org/@sinonjs/commons/-/commons-1.8.6.tgz",
-      "integrity": "sha512-Ky+XkAkqPZSm3NLBeUng77EBQl3cmeJhITaGHdYH8kjVB+aun3S4XBRti2zt17mtt0mIUDiNxYeoJm6drVvBJQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@sinonjs/commons/-/commons-1.8.6.tgz",
+      "integrity": "sha1-gMUWpNwmTCppEV51eNYlgf9FXtk=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "type-detect": "4.0.8"
@@ -4849,8 +4827,8 @@
     },
     "node_modules/@sinonjs/fake-timers": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-8.1.0.tgz",
-      "integrity": "sha512-OAPJUAtgeINhh/TAlUID4QTs53Njm7xzddaVlEs/SXwgtiD1tW22zAB/W1wdqfrpmikgaWQ9Fw6Ws+hsiRm5Vg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@sinonjs/fake-timers/-/fake-timers-8.1.0.tgz",
+      "integrity": "sha1-P9wrbLWJNbIb+40WJesTAEhDFuc=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@sinonjs/commons": "^1.7.0"
@@ -4858,8 +4836,8 @@
     },
     "node_modules/@surma/rollup-plugin-off-main-thread": {
       "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/@surma/rollup-plugin-off-main-thread/-/rollup-plugin-off-main-thread-2.2.3.tgz",
-      "integrity": "sha512-lR8q/9W7hZpMWweNiAKU7NQerBnzQQLvi8qnTDU/fxItPhtZVMbPV3lbCwjhIlNBe9Bbr5V+KHshvWmVSG9cxQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@surma/rollup-plugin-off-main-thread/-/rollup-plugin-off-main-thread-2.2.3.tgz",
+      "integrity": "sha1-7jSYWVLKIVWKsNlS8AKYrSGQwFM=",
       "license": "Apache-2.0",
       "dependencies": {
         "ejs": "^3.1.6",
@@ -4870,8 +4848,8 @@
     },
     "node_modules/@svgr/babel-plugin-add-jsx-attribute": {
       "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-add-jsx-attribute/-/babel-plugin-add-jsx-attribute-5.4.0.tgz",
-      "integrity": "sha512-ZFf2gs/8/6B8PnSofI0inYXr2SDNTDScPXhN7k5EqD4aZ3gi6u+rbmZHVB8IM3wDyx8ntKACZbtXSm7oZGRqVg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/babel-plugin-add-jsx-attribute/-/babel-plugin-add-jsx-attribute-5.4.0.tgz",
+      "integrity": "sha1-ge9hlHuyaOudUFI0RvnGOPs1WQY=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -4883,8 +4861,8 @@
     },
     "node_modules/@svgr/babel-plugin-remove-jsx-attribute": {
       "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-remove-jsx-attribute/-/babel-plugin-remove-jsx-attribute-5.4.0.tgz",
-      "integrity": "sha512-yaS4o2PgUtwLFGTKbsiAy6D0o3ugcUhWK0Z45umJ66EPWunAz9fuFw2gJuje6wqQvQWOTJvIahUwndOXb7QCPg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/babel-plugin-remove-jsx-attribute/-/babel-plugin-remove-jsx-attribute-5.4.0.tgz",
+      "integrity": "sha1-ayx3DJXIdGVP1eHV70dbeKCpYu8=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -4896,8 +4874,8 @@
     },
     "node_modules/@svgr/babel-plugin-remove-jsx-empty-expression": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-remove-jsx-empty-expression/-/babel-plugin-remove-jsx-empty-expression-5.0.1.tgz",
-      "integrity": "sha512-LA72+88A11ND/yFIMzyuLRSMJ+tRKeYKeQ+mR3DcAZ5I4h5CPWN9AHyUzJbWSYp/u2u0xhmgOe0+E41+GjEueA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/babel-plugin-remove-jsx-empty-expression/-/babel-plugin-remove-jsx-empty-expression-5.0.1.tgz",
+      "integrity": "sha1-JWIaiRXtetcNps6j0KbbwuqTPv0=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -4909,8 +4887,8 @@
     },
     "node_modules/@svgr/babel-plugin-replace-jsx-attribute-value": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-replace-jsx-attribute-value/-/babel-plugin-replace-jsx-attribute-value-5.0.1.tgz",
-      "integrity": "sha512-PoiE6ZD2Eiy5mK+fjHqwGOS+IXX0wq/YDtNyIgOrc6ejFnxN4b13pRpiIPbtPwHEc+NT2KCjteAcq33/F1Y9KQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/babel-plugin-replace-jsx-attribute-value/-/babel-plugin-replace-jsx-attribute-value-5.0.1.tgz",
+      "integrity": "sha1-CyIfxX+fzRDpH+IZ4s0N0DFFqJc=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -4922,8 +4900,8 @@
     },
     "node_modules/@svgr/babel-plugin-svg-dynamic-title": {
       "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-svg-dynamic-title/-/babel-plugin-svg-dynamic-title-5.4.0.tgz",
-      "integrity": "sha512-zSOZH8PdZOpuG1ZVx/cLVePB2ibo3WPpqo7gFIjLV9a0QsuQAzJiwwqmuEdTaW2pegyBE17Uu15mOgOcgabQZg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/babel-plugin-svg-dynamic-title/-/babel-plugin-svg-dynamic-title-5.4.0.tgz",
+      "integrity": "sha1-E5tUbdDDGGtuXbT+/CbLC66nKdc=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -4935,8 +4913,8 @@
     },
     "node_modules/@svgr/babel-plugin-svg-em-dimensions": {
       "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-svg-em-dimensions/-/babel-plugin-svg-em-dimensions-5.4.0.tgz",
-      "integrity": "sha512-cPzDbDA5oT/sPXDCUYoVXEmm3VIoAWAPT6mSPTJNbQaBNUuEKVKyGH93oDY4e42PYHRW67N5alJx/eEol20abw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/babel-plugin-svg-em-dimensions/-/babel-plugin-svg-em-dimensions-5.4.0.tgz",
+      "integrity": "sha1-ZUP2lSZjKhM85cq6uWXe6uoiNKA=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -4948,8 +4926,8 @@
     },
     "node_modules/@svgr/babel-plugin-transform-react-native-svg": {
       "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-transform-react-native-svg/-/babel-plugin-transform-react-native-svg-5.4.0.tgz",
-      "integrity": "sha512-3eYP/SaopZ41GHwXma7Rmxcv9uRslRDTY1estspeB1w1ueZWd/tPlMfEOoccYpEMZU3jD4OU7YitnXcF5hLW2Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/babel-plugin-transform-react-native-svg/-/babel-plugin-transform-react-native-svg-5.4.0.tgz",
+      "integrity": "sha1-AL+aenPxytOUjNqx+N+3dHUPjIA=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -4961,8 +4939,8 @@
     },
     "node_modules/@svgr/babel-plugin-transform-svg-component": {
       "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/@svgr/babel-plugin-transform-svg-component/-/babel-plugin-transform-svg-component-5.5.0.tgz",
-      "integrity": "sha512-q4jSH1UUvbrsOtlo/tKcgSeiCHRSBdXoIoqX1pgcKK/aU3JD27wmMKwGtpB8qRYUYoyXvfGxUVKchLuR5pB3rQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/babel-plugin-transform-svg-component/-/babel-plugin-transform-svg-component-5.5.0.tgz",
+      "integrity": "sha1-WDpeKhk+IU2i86/rC56NMlASa0o=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -4974,8 +4952,8 @@
     },
     "node_modules/@svgr/babel-preset": {
       "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/@svgr/babel-preset/-/babel-preset-5.5.0.tgz",
-      "integrity": "sha512-4FiXBjvQ+z2j7yASeGPEi8VD/5rrGQk4Xrq3EdJmoZgz/tpqChpo5hgXDvmEauwtvOc52q8ghhZK4Oy7qph4ig==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/babel-preset/-/babel-preset-5.5.0.tgz",
+      "integrity": "sha1-ivVPPgqK3XseKw/NWogsVTk98yc=",
       "license": "MIT",
       "dependencies": {
         "@svgr/babel-plugin-add-jsx-attribute": "^5.4.0",
@@ -4997,8 +4975,8 @@
     },
     "node_modules/@svgr/core": {
       "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/@svgr/core/-/core-5.5.0.tgz",
-      "integrity": "sha512-q52VOcsJPvV3jO1wkPtzTuKlvX7Y3xIcWRpCMtBF3MrteZJtBfQw/+u0B1BHy5ColpQc1/YVTrPEtSYIMNZlrQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/core/-/core-5.5.0.tgz",
+      "integrity": "sha1-gugmuHFdcQgxIP6PJJLsfXh0pXk=",
       "license": "MIT",
       "dependencies": {
         "@svgr/plugin-jsx": "^5.5.0",
@@ -5015,8 +4993,8 @@
     },
     "node_modules/@svgr/hast-util-to-babel-ast": {
       "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/@svgr/hast-util-to-babel-ast/-/hast-util-to-babel-ast-5.5.0.tgz",
-      "integrity": "sha512-cAaR/CAiZRB8GP32N+1jocovUtvlj0+e65TB50/6Lcime+EA49m/8l+P2ko+XPJ4dw3xaPS3jOL4F2X4KWxoeQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/hast-util-to-babel-ast/-/hast-util-to-babel-ast-5.5.0.tgz",
+      "integrity": "sha1-XuUqnCUz9z5j+PIrd5+TzUMqVGE=",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.12.6"
@@ -5031,8 +5009,8 @@
     },
     "node_modules/@svgr/plugin-jsx": {
       "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/@svgr/plugin-jsx/-/plugin-jsx-5.5.0.tgz",
-      "integrity": "sha512-V/wVh33j12hGh05IDg8GpIUXbjAPnTdPTKuP4VNLggnwaHMPNQNae2pRnyTAILWCQdz5GyMqtO488g7CKM8CBA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/plugin-jsx/-/plugin-jsx-5.5.0.tgz",
+      "integrity": "sha1-GqjNeYodtxc6wENGbXtSI2s2kAA=",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.12.3",
@@ -5050,8 +5028,8 @@
     },
     "node_modules/@svgr/plugin-svgo": {
       "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/@svgr/plugin-svgo/-/plugin-svgo-5.5.0.tgz",
-      "integrity": "sha512-r5swKk46GuQl4RrVejVwpeeJaydoxkdwkM1mBKOgJLBUJPGaLci6ylg/IjhrRsREKDkr4kbMWdgOtbXEh0fyLQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/plugin-svgo/-/plugin-svgo-5.5.0.tgz",
+      "integrity": "sha1-AtpV2FMgVJMk4gHHsuU79DH8wkY=",
       "license": "MIT",
       "dependencies": {
         "cosmiconfig": "^7.0.0",
@@ -5068,8 +5046,8 @@
     },
     "node_modules/@svgr/webpack": {
       "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/@svgr/webpack/-/webpack-5.5.0.tgz",
-      "integrity": "sha512-DOBOK255wfQxguUta2INKkzPj6AIS6iafZYiYmHn6W3pHlycSRRlvWKCfLDG10fXfLWqE3DJHgRUOyJYmARa7g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@svgr/webpack/-/webpack-5.5.0.tgz",
+      "integrity": "sha1-quhY7lefX6jObDFm71bGobOBtkA=",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.12.3",
@@ -5091,8 +5069,8 @@
     },
     "node_modules/@swc/helpers": {
       "version": "0.5.23",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
-      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha1-GSh9DYbZYrERN2A5pQx5KQLJqGo=",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.8.0"
@@ -5100,8 +5078,8 @@
     },
     "node_modules/@tootallnate/once": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-2.0.1.tgz",
-      "integrity": "sha512-HqmEUIGRJ5fSXchkVgR5F7qn48bDBzv0kWj/Kfu5e6uci4UlEeng4331LnBkWffb++Ei3FOVLxo8JJWMFBDMeQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@tootallnate/once/-/once-2.0.1.tgz",
+      "integrity": "sha1-Na3GIi42YvoiIs4SO5YUdqdGueo=",
       "license": "MIT",
       "engines": {
         "node": ">= 10"
@@ -5109,8 +5087,8 @@
     },
     "node_modules/@types/babel__core": {
       "version": "7.20.5",
-      "resolved": "https://registry.npmjs.org/@types/babel__core/-/babel__core-7.20.5.tgz",
-      "integrity": "sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/babel__core/-/babel__core-7.20.5.tgz",
+      "integrity": "sha1-PfFfJ7qFMZyqB7oI0HIYibs5wBc=",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.20.7",
@@ -5122,8 +5100,8 @@
     },
     "node_modules/@types/babel__generator": {
       "version": "7.27.0",
-      "resolved": "https://registry.npmjs.org/@types/babel__generator/-/babel__generator-7.27.0.tgz",
-      "integrity": "sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/babel__generator/-/babel__generator-7.27.0.tgz",
+      "integrity": "sha1-tYGSlMUReZV6+uw0FEL5NB5BCKk=",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.0.0"
@@ -5131,8 +5109,8 @@
     },
     "node_modules/@types/babel__template": {
       "version": "7.4.4",
-      "resolved": "https://registry.npmjs.org/@types/babel__template/-/babel__template-7.4.4.tgz",
-      "integrity": "sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/babel__template/-/babel__template-7.4.4.tgz",
+      "integrity": "sha1-VnJRNwHBshmbxtrWNqnXSRWGdm8=",
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.1.0",
@@ -5141,8 +5119,8 @@
     },
     "node_modules/@types/babel__traverse": {
       "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.28.0.tgz",
-      "integrity": "sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/babel__traverse/-/babel__traverse-7.28.0.tgz",
+      "integrity": "sha1-B9cT1szg0mXJhJ2wy+YtP2Hzb3Q=",
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.28.2"
@@ -5150,8 +5128,8 @@
     },
     "node_modules/@types/body-parser": {
       "version": "1.19.6",
-      "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
-      "integrity": "sha512-HLFeCYgz89uk22N5Qg3dvGvsv46B8GLvKKo1zKG4NybA8U2DiEO3w9lqGg29t/tfLRJpJ6iQxnVw4OnB7MoM9g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/body-parser/-/body-parser-1.19.6.tgz",
+      "integrity": "sha1-GFm+u4/X2smRikXVTBlxq4ta9HQ=",
       "license": "MIT",
       "dependencies": {
         "@types/connect": "*",
@@ -5160,8 +5138,8 @@
     },
     "node_modules/@types/bonjour": {
       "version": "3.5.13",
-      "resolved": "https://registry.npmjs.org/@types/bonjour/-/bonjour-3.5.13.tgz",
-      "integrity": "sha512-z9fJ5Im06zvUL548KvYNecEVlA7cVDkGUi6kZusb04mpyEFKCIZJvloCcmpmLaIahDpOQGHaHmG6imtPMmPXGQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/bonjour/-/bonjour-3.5.13.tgz",
+      "integrity": "sha1-rfkM4aEF6B3R+cYf3Fr9ob+5KVY=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -5169,8 +5147,8 @@
     },
     "node_modules/@types/connect": {
       "version": "3.4.38",
-      "resolved": "https://registry.npmjs.org/@types/connect/-/connect-3.4.38.tgz",
-      "integrity": "sha512-K6uROf1LD88uDQqJCktA4yzL1YYAK6NgfsI0v/mTgyPKWsX1CnJ0XPSDhViejru1GcRkLWb8RlzFYJRqGUbaug==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/connect/-/connect-3.4.38.tgz",
+      "integrity": "sha1-W6fzvE+73q/43e2VLl/yzFP42Fg=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -5178,8 +5156,8 @@
     },
     "node_modules/@types/connect-history-api-fallback": {
       "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@types/connect-history-api-fallback/-/connect-history-api-fallback-1.5.4.tgz",
-      "integrity": "sha512-n6Cr2xS1h4uAulPRdlw6Jl6s1oG8KrVilPN2yUITEs+K48EzMJJ3W1xy8K5eWuFvjp3R74AOIGSmp2UfBJ8HFw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/connect-history-api-fallback/-/connect-history-api-fallback-1.5.4.tgz",
+      "integrity": "sha1-fecWRaEDBWtIrDzgezUguBnB1bM=",
       "license": "MIT",
       "dependencies": {
         "@types/express-serve-static-core": "*",
@@ -5188,8 +5166,8 @@
     },
     "node_modules/@types/d3": {
       "version": "7.4.3",
-      "resolved": "https://registry.npmjs.org/@types/d3/-/d3-7.4.3.tgz",
-      "integrity": "sha512-lZXZ9ckh5R8uiFVt8ogUNf+pIrK4EsWrx2Np75WvF/eTpJ0FMHNhjXk8CKEx/+gpHbNQyJWehbFaTvqmHWB3ww==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3/-/d3-7.4.3.tgz",
+      "integrity": "sha1-1FUKhdCPSXj68KTDa4SMYeqsB+I=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-array": "*",
@@ -5226,14 +5204,14 @@
     },
     "node_modules/@types/d3-array": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-array/-/d3-array-3.2.2.tgz",
-      "integrity": "sha512-hOLWVbm7uRza0BYXpIIW5pxfrKe0W+D5lrFiAEYR+pb6w3N2SwSMaJbXdUfSEv+dT4MfHBLtn5js0LAWaO6otw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-array/-/d3-array-3.2.2.tgz",
+      "integrity": "sha1-4CFRRk0C1KG0RkbQ/NuT+viP3ow=",
       "license": "MIT"
     },
     "node_modules/@types/d3-axis": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-axis/-/d3-axis-3.0.6.tgz",
-      "integrity": "sha512-pYeijfZuBd87T0hGn0FO1vQ/cgLk6E1ALJjfkC0oJ8cbwkZl3TpgS8bVBLZN+2jjGgg38epgxb2zmoGtSfvgMw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-axis/-/d3-axis-3.0.6.tgz",
+      "integrity": "sha1-52DldluBiLHe+jK8i7YGL4Hkx5U=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-selection": "*"
@@ -5241,8 +5219,8 @@
     },
     "node_modules/@types/d3-brush": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-brush/-/d3-brush-3.0.6.tgz",
-      "integrity": "sha512-nH60IZNNxEcrh6L1ZSMNA28rj27ut/2ZmI3r96Zd+1jrZD++zD3LsMIjWlvg4AYrHn/Pqz4CF3veCxGjtbqt7A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-brush/-/d3-brush-3.0.6.tgz",
+      "integrity": "sha1-wvQ2KwRdRy4bGGzb7DKbpSva7mw=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-selection": "*"
@@ -5250,20 +5228,20 @@
     },
     "node_modules/@types/d3-chord": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-chord/-/d3-chord-3.0.6.tgz",
-      "integrity": "sha512-LFYWWd8nwfwEmTZG9PfQxd17HbNPksHBiJHaKuY1XeqscXacsS2tyoo6OdRsjf+NQYeB6XrNL3a25E3gH69lcg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-chord/-/d3-chord-3.0.6.tgz",
+      "integrity": "sha1-FwbKQM9+pZoK3Y9EVu//j4d1eT0=",
       "license": "MIT"
     },
     "node_modules/@types/d3-color": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-color/-/d3-color-3.1.3.tgz",
-      "integrity": "sha512-iO90scth9WAbmgv7ogoq57O9YpKmFBbmoEoCHDB2xMBY0+/KVrqAaCDyCE16dUspeOvIxFFRI+0sEtqDqy2b4A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-color/-/d3-color-3.1.3.tgz",
+      "integrity": "sha1-NoyWGhjech2oIA6AvzlD+1MTavI=",
       "license": "MIT"
     },
     "node_modules/@types/d3-contour": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-contour/-/d3-contour-3.0.6.tgz",
-      "integrity": "sha512-BjzLgXGnCWjUSYGfH1cpdo41/hgdWETu4YxpezoztawmqsvCeep+8QGfiY6YbDvfgHz/DkjeIkkZVJavB4a3rg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-contour/-/d3-contour-3.0.6.tgz",
+      "integrity": "sha1-mto/qcTQDjpQk/7QNWx6uSlgQjE=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-array": "*",
@@ -5272,20 +5250,20 @@
     },
     "node_modules/@types/d3-delaunay": {
       "version": "6.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-delaunay/-/d3-delaunay-6.0.4.tgz",
-      "integrity": "sha512-ZMaSKu4THYCU6sV64Lhg6qjf1orxBthaC161plr5KuPHo3CNm8DTHiLw/5Eq2b6TsNP0W0iJrUOFscY6Q450Hw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-delaunay/-/d3-delaunay-6.0.4.tgz",
+      "integrity": "sha1-GFwagMyAf92io/6WD3wRxKJ5UuE=",
       "license": "MIT"
     },
     "node_modules/@types/d3-dispatch": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-dispatch/-/d3-dispatch-3.0.7.tgz",
-      "integrity": "sha512-5o9OIAdKkhN1QItV2oqaE5KMIiXAvDWBDPrD85e58Qlz1c1kI/J0NcqbEG88CoTwJrYe7ntUCVfeUl2UJKbWgA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-dispatch/-/d3-dispatch-3.0.7.tgz",
+      "integrity": "sha1-7wBNihKARs/OQ00XGC+DTkTvlbI=",
       "license": "MIT"
     },
     "node_modules/@types/d3-drag": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-drag/-/d3-drag-3.0.7.tgz",
-      "integrity": "sha512-HE3jVKlzU9AaMazNufooRJ5ZpWmLIoc90A37WU2JMmeq28w1FQqCZswHZ3xR+SuxYftzHq6WU6KJHvqxKzTxxQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-drag/-/d3-drag-3.0.7.tgz",
+      "integrity": "sha1-sTq6iyRCtAaMmp5tHYL4vOp3/AI=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-selection": "*"
@@ -5293,20 +5271,20 @@
     },
     "node_modules/@types/d3-dsv": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-dsv/-/d3-dsv-3.0.7.tgz",
-      "integrity": "sha512-n6QBF9/+XASqcKK6waudgL0pf/S5XHPPI8APyMLLUHd8NqouBGLsU8MgtO7NINGtPBtk9Kko/W4ea0oAspwh9g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-dsv/-/d3-dsv-3.0.7.tgz",
+      "integrity": "sha1-CjUfmW3Jmzf0+li0ksLRwE49rBc=",
       "license": "MIT"
     },
     "node_modules/@types/d3-ease": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-ease/-/d3-ease-3.0.2.tgz",
-      "integrity": "sha512-NcV1JjO5oDzoK26oMzbILE6HW7uVXOHLQvHshBUW4UMdZGfiY6v5BeQwh9a9tCzv+CeefZQHJt5SRgK154RtiA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-ease/-/d3-ease-3.0.2.tgz",
+      "integrity": "sha1-4o2xv7+mFwdvd3DdHZpI6qO2xRs=",
       "license": "MIT"
     },
     "node_modules/@types/d3-fetch": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-fetch/-/d3-fetch-3.0.7.tgz",
-      "integrity": "sha512-fTAfNmxSb9SOWNB9IoG5c8Hg6R+AzUHDRlsXsDZsNp6sxAEOP0tkP3gKkNSO/qmHPoBFTxNrjDprVHDQDvo5aA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-fetch/-/d3-fetch-3.0.7.tgz",
+      "integrity": "sha1-wEorTyMYGqN28wrwKD28eztWmYA=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-dsv": "*"
@@ -5314,20 +5292,20 @@
     },
     "node_modules/@types/d3-force": {
       "version": "3.0.10",
-      "resolved": "https://registry.npmjs.org/@types/d3-force/-/d3-force-3.0.10.tgz",
-      "integrity": "sha512-ZYeSaCF3p73RdOKcjj+swRlZfnYpK1EbaDiYICEEp5Q6sUiqFaFQ9qgoshp5CzIyyb/yD09kD9o2zEltCexlgw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-force/-/d3-force-3.0.10.tgz",
+      "integrity": "sha1-bcj8bh81cE87BXCQvu63rGdL/xo=",
       "license": "MIT"
     },
     "node_modules/@types/d3-format": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-format/-/d3-format-3.0.4.tgz",
-      "integrity": "sha512-fALi2aI6shfg7vM5KiR1wNJnZ7r6UuggVqtDA+xiEdPZQwy/trcQaHnwShLuLdta2rTymCNpxYTiMZX/e09F4g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-format/-/d3-format-3.0.4.tgz",
+      "integrity": "sha1-seRGVkTds/3zomP+uyQKbNYW3pA=",
       "license": "MIT"
     },
     "node_modules/@types/d3-geo": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/@types/d3-geo/-/d3-geo-3.1.1.tgz",
-      "integrity": "sha512-65Emv9fQiQQqphLlRkuQ5ypPsOmWPhtBGCMv61JDPEPMvsx+gzhGf74yw1a78xFKPj6zw4AgQICJoQv0vK9M2w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-geo/-/d3-geo-3.1.1.tgz",
+      "integrity": "sha1-nig68XlgHFSVgWALP+wllBkRMp0=",
       "license": "MIT",
       "dependencies": {
         "@types/geojson": "*"
@@ -5335,14 +5313,14 @@
     },
     "node_modules/@types/d3-hierarchy": {
       "version": "3.1.7",
-      "resolved": "https://registry.npmjs.org/@types/d3-hierarchy/-/d3-hierarchy-3.1.7.tgz",
-      "integrity": "sha512-tJFtNoYBtRtkNysX1Xq4sxtjK8YgoWUNpIiUee0/jHGRwqvzYxkq0hGVbbOGSz+JgFxxRu4K8nb3YpG3CMARtg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-hierarchy/-/d3-hierarchy-3.1.7.tgz",
+      "integrity": "sha1-YCP7Oy1GMiny1oD5rEtHRm9x8Xs=",
       "license": "MIT"
     },
     "node_modules/@types/d3-interpolate": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
-      "integrity": "sha512-mgLPETlrpVV1YRJIglr4Ez47g7Yxjl1lj7YKsiMCb27VJH9W8NVM6Bb9d8kkpG/uAQS5AmbA48q2IAolKKo1MA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-interpolate/-/d3-interpolate-3.0.4.tgz",
+      "integrity": "sha1-QSuQ6EhwKF8v+KhGxutgNE8SpBw=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-color": "*"
@@ -5350,32 +5328,32 @@
     },
     "node_modules/@types/d3-path": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/@types/d3-path/-/d3-path-3.1.1.tgz",
-      "integrity": "sha512-VMZBYyQvbGmWyWVea0EHs/BwLgxc+MKi1zLDCONksozI4YJMcTt8ZEuIR4Sb1MMTE8MMW49v0IwI5+b7RmfWlg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-path/-/d3-path-3.1.1.tgz",
+      "integrity": "sha1-9jKzgMOsoduo40qgSbzWpK8j34o=",
       "license": "MIT"
     },
     "node_modules/@types/d3-polygon": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-polygon/-/d3-polygon-3.0.2.tgz",
-      "integrity": "sha512-ZuWOtMaHCkN9xoeEMr1ubW2nGWsp4nIql+OPQRstu4ypeZ+zk3YKqQT0CXVe/PYqrKpZAi+J9mTs05TKwjXSRA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-polygon/-/d3-polygon-3.0.2.tgz",
+      "integrity": "sha1-365UptNdGedqyVZbyzKo5UaTGJw=",
       "license": "MIT"
     },
     "node_modules/@types/d3-quadtree": {
       "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/@types/d3-quadtree/-/d3-quadtree-3.0.6.tgz",
-      "integrity": "sha512-oUzyO1/Zm6rsxKRHA1vH0NEDG58HrT5icx/azi9MF1TWdtttWl0UIUsjEQBBh+SIkrpd21ZjEv7ptxWys1ncsg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-quadtree/-/d3-quadtree-3.0.6.tgz",
+      "integrity": "sha1-1HQLD+NbHFi2bhSI9OftApUvVw8=",
       "license": "MIT"
     },
     "node_modules/@types/d3-random": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-random/-/d3-random-3.0.4.tgz",
-      "integrity": "sha512-UHYId5WTCx4L4YNel7NU00XUXXgvgpgZOvp10PuvsQENjMDXhh2RyFc0KBjO7B45ne4Ha1yVH7ii0vnzKkuzWA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-random/-/d3-random-3.0.4.tgz",
+      "integrity": "sha1-a9NoO4My/A8B5wWbdja8XH7eczc=",
       "license": "MIT"
     },
     "node_modules/@types/d3-scale": {
       "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/@types/d3-scale/-/d3-scale-4.0.9.tgz",
-      "integrity": "sha512-dLmtwB8zkAeO/juAMfnV+sItKjlsw2lKdZVVy6LRr0cBmegxSABiLEpGVmSJJ8O08i4+sGR6qQtb6WtuwJdvVw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-scale/-/d3-scale-4.0.9.tgz",
+      "integrity": "sha1-V6L3ByQub+Hega17/Myq9gYXmvs=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-time": "*"
@@ -5383,20 +5361,20 @@
     },
     "node_modules/@types/d3-scale-chromatic": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@types/d3-scale-chromatic/-/d3-scale-chromatic-3.1.0.tgz",
-      "integrity": "sha512-iWMJgwkK7yTRmWqRB5plb1kadXyQ5Sj8V/zYlFGMUBbIPKQScw+Dku9cAAMgJG+z5GYDoMjWGLVOvjghDEFnKQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-scale-chromatic/-/d3-scale-chromatic-3.1.0.tgz",
+      "integrity": "sha1-3G1Pmpg3bxjqULrWw5U38bVGPDk=",
       "license": "MIT"
     },
     "node_modules/@types/d3-selection": {
       "version": "3.0.11",
-      "resolved": "https://registry.npmjs.org/@types/d3-selection/-/d3-selection-3.0.11.tgz",
-      "integrity": "sha512-bhAXu23DJWsrI45xafYpkQ4NtcKMwWnAC/vKrd2l+nxMFuvOT3XMYTIj2opv8vq8AO5Yh7Qac/nSeP/3zjTK0w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-selection/-/d3-selection-3.0.11.tgz",
+      "integrity": "sha1-vXpF/AqMMWemMWdeYbwsorBY1KM=",
       "license": "MIT"
     },
     "node_modules/@types/d3-shape": {
       "version": "3.1.8",
-      "resolved": "https://registry.npmjs.org/@types/d3-shape/-/d3-shape-3.1.8.tgz",
-      "integrity": "sha512-lae0iWfcDeR7qt7rA88BNiqdvPS5pFVPpo5OfjElwNaT2yyekbM0C9vK+yqBqEmHr6lDkRnYNoTBYlAgJa7a4w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-shape/-/d3-shape-3.1.8.tgz",
+      "integrity": "sha1-0VFsxQh1O+BoUs0GdY47tUoisOM=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-path": "*"
@@ -5404,26 +5382,26 @@
     },
     "node_modules/@types/d3-time": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/d3-time/-/d3-time-3.0.4.tgz",
-      "integrity": "sha512-yuzZug1nkAAaBlBBikKZTgzCeA+k1uy4ZFwWANOfKw5z5LRhV0gNA7gNkKm7HoK+HRN0wX3EkxGk0fpbWhmB7g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-time/-/d3-time-3.0.4.tgz",
+      "integrity": "sha1-hHL+7NY5aRRQ3YAA6zPt1EThMj8=",
       "license": "MIT"
     },
     "node_modules/@types/d3-time-format": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/@types/d3-time-format/-/d3-time-format-4.0.3.tgz",
-      "integrity": "sha512-5xg9rC+wWL8kdDj153qZcsJ0FWiFt0J5RB6LYUNZjwSnesfblqrI/bJ1wBdJ8OQfncgbJG5+2F+qfqnqyzYxyg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-time-format/-/d3-time-format-4.0.3.tgz",
+      "integrity": "sha1-1rwea2p9tpzM+73Uw0twYy2enbI=",
       "license": "MIT"
     },
     "node_modules/@types/d3-timer": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@types/d3-timer/-/d3-timer-3.0.2.tgz",
-      "integrity": "sha512-Ps3T8E8dZDam6fUyNiMkekK3XUsaUEik+idO9/YjPtfj2qruF8tFBXS7XhtE4iIXBLxhmLjP3SXpLhVf21I9Lw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-timer/-/d3-timer-3.0.2.tgz",
+      "integrity": "sha1-cLvad9wjqnJ0E+IuIUr6Pw6FL3A=",
       "license": "MIT"
     },
     "node_modules/@types/d3-transition": {
       "version": "3.0.9",
-      "resolved": "https://registry.npmjs.org/@types/d3-transition/-/d3-transition-3.0.9.tgz",
-      "integrity": "sha512-uZS5shfxzO3rGlu0cC3bjmMFKsXv+SmZZcgp0KD22ts4uGXp5EVYGzu/0YdwZeKmddhcAccYtREJKkPfXkZuCg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-transition/-/d3-transition-3.0.9.tgz",
+      "integrity": "sha1-ETa8V+nds8OQ3MybX/O30rjZRwY=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-selection": "*"
@@ -5431,8 +5409,8 @@
     },
     "node_modules/@types/d3-zoom": {
       "version": "3.0.8",
-      "resolved": "https://registry.npmjs.org/@types/d3-zoom/-/d3-zoom-3.0.8.tgz",
-      "integrity": "sha512-iqMC4/YlFCSlO8+2Ii1GGGliCAY4XdeG748w5vQUbevlbDu0zSjH/+jojorQVBK/se0j6DUFNPBGSqD3YWYnDw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/d3-zoom/-/d3-zoom-3.0.8.tgz",
+      "integrity": "sha1-3Msy0cVrHhxuDxGA2ZSJbwOLxAs=",
       "license": "MIT",
       "dependencies": {
         "@types/d3-interpolate": "*",
@@ -5441,8 +5419,8 @@
     },
     "node_modules/@types/eslint": {
       "version": "8.56.12",
-      "resolved": "https://registry.npmjs.org/@types/eslint/-/eslint-8.56.12.tgz",
-      "integrity": "sha512-03ruubjWyOHlmljCVoxSuNDdmfZDzsrrz0P2LeJsOXr+ZwFQ+0yQIwNCwt/GYhV7Z31fgtXJTAEs+FYlEL851g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/eslint/-/eslint-8.56.12.tgz",
+      "integrity": "sha1-FlfIFP/rpNL4TA1LoPRMp+ocpTo=",
       "license": "MIT",
       "dependencies": {
         "@types/estree": "*",
@@ -5451,14 +5429,14 @@
     },
     "node_modules/@types/estree": {
       "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
-      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha1-zz8Oh2177hWpOrkluCv1cKOQSiQ=",
       "license": "MIT"
     },
     "node_modules/@types/express": {
       "version": "4.17.25",
-      "resolved": "https://registry.npmjs.org/@types/express/-/express-4.17.25.tgz",
-      "integrity": "sha512-dVd04UKsfpINUnK0yBoYHDF3xu7xVH4BuDotC/xGuycx4CgbP48X/KF/586bcObxT0HENHXEU8Nqtu6NR+eKhw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/express/-/express-4.17.25.tgz",
+      "integrity": "sha1-BwyMc6b+5pNtZcGV27+32lAmZJs=",
       "license": "MIT",
       "dependencies": {
         "@types/body-parser": "*",
@@ -5469,8 +5447,8 @@
     },
     "node_modules/@types/express-serve-static-core": {
       "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-5.1.3.tgz",
-      "integrity": "sha512-dPfW8NFiOF4wOHc7+N/QSxlY9cfSsenewGbAz8C8U/MULPd/YZ27LvJUIlzaXie7e6Ove9YunJGgC9tbHD2cKw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/express-serve-static-core/-/express-serve-static-core-5.1.3.tgz",
+      "integrity": "sha1-nTTIjAye5iuabk2firjX4paI5rQ=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
@@ -5481,8 +5459,8 @@
     },
     "node_modules/@types/express/node_modules/@types/express-serve-static-core": {
       "version": "4.19.9",
-      "resolved": "https://registry.npmjs.org/@types/express-serve-static-core/-/express-serve-static-core-4.19.9.tgz",
-      "integrity": "sha512-QP2ESEe/ImWY0HDwNAnK9PvEffUyhLTnWkk7KXzHfyeWAnlrDe1fN77bXl6ia8KT3wPlmA7t9/VPRpnf4Ex9sg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/express-serve-static-core/-/express-serve-static-core-4.19.9.tgz",
+      "integrity": "sha1-t0aou2w4mvejEUE5e7U593WwroQ=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
@@ -5493,14 +5471,14 @@
     },
     "node_modules/@types/geojson": {
       "version": "7946.0.16",
-      "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.16.tgz",
-      "integrity": "sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/geojson/-/geojson-7946.0.16.tgz",
+      "integrity": "sha1-jr5T1p762nBERU4zBcGQF9l87So=",
       "license": "MIT"
     },
     "node_modules/@types/graceful-fs": {
       "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@types/graceful-fs/-/graceful-fs-4.1.9.tgz",
-      "integrity": "sha512-olP3sd1qOEe5dXTSaFvQG+02VdRXcdytWLAZsAq1PecU8uqQAhkrnbli7DagjtXKW/Bl7YJbUsa8MPcuc8LHEQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/graceful-fs/-/graceful-fs-4.1.9.tgz",
+      "integrity": "sha1-Kga8D2iiCrN7PjaqI4vmq99J6LQ=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -5508,20 +5486,20 @@
     },
     "node_modules/@types/html-minifier-terser": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@types/html-minifier-terser/-/html-minifier-terser-6.1.0.tgz",
-      "integrity": "sha512-oh/6byDPnL1zeNXFrDXFLyZjkr1MsBG667IM792caf1L2UPOOMf65NFzjUH/ltyfwjAGfs1rsX1eftK0jC/KIg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/html-minifier-terser/-/html-minifier-terser-6.1.0.tgz",
+      "integrity": "sha1-T8M6AMHQwWmHsaIM+S0gYUxVrDU=",
       "license": "MIT"
     },
     "node_modules/@types/http-errors": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@types/http-errors/-/http-errors-2.0.5.tgz",
-      "integrity": "sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/http-errors/-/http-errors-2.0.5.tgz",
+      "integrity": "sha1-W3SasrFroRNCP+saZKldzTA5hHI=",
       "license": "MIT"
     },
     "node_modules/@types/http-proxy": {
       "version": "1.17.17",
-      "resolved": "https://registry.npmjs.org/@types/http-proxy/-/http-proxy-1.17.17.tgz",
-      "integrity": "sha512-ED6LB+Z1AVylNTu7hdzuBqOgMnvG/ld6wGCG8wFnAzKX5uyW2K3WD52v0gnLCTK/VLpXtKckgWuyScYK6cSPaw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/http-proxy/-/http-proxy-1.17.17.tgz",
+      "integrity": "sha1-2eLEVx/jUHNDyyEM1BeQN15ZpTM=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -5529,14 +5507,14 @@
     },
     "node_modules/@types/istanbul-lib-coverage": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz",
-      "integrity": "sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/istanbul-lib-coverage/-/istanbul-lib-coverage-2.0.6.tgz",
+      "integrity": "sha1-dznCMqH+6bTTzomF8xTAxtM1Sdc=",
       "license": "MIT"
     },
     "node_modules/@types/istanbul-lib-report": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.3.tgz",
-      "integrity": "sha512-NQn7AHQnk/RSLOxrBbGyJM/aVQ+pjj5HCgasFxc0K/KhoATfQ/47AyUl15I2yBUpihjmas+a+VJBOqecrFH+uA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/istanbul-lib-report/-/istanbul-lib-report-3.0.3.tgz",
+      "integrity": "sha1-UwR2FK5y4Z/AQB2HLeOuK0zjUL8=",
       "license": "MIT",
       "dependencies": {
         "@types/istanbul-lib-coverage": "*"
@@ -5544,8 +5522,8 @@
     },
     "node_modules/@types/istanbul-reports": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/@types/istanbul-reports/-/istanbul-reports-3.0.4.tgz",
-      "integrity": "sha512-pk2B1NWalF9toCRu6gjBzR69syFjP4Od8WRAX+0mmf9lAjCRicLOWc+ZrxZHx/0XRjotgkF9t6iaMJ+aXcOdZQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/istanbul-reports/-/istanbul-reports-3.0.4.tgz",
+      "integrity": "sha1-DwPj0vZw+9rFhuNLQzeDBwzBb1Q=",
       "license": "MIT",
       "dependencies": {
         "@types/istanbul-lib-report": "*"
@@ -5553,26 +5531,26 @@
     },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
-      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/json-schema/-/json-schema-7.0.15.tgz",
+      "integrity": "sha1-WWoXRyM2lNUPatinhp/Lb1bPWEE=",
       "license": "MIT"
     },
     "node_modules/@types/json5": {
       "version": "0.0.29",
-      "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
-      "integrity": "sha512-dRLjCWHYg4oaA77cxO64oO+7JwCwnIzkZPdrrC71jQmQtlhM556pwKo5bUzqvZndkVbeFLIIi+9TC40JNF5hNQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/json5/-/json5-0.0.29.tgz",
+      "integrity": "sha1-7ihweulOEdK4J7y+UnC86n8+ce4=",
       "license": "MIT"
     },
     "node_modules/@types/mime": {
       "version": "1.3.5",
-      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
-      "integrity": "sha512-/pyBZWSLD2n0dcHE3hq8s8ZvcETHtEuF+3E7XVt0Ig2nvsVQXdghHVcEkIWjy9A0wKfTn97a/PSDYohKIlnP/w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/mime/-/mime-1.3.5.tgz",
+      "integrity": "sha1-HvMC4Bz30rWg+lJnkMkSO/HQZpA=",
       "license": "MIT"
     },
     "node_modules/@types/node": {
       "version": "25.9.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.9.5.tgz",
-      "integrity": "sha512-OScDchr2fwuUmWdf4kZ9h7PcJiYDVInhJizG/biAq3cAvqwYktuy/TYGGdZNMtNTFUP7rnb0NU4TUdm82kt4Rg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/node/-/node-25.9.5.tgz",
+      "integrity": "sha1-D+/Anm6C6UzeKRus9DUi6YnrAaQ=",
       "license": "MIT",
       "dependencies": {
         "undici-types": ">=7.24.0 <7.24.7"
@@ -5580,8 +5558,8 @@
     },
     "node_modules/@types/node-forge": {
       "version": "1.3.14",
-      "resolved": "https://registry.npmjs.org/@types/node-forge/-/node-forge-1.3.14.tgz",
-      "integrity": "sha512-mhVF2BnD4BO+jtOp7z1CdzaK4mbuK0LLQYAvdOLqHTavxFNq4zA1EmYkpnFjP8HOUzedfQkRnp0E2ulSAYSzAw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/node-forge/-/node-forge-1.3.14.tgz",
+      "integrity": "sha1-AGwmFszWVVBWDCdX2EcuttPs6gs=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -5589,39 +5567,39 @@
     },
     "node_modules/@types/parse-json": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.2.tgz",
-      "integrity": "sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/parse-json/-/parse-json-4.0.2.tgz",
+      "integrity": "sha1-WVDlCWB5MFWEXpVsQn/CsNcMUjk=",
       "license": "MIT"
     },
     "node_modules/@types/prettier": {
       "version": "2.7.3",
-      "resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.7.3.tgz",
-      "integrity": "sha512-+68kP9yzs4LMp7VNh8gdzMSPZFL44MLGqiHWvttYJe+6qnuVr4Ek9wSBQoveqY/r+LwjCcU29kNVkidwim+kYA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/prettier/-/prettier-2.7.3.tgz",
+      "integrity": "sha1-PlGhfikdAdF9P8YUIgFakzr3oI8=",
       "license": "MIT"
     },
     "node_modules/@types/prop-types": {
       "version": "15.7.15",
-      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.15.tgz",
-      "integrity": "sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/prop-types/-/prop-types-15.7.15.tgz",
+      "integrity": "sha1-5uWobWAr6spxzlFj+t9fldcJMcc=",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/qs": {
       "version": "6.15.1",
-      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.15.1.tgz",
-      "integrity": "sha512-GZHUBZR9hckSUhrxmp1nG6NwdpM9fCunJwyThLW1X3AyHgd9IlHb6VANpQQqDr2o/qQp6McZ3y/IA2rVzKzSbw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/qs/-/qs-6.15.1.tgz",
+      "integrity": "sha1-hgaIQnLGPw25aYa9NUhlDYqTiL8=",
       "license": "MIT"
     },
     "node_modules/@types/range-parser": {
       "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
-      "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/range-parser/-/range-parser-1.2.7.tgz",
+      "integrity": "sha1-UK5DU+qt3AQEQnmBL1LIxlhX28s=",
       "license": "MIT"
     },
     "node_modules/@types/react": {
       "version": "18.3.31",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.31.tgz",
-      "integrity": "sha512-vfEqpXTvwT91yhmwdfouStN2hSKwTvyRs8qpLfADyrq/kxDw0hZM7Wk9Ug1FELj8hIby+S/+kQCSRFF32nv2Qw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/react/-/react-18.3.31.tgz",
+      "integrity": "sha1-teleKP/M6rjZgvM/LrB24XZTwqQ=",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5631,8 +5609,8 @@
     },
     "node_modules/@types/react-dom": {
       "version": "18.3.7",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.7.tgz",
-      "integrity": "sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/react-dom/-/react-dom-18.3.7.tgz",
+      "integrity": "sha1-uJ3fLNg7T+r8xOLqQa/fuVoNGU8=",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -5641,8 +5619,8 @@
     },
     "node_modules/@types/resolve": {
       "version": "1.17.1",
-      "resolved": "https://registry.npmjs.org/@types/resolve/-/resolve-1.17.1.tgz",
-      "integrity": "sha512-yy7HuzQhj0dhGpD8RLXSZWEkLsV9ibvxvi6EiJ3bkqLAO1RGo0WbkWQiwpRlSFymTJRz0d3k5LM3kkx8ArDbLw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/resolve/-/resolve-1.17.1.tgz",
+      "integrity": "sha1-Ov1q2JZ8d+Q3bFmKgt3Vj0bsRdY=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -5650,20 +5628,20 @@
     },
     "node_modules/@types/retry": {
       "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.0.tgz",
-      "integrity": "sha512-wWKOClTTiizcZhXnPY4wikVAwmdYHp8q6DmC+EJUzAMsycb7HB32Kh9RN4+0gExjmPmZSAQjgURXIGATPegAvA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha1-KzXsz87n04zXKtmSMvvVi/+zyE0=",
       "license": "MIT"
     },
     "node_modules/@types/semver": {
       "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-1mAINjtQCXXeLkJ9ehXkwOcBpqtLxiVtKhpUf83DdRNdQKV0iXZpaHYqRr7nj+wvxuJzoAmAwXI+sCNMv1CzLQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/semver/-/semver-7.8.0.tgz",
+      "integrity": "sha1-C/4+xR9elhW8MXF0zVuI6gi3/C8=",
       "license": "MIT"
     },
     "node_modules/@types/send": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@types/send/-/send-1.2.1.tgz",
-      "integrity": "sha512-arsCikDvlU99zl1g69TcAB3mzZPpxgw0UQnaHeC1Nwb015xp8bknZv5rIfri9xTOcMuaVgvabfIRA7PSZVuZIQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/send/-/send-1.2.1.tgz",
+      "integrity": "sha1-anhORVQ8GMd0wEm/9tPbrwRcnHQ=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -5671,8 +5649,8 @@
     },
     "node_modules/@types/serve-index": {
       "version": "1.9.4",
-      "resolved": "https://registry.npmjs.org/@types/serve-index/-/serve-index-1.9.4.tgz",
-      "integrity": "sha512-qLpGZ/c2fhSs5gnYsQxtDEq3Oy8SXPClIXkW5ghvAvsNuVSA8k+gCONcUCS/UjLEYvYps+e8uBtfgXgvhwfNug==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/serve-index/-/serve-index-1.9.4.tgz",
+      "integrity": "sha1-5q4T1QU8sG7TY5IRC0+aSaxOyJg=",
       "license": "MIT",
       "dependencies": {
         "@types/express": "*"
@@ -5680,8 +5658,8 @@
     },
     "node_modules/@types/serve-static": {
       "version": "1.15.10",
-      "resolved": "https://registry.npmjs.org/@types/serve-static/-/serve-static-1.15.10.tgz",
-      "integrity": "sha512-tRs1dB+g8Itk72rlSI2ZrW6vZg0YrLI81iQSTkMmOqnqCaNr/8Ek4VwWcN5vZgCYWbg/JJSGBlUaYGAOP73qBw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/serve-static/-/serve-static-1.15.10.tgz",
+      "integrity": "sha1-doFpFFp3j49d/LY2CurUFKOZT+4=",
       "license": "MIT",
       "dependencies": {
         "@types/http-errors": "*",
@@ -5691,8 +5669,8 @@
     },
     "node_modules/@types/serve-static/node_modules/@types/send": {
       "version": "0.17.6",
-      "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.6.tgz",
-      "integrity": "sha512-Uqt8rPBE8SY0RK8JB1EzVOIZ32uqy8HwdxCnoCOsYrvnswqmFZ/k+9Ikidlk/ImhsdvBsloHbAlewb2IEBV/Og==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/send/-/send-0.17.6.tgz",
+      "integrity": "sha1-rrU4W+Yv9YpSzVRZ2qUJrpFlHSU=",
       "license": "MIT",
       "dependencies": {
         "@types/mime": "^1",
@@ -5701,8 +5679,8 @@
     },
     "node_modules/@types/sockjs": {
       "version": "0.3.36",
-      "resolved": "https://registry.npmjs.org/@types/sockjs/-/sockjs-0.3.36.tgz",
-      "integrity": "sha512-MK9V6NzAS1+Ud7JV9lJLFqW85VbC9dq3LmwZCuBe4wBDgKC0Kj/jd8Xl+nSviU+Qc3+m7umHHyHg//2KSa0a0Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/sockjs/-/sockjs-0.3.36.tgz",
+      "integrity": "sha1-zjIs8HvMEZ1Mv3+IlU86O9D2dTU=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -5710,20 +5688,20 @@
     },
     "node_modules/@types/stack-utils": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz",
-      "integrity": "sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/stack-utils/-/stack-utils-2.0.3.tgz",
+      "integrity": "sha1-YgkyHrLBcSp+dGZCK4yx/A2d1dg=",
       "license": "MIT"
     },
     "node_modules/@types/trusted-types": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
-      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/trusted-types/-/trusted-types-2.0.7.tgz",
+      "integrity": "sha1-usywepcLkXB986PoumiWxX6tLRE=",
       "license": "MIT"
     },
     "node_modules/@types/ws": {
       "version": "8.18.1",
-      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.1.tgz",
-      "integrity": "sha512-ThVF6DCVhA8kUGy+aazFQ4kXQ7E1Ty7A3ypFOe0IcJV8O/M511G99AW24irKrW56Wt44yG9+ij8FaqoBGkuBXg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/ws/-/ws-8.18.1.tgz",
+      "integrity": "sha1-SEZOS/Ld/RfbE9hFRn9gcP/qSqk=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*"
@@ -5731,8 +5709,8 @@
     },
     "node_modules/@types/yargs": {
       "version": "16.0.11",
-      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-16.0.11.tgz",
-      "integrity": "sha512-sbtvk8wDN+JvEdabmZExoW/HNr1cB7D/j4LT08rMiuikfA7m/JNJg7ATQcgzs34zHnoScDkY0ZRSl29Fkmk36g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/yargs/-/yargs-16.0.11.tgz",
+      "integrity": "sha1-3pWPti53/Dg/ps2AZuq90T2ojwQ=",
       "license": "MIT",
       "dependencies": {
         "@types/yargs-parser": "*"
@@ -5740,14 +5718,14 @@
     },
     "node_modules/@types/yargs-parser": {
       "version": "21.0.3",
-      "resolved": "https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.3.tgz",
-      "integrity": "sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/yargs-parser/-/yargs-parser-21.0.3.tgz",
+      "integrity": "sha1-gV4wt4bS6PDc2F/VvPXhoE0AjxU=",
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
       "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.62.0.tgz",
-      "integrity": "sha512-TiZzBSJja/LbhNPvk6yc0JrX9XqhQ0hdh6M2svYfsHGejaKFIAGd9MQ+ERIMzLGlN/kZoYIgdxFV0PuljTKXag==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.62.0.tgz",
+      "integrity": "sha1-ru8DKNFyueN9m6ttvBO4ftiJd9s=",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.4.0",
@@ -5780,8 +5758,8 @@
     },
     "node_modules/@typescript-eslint/experimental-utils": {
       "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/experimental-utils/-/experimental-utils-5.62.0.tgz",
-      "integrity": "sha512-RTXpeB3eMkpoclG3ZHft6vG/Z30azNHuqY6wKPBHlVMZFuEvrtlEDe8gMqDb+SO+9hjC/pLekeSCryf9vMZlCw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@typescript-eslint/experimental-utils/-/experimental-utils-5.62.0.tgz",
+      "integrity": "sha1-FFWb9zODowgCa0J6SmEpuuIUZ0E=",
       "license": "MIT",
       "dependencies": {
         "@typescript-eslint/utils": "5.62.0"
@@ -5799,8 +5777,8 @@
     },
     "node_modules/@typescript-eslint/parser": {
       "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.62.0.tgz",
-      "integrity": "sha512-VlJEV0fOQ7BExOsHYAGrgbEiZoi8D+Bl2+f6V2RrXerRSylnp+ZBHmPvaIa8cz0Ajx7WO7Z5RqfgYg7ED1nRhA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@typescript-eslint/parser/-/parser-5.62.0.tgz",
+      "integrity": "sha1-G2PQgthJovyuilaSSPvi7huKVsc=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "@typescript-eslint/scope-manager": "5.62.0",
@@ -5826,8 +5804,8 @@
     },
     "node_modules/@typescript-eslint/scope-manager": {
       "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.62.0.tgz",
-      "integrity": "sha512-VXuvVvZeQCQb5Zgf4HAxc04q5j+WrNAtNh9OwCsCgpKqESMTu3tF/jhZ3xG6T4NZwWl65Bg8KuS2uEvhSfLl0w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@typescript-eslint/scope-manager/-/scope-manager-5.62.0.tgz",
+      "integrity": "sha1-2UV8zGoLjWs30OslKiMCJHjFRgw=",
       "license": "MIT",
       "dependencies": {
         "@typescript-eslint/types": "5.62.0",
@@ -5843,8 +5821,8 @@
     },
     "node_modules/@typescript-eslint/type-utils": {
       "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-5.62.0.tgz",
-      "integrity": "sha512-xsSQreu+VnfbqQpW5vnCJdq1Z3Q0U31qiWmRhr98ONQmcp/yhiPJFPq8MXiJVLiksmOKSjIldZzkebzHuCGzew==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@typescript-eslint/type-utils/-/type-utils-5.62.0.tgz",
+      "integrity": "sha1-KG8DicQWgTds2tlrMJzt0X1wNGo=",
       "license": "MIT",
       "dependencies": {
         "@typescript-eslint/typescript-estree": "5.62.0",
@@ -5870,8 +5848,8 @@
     },
     "node_modules/@typescript-eslint/types": {
       "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-5.62.0.tgz",
-      "integrity": "sha512-87NVngcbVXUahrRTqIK27gD2t5Cu1yuCXxbLcFtCzZGlfyVWWh8mLHkoxzjsB6DDNnvdL+fW8MiwPEJyGJQDgQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@typescript-eslint/types/-/types-5.62.0.tgz",
+      "integrity": "sha1-JYYH5g7/ownwZ2CJMcPfb+1B/S8=",
       "license": "MIT",
       "engines": {
         "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
@@ -5883,8 +5861,8 @@
     },
     "node_modules/@typescript-eslint/typescript-estree": {
       "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-5.62.0.tgz",
-      "integrity": "sha512-CmcQ6uY7b9y694lKdRB8FEel7JbU/40iSAPomu++SjLMntB+2Leay2LO6i8VnJk58MtE9/nQSFIH6jpyRWyYzA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@typescript-eslint/typescript-estree/-/typescript-estree-5.62.0.tgz",
+      "integrity": "sha1-fRd5S3f6vKxhXWpI+xQzMNli65s=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "@typescript-eslint/types": "5.62.0",
@@ -5910,8 +5888,8 @@
     },
     "node_modules/@typescript-eslint/utils": {
       "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-5.62.0.tgz",
-      "integrity": "sha512-n8oxjeb5aIbPFEtmQxQYOLI0i9n5ySBEY/ZEHHZqKQSFnxio1rv6dthascc9dLuwrL0RC5mPCxB7vnAVGAYWAQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@typescript-eslint/utils/-/utils-5.62.0.tgz",
+      "integrity": "sha1-FB6AnHFjbkp12qOfrtL7X0sQ34Y=",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
@@ -5936,8 +5914,8 @@
     },
     "node_modules/@typescript-eslint/utils/node_modules/eslint-scope": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
-      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-scope/-/eslint-scope-5.1.1.tgz",
+      "integrity": "sha1-54blmmbLkrP2wfsNUIqrF0hI9Iw=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "esrecurse": "^4.3.0",
@@ -5949,8 +5927,8 @@
     },
     "node_modules/@typescript-eslint/utils/node_modules/estraverse": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/estraverse/-/estraverse-4.3.0.tgz",
+      "integrity": "sha1-OYrT88WiSUi+dyXoPRGn3ijNvR0=",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=4.0"
@@ -5958,8 +5936,8 @@
     },
     "node_modules/@typescript-eslint/visitor-keys": {
       "version": "5.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-5.62.0.tgz",
-      "integrity": "sha512-07ny+LHRzQXepkGg6w0mFY41fVUNBrL2Roj/++7V1txKugfjm/Ci/qSND03r2RhlJhJYMcTn9AhhSSqQp0Ysyw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@typescript-eslint/visitor-keys/-/visitor-keys-5.62.0.tgz",
+      "integrity": "sha1-IXQBGRfOWCh1lU/+L2kS1ZMeNT4=",
       "license": "MIT",
       "dependencies": {
         "@typescript-eslint/types": "5.62.0",
@@ -5975,14 +5953,14 @@
     },
     "node_modules/@ungap/structured-clone": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.3.tgz",
-      "integrity": "sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@ungap/structured-clone/-/structured-clone-1.3.3.tgz",
+      "integrity": "sha1-CUBB4aTLGYfwODNUISgayL45C8w=",
       "license": "ISC"
     },
     "node_modules/@webassemblyjs/ast": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.14.1.tgz",
-      "integrity": "sha512-nuBEDgQfm1ccRp/8bCQrx1frohyufl4JlbMMZ4P1wpeOfDhF6FQkxZJ1b/e+PLwr6X1Nhw6OLme5usuBWYBvuQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/ast/-/ast-1.14.1.tgz",
+      "integrity": "sha1-qfagfysDyVyNOMRTah/ftSH/VbY=",
       "license": "MIT",
       "dependencies": {
         "@webassemblyjs/helper-numbers": "1.13.2",
@@ -5991,26 +5969,26 @@
     },
     "node_modules/@webassemblyjs/floating-point-hex-parser": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.13.2.tgz",
-      "integrity": "sha512-6oXyTOzbKxGH4steLbLNOu71Oj+C8Lg34n6CqRvqfS2O71BxY6ByfMDRhBytzknj9yGUPVJ1qIKhRlAwO1AovA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.13.2.tgz",
+      "integrity": "sha1-/Moe7dscxOe27tT8eVbWgTshufs=",
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-api-error": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.13.2.tgz",
-      "integrity": "sha512-U56GMYxy4ZQCbDZd6JuvvNV/WFildOjsaWD3Tzzvmw/mas3cXzRJPMjP83JqEsgSbyrmaGjBfDtV7KDXV9UzFQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/helper-api-error/-/helper-api-error-1.13.2.tgz",
+      "integrity": "sha1-4KFhUiSLw42u523X4h8Vxe86sec=",
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-buffer": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.14.1.tgz",
-      "integrity": "sha512-jyH7wtcHiKssDtFPRB+iQdxlDf96m0E39yb0k5uJVhFGleZFoNw1c4aeIcVUPPbXUVJ94wwnMOAqUHyzoEPVMA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/helper-buffer/-/helper-buffer-1.14.1.tgz",
+      "integrity": "sha1-giqbxgMWZTH31d+E5ntb+ZtyuWs=",
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-numbers": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-numbers/-/helper-numbers-1.13.2.tgz",
-      "integrity": "sha512-FE8aCmS5Q6eQYcV3gI35O4J789wlQA+7JrqTTpJqn5emA4U2hvwJmvFRC0HODS+3Ye6WioDklgd6scJ3+PLnEA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/helper-numbers/-/helper-numbers-1.13.2.tgz",
+      "integrity": "sha1-29kyVI5xGfS4p4d/1ajSDmNJCy0=",
       "license": "MIT",
       "dependencies": {
         "@webassemblyjs/floating-point-hex-parser": "1.13.2",
@@ -6020,14 +5998,14 @@
     },
     "node_modules/@webassemblyjs/helper-wasm-bytecode": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.13.2.tgz",
-      "integrity": "sha512-3QbLKy93F0EAIXLh0ogEVR6rOubA9AoZ+WRYhNbFyuB70j3dRdwH9g+qXhLAO0kiYGlg3TxDV+I4rQTr/YNXkA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.13.2.tgz",
+      "integrity": "sha1-5VYQh1j0SKroTIUOWTzhig6zHgs=",
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/helper-wasm-section": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.14.1.tgz",
-      "integrity": "sha512-ds5mXEqTJ6oxRoqjhWDU83OgzAYjwsCV8Lo/N+oRsNDmx/ZDpqalmrtgOMkHwxsG0iI//3BwWAErYRHtgn0dZw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.14.1.tgz",
+      "integrity": "sha1-lindqcRDDqtUtZEFPW3G87oFA0g=",
       "license": "MIT",
       "dependencies": {
         "@webassemblyjs/ast": "1.14.1",
@@ -6038,8 +6016,8 @@
     },
     "node_modules/@webassemblyjs/ieee754": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.13.2.tgz",
-      "integrity": "sha512-4LtOzh58S/5lX4ITKxnAK2USuNEvpdVV9AlgGQb8rJDHaLeHciwG4zlGr0j/SNWlr7x3vO1lDEsuePvtcDNCkw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/ieee754/-/ieee754-1.13.2.tgz",
+      "integrity": "sha1-HF6qzh1gatosf9cEXqk1bFnuDbo=",
       "license": "MIT",
       "dependencies": {
         "@xtuc/ieee754": "^1.2.0"
@@ -6047,8 +6025,8 @@
     },
     "node_modules/@webassemblyjs/leb128": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.13.2.tgz",
-      "integrity": "sha512-Lde1oNoIdzVzdkNEAWZ1dZ5orIbff80YPdHx20mrHwHrVNNTjNr8E3xz9BdpcGqRQbAEa+fkrCb+fRFTl/6sQw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/leb128/-/leb128-1.13.2.tgz",
+      "integrity": "sha1-V8XD3rAQXQLOJfo/109OvJ/Qu7A=",
       "license": "Apache-2.0",
       "dependencies": {
         "@xtuc/long": "4.2.2"
@@ -6056,14 +6034,14 @@
     },
     "node_modules/@webassemblyjs/utf8": {
       "version": "1.13.2",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.13.2.tgz",
-      "integrity": "sha512-3NQWGjKTASY1xV5m7Hr0iPeXD9+RDobLll3T9d2AO+g3my8xy5peVyjSag4I50mR1bBSN/Ct12lo+R9tJk0NZQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/utf8/-/utf8-1.13.2.tgz",
+      "integrity": "sha1-kXog6T9xrVYClmwtaFrgxsIfYPE=",
       "license": "MIT"
     },
     "node_modules/@webassemblyjs/wasm-edit": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.14.1.tgz",
-      "integrity": "sha512-RNJUIQH/J8iA/1NzlE4N7KtyZNHi3w7at7hDjvRNm5rcUXa00z1vRz3glZoULfJ5mpvYhLybmVcwcjGrC1pRrQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/wasm-edit/-/wasm-edit-1.14.1.tgz",
+      "integrity": "sha1-rGaJ9QIhm1kZjd7ELc1JaxAE1Zc=",
       "license": "MIT",
       "dependencies": {
         "@webassemblyjs/ast": "1.14.1",
@@ -6078,8 +6056,8 @@
     },
     "node_modules/@webassemblyjs/wasm-gen": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.14.1.tgz",
-      "integrity": "sha512-AmomSIjP8ZbfGQhumkNvgC33AY7qtMCXnN6bL2u2Js4gVCg8fp735aEiMSBbDR7UQIj90n4wKAFUSEd0QN2Ukg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/wasm-gen/-/wasm-gen-1.14.1.tgz",
+      "integrity": "sha1-mR5/DAkMsLtiu6yIIHbj0hnalXA=",
       "license": "MIT",
       "dependencies": {
         "@webassemblyjs/ast": "1.14.1",
@@ -6091,8 +6069,8 @@
     },
     "node_modules/@webassemblyjs/wasm-opt": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.14.1.tgz",
-      "integrity": "sha512-PTcKLUNvBqnY2U6E5bdOQcSM+oVP/PmrDY9NzowJjislEjwP/C4an2303MCVS2Mg9d3AJpIGdUFIQQWbPds0Sw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/wasm-opt/-/wasm-opt-1.14.1.tgz",
+      "integrity": "sha1-5vce18yuRngcIGAX08FMUO+oEGs=",
       "license": "MIT",
       "dependencies": {
         "@webassemblyjs/ast": "1.14.1",
@@ -6103,8 +6081,8 @@
     },
     "node_modules/@webassemblyjs/wasm-parser": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.14.1.tgz",
-      "integrity": "sha512-JLBl+KZ0R5qB7mCnud/yyX08jWFw5MsoalJ1pQ4EdFlgj9VdXKGuENGsiCIjegI1W7p91rUlcB/LB5yRJKNTcQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/wasm-parser/-/wasm-parser-1.14.1.tgz",
+      "integrity": "sha1-s+E/GJNgXKeLUsaOVM9qhl+Qufs=",
       "license": "MIT",
       "dependencies": {
         "@webassemblyjs/ast": "1.14.1",
@@ -6117,8 +6095,8 @@
     },
     "node_modules/@webassemblyjs/wast-printer": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.14.1.tgz",
-      "integrity": "sha512-kPSSXE6De1XOR820C90RIo2ogvZG+c3KiHzqUoO/F34Y2shGzesfqv7o57xrxovZJH/MetF5UjroJ/R/3isoiw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@webassemblyjs/wast-printer/-/wast-printer-1.14.1.tgz",
+      "integrity": "sha1-O7PpY4qK5f2vlhDnoGtNn5qm/gc=",
       "license": "MIT",
       "dependencies": {
         "@webassemblyjs/ast": "1.14.1",
@@ -6127,27 +6105,27 @@
     },
     "node_modules/@xtuc/ieee754": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@xtuc/ieee754/-/ieee754-1.2.0.tgz",
-      "integrity": "sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@xtuc/ieee754/-/ieee754-1.2.0.tgz",
+      "integrity": "sha1-7vAUoxRa5Hehy8AM0eVSM23Ot5A=",
       "license": "BSD-3-Clause"
     },
     "node_modules/@xtuc/long": {
       "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@xtuc/long/-/long-4.2.2.tgz",
-      "integrity": "sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@xtuc/long/-/long-4.2.2.tgz",
+      "integrity": "sha1-0pHGpOl5ibXGHZrPOWrk/hM6cY0=",
       "license": "Apache-2.0"
     },
     "node_modules/abab": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/abab/-/abab-2.0.6.tgz",
-      "integrity": "sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/abab/-/abab-2.0.6.tgz",
+      "integrity": "sha1-QbgPLIcdGWhiFrgjCSMc/Tyz0pE=",
       "deprecated": "Use your platform's native atob() and btoa() methods instead",
       "license": "BSD-3-Clause"
     },
     "node_modules/accepts": {
       "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
-      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/accepts/-/accepts-1.3.8.tgz",
+      "integrity": "sha1-C/C+EltnAUrcsLCSHmLbe//hay4=",
       "license": "MIT",
       "dependencies": {
         "mime-types": "~2.1.34",
@@ -6159,8 +6137,8 @@
     },
     "node_modules/accepts/node_modules/negotiator": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
-      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/negotiator/-/negotiator-0.6.3.tgz",
+      "integrity": "sha1-WOMjpy/twNb5zU0x/kn1FHlZDM0=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -6168,8 +6146,8 @@
     },
     "node_modules/acorn": {
       "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
-      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/acorn/-/acorn-8.18.0.tgz",
+      "integrity": "sha1-T68BstbTJr/u2XrqH1IiC19MGUA=",
       "license": "MIT",
       "bin": {
         "acorn": "bin/acorn"
@@ -6180,8 +6158,8 @@
     },
     "node_modules/acorn-globals": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/acorn-globals/-/acorn-globals-6.0.0.tgz",
-      "integrity": "sha512-ZQl7LOWaF5ePqqcX4hLuv/bLXYQNfNWw2c0/yX/TsPRKamzHcTGQnlCjHT3TsmkOUVEPS3crCxiPfdzE/Trlhg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/acorn-globals/-/acorn-globals-6.0.0.tgz",
+      "integrity": "sha1-Rs3Tnw+P8IqHZhm1X1rIptx3C0U=",
       "license": "MIT",
       "dependencies": {
         "acorn": "^7.1.1",
@@ -6190,8 +6168,8 @@
     },
     "node_modules/acorn-globals/node_modules/acorn": {
       "version": "7.4.1",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
-      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/acorn/-/acorn-7.4.1.tgz",
+      "integrity": "sha1-/q7SVZc9LndVW4PbwIhRpsY1IPo=",
       "license": "MIT",
       "bin": {
         "acorn": "bin/acorn"
@@ -6202,8 +6180,8 @@
     },
     "node_modules/acorn-jsx": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
-      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha1-ftW7VZCLOy8bxVxq8WU7rafweTc=",
       "license": "MIT",
       "peerDependencies": {
         "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -6211,8 +6189,8 @@
     },
     "node_modules/acorn-walk": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.2.0.tgz",
-      "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/acorn-walk/-/acorn-walk-7.2.0.tgz",
+      "integrity": "sha1-DeiJpgEgOQmw++B7iTjcIdLpZ7w=",
       "license": "MIT",
       "engines": {
         "node": ">=0.4.0"
@@ -6220,8 +6198,8 @@
     },
     "node_modules/address": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/address/-/address-1.2.2.tgz",
-      "integrity": "sha512-4B/qKCfeE/ODUaAUpSwfzazo5x29WD4r3vXiWsB7I2mSDAihwEqKO+g8GELZUQSSAo5e1XTYh3ZVfLyxBc12nA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/address/-/address-1.2.2.tgz",
+      "integrity": "sha1-K1JI2sVIWmOQUyxqUX/aLj+qyJ4=",
       "license": "MIT",
       "engines": {
         "node": ">= 10.0.0"
@@ -6229,8 +6207,8 @@
     },
     "node_modules/adjust-sourcemap-loader": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/adjust-sourcemap-loader/-/adjust-sourcemap-loader-4.0.0.tgz",
-      "integrity": "sha512-OXwN5b9pCUXNQHJpwwD2qP40byEmSgzj8B4ydSN0uMNYWiFmJ6x6KwUllMmfk8Rwu/HJDFR7U8ubsWBoN0Xp0A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/adjust-sourcemap-loader/-/adjust-sourcemap-loader-4.0.0.tgz",
+      "integrity": "sha1-/EoP0ID30QRx8wpzIPJVYK3ijJk=",
       "license": "MIT",
       "dependencies": {
         "loader-utils": "^2.0.0",
@@ -6242,8 +6220,8 @@
     },
     "node_modules/agent-base": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
-      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha1-Sf/1hXfP7j83F2/qtMIuAPhtf3c=",
       "license": "MIT",
       "dependencies": {
         "debug": "4"
@@ -6254,8 +6232,8 @@
     },
     "node_modules/ajv": {
       "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha1-MEs2Nq3Yi6fZNnYN1Q7OAG3qlfk=",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -6270,8 +6248,8 @@
     },
     "node_modules/ajv-formats": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-2.1.1.tgz",
-      "integrity": "sha512-Wx0Kx52hxE7C18hkMEggYlEifqWZtYaRgouJor+WMdPnQyEK13vgEWyVNup7SoeeoLMsr4kf5h6dOW11I15MUA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv-formats/-/ajv-formats-2.1.1.tgz",
+      "integrity": "sha1-bmaUAGWet0lzu/LjMycYCgmWtSA=",
       "license": "MIT",
       "dependencies": {
         "ajv": "^8.0.0"
@@ -6287,8 +6265,8 @@
     },
     "node_modules/ajv-keywords": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
-      "integrity": "sha512-YCS/JNFAUyr5vAuhk1DWm1CBxRHW9LbJ2ozWeemrIqpbsqKjHVxYPyi5GC0rjZIT5JxJ3virVTS8wk4i/Z+krw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv-keywords/-/ajv-keywords-5.1.0.tgz",
+      "integrity": "sha1-adTThaRzPNvqtElkoRcKiPh/DhY=",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3"
@@ -6299,8 +6277,8 @@
     },
     "node_modules/ansi-escapes": {
       "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
-      "integrity": "sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ansi-escapes/-/ansi-escapes-4.3.2.tgz",
+      "integrity": "sha1-ayKR0dt9mLZSHV8e+kLQ86n+tl4=",
       "license": "MIT",
       "dependencies": {
         "type-fest": "^0.21.3"
@@ -6314,8 +6292,8 @@
     },
     "node_modules/ansi-escapes/node_modules/type-fest": {
       "version": "0.21.3",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.21.3.tgz",
-      "integrity": "sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/type-fest/-/type-fest-0.21.3.tgz",
+      "integrity": "sha1-0mCiSwGYQ24TP6JqUkptZfo7Ljc=",
       "license": "(MIT OR CC0-1.0)",
       "engines": {
         "node": ">=10"
@@ -6326,8 +6304,8 @@
     },
     "node_modules/ansi-html": {
       "version": "0.0.9",
-      "resolved": "https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.9.tgz",
-      "integrity": "sha512-ozbS3LuenHVxNRh/wdnN16QapUHzauqSomAl1jwwJRRsGwFwtj644lIhxfWu0Fy0acCij2+AEgHvjscq3dlVXg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ansi-html/-/ansi-html-0.0.9.tgz",
+      "integrity": "sha1-ZRLQI0KuLMaBMZUmRKEpy3NM0/A=",
       "engines": [
         "node >= 0.8.0"
       ],
@@ -6338,8 +6316,8 @@
     },
     "node_modules/ansi-html-community": {
       "version": "0.0.8",
-      "resolved": "https://registry.npmjs.org/ansi-html-community/-/ansi-html-community-0.0.8.tgz",
-      "integrity": "sha512-1APHAyr3+PCamwNw3bXCPp4HFLONZt/yIH0sZp0/469KWNTEy+qN5jQ3GVX6DMZ1UXAi34yVwtTeaG/HpBuuzw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ansi-html-community/-/ansi-html-community-0.0.8.tgz",
+      "integrity": "sha1-afvE1sy+OD+XNpNK40w/gpDxv0E=",
       "engines": [
         "node >= 0.8.0"
       ],
@@ -6350,8 +6328,8 @@
     },
     "node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha1-CCyyyJyf6GWaMRpTvWpNxTAdswQ=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -6359,8 +6337,8 @@
     },
     "node_modules/ansi-styles": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha1-7dgDYornHATIWuegkG7a00tkiTc=",
       "license": "MIT",
       "dependencies": {
         "color-convert": "^2.0.1"
@@ -6374,14 +6352,14 @@
     },
     "node_modules/any-promise": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/any-promise/-/any-promise-1.3.0.tgz",
-      "integrity": "sha512-7UvmKalWRt1wgjL1RrGxoSJW/0QZFIegpeGvZG9kjp8vrRu55XTHbwnqq2GpXm9uLbcuhxm3IqX9OB4MZR1b2A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/any-promise/-/any-promise-1.3.0.tgz",
+      "integrity": "sha1-q8av7tzqUugJzcA3au0845Y10X8=",
       "license": "MIT"
     },
     "node_modules/anymatch": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz",
-      "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/anymatch/-/anymatch-3.1.3.tgz",
+      "integrity": "sha1-eQxYsZuhcgqEIFtXxhjVrYUklz4=",
       "license": "ISC",
       "dependencies": {
         "normalize-path": "^3.0.0",
@@ -6393,14 +6371,14 @@
     },
     "node_modules/arg": {
       "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/arg/-/arg-5.0.2.tgz",
-      "integrity": "sha512-PYjyFOLKQ9y57JvQ6QLo8dAgNqswh8M1RMJYdQduT6xbWSgK36P/Z/v+p888pM69jMMfS8Xd8F6I1kQ/I9HUGg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/arg/-/arg-5.0.2.tgz",
+      "integrity": "sha1-yBQzzEJ8ksTc9IZRQtvKbxWs1Zw=",
       "license": "MIT"
     },
     "node_modules/argparse": {
       "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-1.0.10.tgz",
-      "integrity": "sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/argparse/-/argparse-1.0.10.tgz",
+      "integrity": "sha1-vNZ5HqWuCXJeF+WtmIE0zUCz2RE=",
       "license": "MIT",
       "dependencies": {
         "sprintf-js": "~1.0.2"
@@ -6408,8 +6386,8 @@
     },
     "node_modules/aria-query": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.2.tgz",
-      "integrity": "sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/aria-query/-/aria-query-5.3.2.tgz",
+      "integrity": "sha1-k/gaQ0gOM6M48ZFjo9EKUMAdzVk=",
       "license": "Apache-2.0",
       "engines": {
         "node": ">= 0.4"
@@ -6417,8 +6395,8 @@
     },
     "node_modules/array-buffer-byte-length": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/array-buffer-byte-length/-/array-buffer-byte-length-1.0.2.tgz",
-      "integrity": "sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/array-buffer-byte-length/-/array-buffer-byte-length-1.0.2.tgz",
+      "integrity": "sha1-OE0So3KVrsN2mrAirTI6GKUcz4s=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -6433,14 +6411,14 @@
     },
     "node_modules/array-flatten": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
-      "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/array-flatten/-/array-flatten-1.1.1.tgz",
+      "integrity": "sha1-ml9pkFGx5wczKPKgCJaLZOopVdI=",
       "license": "MIT"
     },
     "node_modules/array-includes": {
       "version": "3.1.9",
-      "resolved": "https://registry.npmjs.org/array-includes/-/array-includes-3.1.9.tgz",
-      "integrity": "sha512-FmeCCAenzH0KH381SPT5FZmiA/TmpndpcaShhfgEN9eCVjnFBqq3l1xrI42y8+PPLI6hypzou4GXw00WHmPBLQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/array-includes/-/array-includes-3.1.9.tgz",
+      "integrity": "sha1-HwzKoI6Qzbw+tDMhD5A60PF8Pzo=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -6461,8 +6439,8 @@
     },
     "node_modules/array-union": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz",
-      "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/array-union/-/array-union-2.1.0.tgz",
+      "integrity": "sha1-t5hCCtvrHego2ErNii4j0+/oXo0=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -6470,8 +6448,8 @@
     },
     "node_modules/array.prototype.findlast": {
       "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/array.prototype.findlast/-/array.prototype.findlast-1.2.5.tgz",
-      "integrity": "sha512-CVvd6FHg1Z3POpBLxO6E6zr+rSKEQ9L6rZHAaY7lLfhKsWYUBBOuMs0e9o24oopj6H+geRCX0YJ+TJLBK2eHyQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/array.prototype.findlast/-/array.prototype.findlast-1.2.5.tgz",
+      "integrity": "sha1-Pk+8swoVp/W/ZM8vquItE5wuSQQ=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.7",
@@ -6490,8 +6468,8 @@
     },
     "node_modules/array.prototype.findlastindex": {
       "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/array.prototype.findlastindex/-/array.prototype.findlastindex-1.2.6.tgz",
-      "integrity": "sha512-F/TKATkzseUExPlfvmwQKGITM3DGTK+vkAsCZoDc5daVygbJBnjEUCbgkAvVFsgfXfX4YIqZ/27G3k3tdXrTxQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/array.prototype.findlastindex/-/array.prototype.findlastindex-1.2.6.tgz",
+      "integrity": "sha1-z6EGXIHctk40VXybgdAS9qQhxWQ=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -6511,8 +6489,8 @@
     },
     "node_modules/array.prototype.flat": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/array.prototype.flat/-/array.prototype.flat-1.3.3.tgz",
-      "integrity": "sha512-rwG/ja1neyLqCuGZ5YYrznA62D4mZXg0i1cIskIUKSiqF3Cje9/wXAls9B9s1Wa2fomMsIv8czB8jZcPmxCXFg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/array.prototype.flat/-/array.prototype.flat-1.3.3.tgz",
+      "integrity": "sha1-U0qvnm6N15+2uamRf4Oe8exjr+U=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -6529,8 +6507,8 @@
     },
     "node_modules/array.prototype.flatmap": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/array.prototype.flatmap/-/array.prototype.flatmap-1.3.3.tgz",
-      "integrity": "sha512-Y7Wt51eKJSyi80hFrJCePGGNo5ktJCslFuboqJsbf57CCPcm5zztluPlc4/aD8sWsKvlwatezpV4U1efk8kpjg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/array.prototype.flatmap/-/array.prototype.flatmap-1.3.3.tgz",
+      "integrity": "sha1-cSzHkq5wNwrkBYYmRinjOqtd04s=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -6547,8 +6525,8 @@
     },
     "node_modules/array.prototype.tosorted": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/array.prototype.tosorted/-/array.prototype.tosorted-1.1.4.tgz",
-      "integrity": "sha512-p6Fx8B7b7ZhL/gmUsAy0D15WhvDccw3mnGNbZpi3pmeJdxtWsj2jEaI4Y6oo3XiHfzuSgPwKc04MYt6KgvC/wA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/array.prototype.tosorted/-/array.prototype.tosorted-1.1.4.tgz",
+      "integrity": "sha1-/pVGeP9TA05xfqM1KgPwsLhvf/w=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.7",
@@ -6563,8 +6541,8 @@
     },
     "node_modules/arraybuffer.prototype.slice": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.4.tgz",
-      "integrity": "sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/arraybuffer.prototype.slice/-/arraybuffer.prototype.slice-1.0.4.tgz",
+      "integrity": "sha1-nXYNhNvdBtDL+SyISWFaGnqzGDw=",
       "license": "MIT",
       "dependencies": {
         "array-buffer-byte-length": "^1.0.1",
@@ -6584,26 +6562,26 @@
     },
     "node_modules/asap": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/asap/-/asap-2.0.6.tgz",
-      "integrity": "sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/asap/-/asap-2.0.6.tgz",
+      "integrity": "sha1-5QNHYR1+aQlDIIu9r+vLwvuGbUY=",
       "license": "MIT"
     },
     "node_modules/ast-types-flow": {
       "version": "0.0.8",
-      "resolved": "https://registry.npmjs.org/ast-types-flow/-/ast-types-flow-0.0.8.tgz",
-      "integrity": "sha512-OH/2E5Fg20h2aPrbe+QL8JZQFko0YZaF+j4mnQ7BGhfavO7OpSLa8a0y9sBwomHdSbkhTS8TQNayBfnW5DwbvQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ast-types-flow/-/ast-types-flow-0.0.8.tgz",
+      "integrity": "sha1-CoXhySaVdprBOkKLtlPnU4vqJ9Y=",
       "license": "MIT"
     },
     "node_modules/async": {
       "version": "3.2.6",
-      "resolved": "https://registry.npmjs.org/async/-/async-3.2.6.tgz",
-      "integrity": "sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/async/-/async-3.2.6.tgz",
+      "integrity": "sha1-Gwco4Ukp1RuFtEm38G4nwRReOM4=",
       "license": "MIT"
     },
     "node_modules/async-function": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/async-function/-/async-function-1.0.0.tgz",
-      "integrity": "sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/async-function/-/async-function-1.0.0.tgz",
+      "integrity": "sha1-UJyfymDq+FA0xoKYOBiOTkyP+ys=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -6611,14 +6589,14 @@
     },
     "node_modules/asynckit": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
-      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha1-x57Zf380y48robyXkLzDZkdLS3k=",
       "license": "MIT"
     },
     "node_modules/at-least-node": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
-      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/at-least-node/-/at-least-node-1.0.0.tgz",
+      "integrity": "sha1-YCzUtG6EStTv/JKoARo8RuAjjcI=",
       "license": "ISC",
       "engines": {
         "node": ">= 4.0.0"
@@ -6626,8 +6604,8 @@
     },
     "node_modules/autoprefixer": {
       "version": "10.5.4",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.5.4.tgz",
-      "integrity": "sha512-MaU0U/za7N3r6brxD4YB/l4NSrFzLPlANv6wEuQVaIPlD3L4W9rFcQPbL/EilY9BHhHvhfcz3gInDLrEtWT4EA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/autoprefixer/-/autoprefixer-10.5.4.tgz",
+      "integrity": "sha1-O33YSLQVVRSpWtH2zlmIRL6glpc=",
       "funding": [
         {
           "type": "opencollective",
@@ -6662,8 +6640,8 @@
     },
     "node_modules/available-typed-arrays": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/available-typed-arrays/-/available-typed-arrays-1.0.7.tgz",
-      "integrity": "sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/available-typed-arrays/-/available-typed-arrays-1.0.7.tgz",
+      "integrity": "sha1-pcw3XWoDwu/IelU/PgsVIt7xSEY=",
       "license": "MIT",
       "dependencies": {
         "possible-typed-array-names": "^1.0.0"
@@ -6676,9 +6654,9 @@
       }
     },
     "node_modules/axe-core": {
-      "version": "4.12.1",
-      "resolved": "https://registry.npmjs.org/axe-core/-/axe-core-4.12.1.tgz",
-      "integrity": "sha512-s7iGf5GaVMxEG0ENN9x+xTr7GFZCb1ZP/1uATUpCEK2X78nDB3RwbtFCo9pGAf9ru+VwoQ464DkaLEeRM08wJA==",
+      "version": "4.13.0",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/axe-core/-/axe-core-4.13.0.tgz",
+      "integrity": "sha1-+Gjssb1h2YIyF2DlHYQatJerhtA=",
       "license": "MPL-2.0",
       "engines": {
         "node": ">=4"
@@ -6686,8 +6664,8 @@
     },
     "node_modules/axios": {
       "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.19.0.tgz",
-      "integrity": "sha512-ht/iuYZXEjFxLH/Hkezgd7m6JKlHHXEUSneaDz8uZe1Gj5QZtCnpyDsckvAiEnT89OEbCLmnte4R4sn7P0EKFw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/axios/-/axios-1.19.0.tgz",
+      "integrity": "sha1-3fhk1MgjPA5oc3RqtZNhU30FrTk=",
       "license": "MIT",
       "dependencies": {
         "follow-redirects": "^1.16.0",
@@ -6698,8 +6676,8 @@
     },
     "node_modules/axobject-query": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
-      "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/axobject-query/-/axobject-query-4.1.0.tgz",
+      "integrity": "sha1-KHaMdtDjz/IbxiqeLQtqwwBCoe4=",
       "license": "Apache-2.0",
       "engines": {
         "node": ">= 0.4"
@@ -6707,8 +6685,8 @@
     },
     "node_modules/babel-jest": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-27.5.1.tgz",
-      "integrity": "sha512-cdQ5dXjGRd0IBRATiQ4mZGlGlRE8kJpjPOixdNRdT+m3UcNqmYWN6rK6nvtXYfY3D76cb8s/O1Ss8ea24PIwcg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-jest/-/babel-jest-27.5.1.tgz",
+      "integrity": "sha1-ob+NYZKO3+/SHaJ+uGppW/1pFEQ=",
       "license": "MIT",
       "dependencies": {
         "@jest/transform": "^27.5.1",
@@ -6729,8 +6707,8 @@
     },
     "node_modules/babel-loader": {
       "version": "8.4.1",
-      "resolved": "https://registry.npmjs.org/babel-loader/-/babel-loader-8.4.1.tgz",
-      "integrity": "sha512-nXzRChX+Z1GoE6yWavBQg6jDslyFF3SDjl2paADuoQtQW10JqShJt62R6eJQ5m/pjJFDT8xgKIWSP85OY8eXeA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-loader/-/babel-loader-8.4.1.tgz",
+      "integrity": "sha1-bMt1xm5iw7FE4cXy6uxbj2wIxnU=",
       "license": "MIT",
       "dependencies": {
         "find-cache-dir": "^3.3.1",
@@ -6748,8 +6726,8 @@
     },
     "node_modules/babel-loader/node_modules/ajv": {
       "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha1-B+mCx0YmFnqnoklcU4F4ktcTlJI=",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
@@ -6764,8 +6742,8 @@
     },
     "node_modules/babel-loader/node_modules/ajv-keywords": {
       "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
-      "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
+      "integrity": "sha1-MfKdpatuANHC0yms97WSlhTVAU0=",
       "license": "MIT",
       "peerDependencies": {
         "ajv": "^6.9.1"
@@ -6773,14 +6751,14 @@
     },
     "node_modules/babel-loader/node_modules/json-schema-traverse": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha1-afaofZUTq4u4/mO9sJecRI5oRmA=",
       "license": "MIT"
     },
     "node_modules/babel-loader/node_modules/schema-utils": {
       "version": "2.7.1",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.1.tgz",
-      "integrity": "sha512-SHiNtMOUGWBQJwzISiVYKu82GiV4QYGePp3odlY1tuKO7gPtphAT5R/py0fA6xtbgLL/RvtJZnU9b8s0F1q0Xg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/schema-utils/-/schema-utils-2.7.1.tgz",
+      "integrity": "sha1-HKTzLRskxZDCA7jnpQvw6kzTlNc=",
       "license": "MIT",
       "dependencies": {
         "@types/json-schema": "^7.0.5",
@@ -6797,8 +6775,8 @@
     },
     "node_modules/babel-plugin-istanbul": {
       "version": "6.1.1",
-      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-6.1.1.tgz",
-      "integrity": "sha512-Y1IQok9821cC9onCx5otgFfRm7Lm+I+wwxOx738M/WLPZ9Q42m4IG5W0FNX8WLL2gYMZo3JkuXIH2DOpWM+qwA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-plugin-istanbul/-/babel-plugin-istanbul-6.1.1.tgz",
+      "integrity": "sha1-+ojsWSMv2bTjbbvFQKjsmptH2nM=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@babel/helper-plugin-utils": "^7.0.0",
@@ -6813,8 +6791,8 @@
     },
     "node_modules/babel-plugin-jest-hoist": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-27.5.1.tgz",
-      "integrity": "sha512-50wCwD5EMNW4aRpOwtqzyZHIewTYNxLA4nhB+09d8BIssfNfzBRhkBIHiaPv1Si226TQSvp8gxAJm2iY2qs2hQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-27.5.1.tgz",
+      "integrity": "sha1-m+mOzyjDMeufXfnHLW+J3rgYHC4=",
       "license": "MIT",
       "dependencies": {
         "@babel/template": "^7.3.3",
@@ -6828,8 +6806,8 @@
     },
     "node_modules/babel-plugin-macros": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/babel-plugin-macros/-/babel-plugin-macros-3.1.0.tgz",
-      "integrity": "sha512-Cg7TFGpIr01vOQNODXOOaGz2NpCU5gl8x1qJFbb6hbZxR7XrcE2vtbAsTAbJ7/xwJtUuJEw8K8Zr/AE0LHlesg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-plugin-macros/-/babel-plugin-macros-3.1.0.tgz",
+      "integrity": "sha1-nvbcdN65NLTbNE3Jc+6FHRSMUME=",
       "license": "MIT",
       "dependencies": {
         "@babel/runtime": "^7.12.5",
@@ -6843,8 +6821,8 @@
     },
     "node_modules/babel-plugin-named-asset-import": {
       "version": "0.3.8",
-      "resolved": "https://registry.npmjs.org/babel-plugin-named-asset-import/-/babel-plugin-named-asset-import-0.3.8.tgz",
-      "integrity": "sha512-WXiAc++qo7XcJ1ZnTYGtLxmBCVbddAml3CEXgWaBzNzLNoxtQ8AiGEFDMOhot9XjTCQbvP5E77Fj9Gk924f00Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-plugin-named-asset-import/-/babel-plugin-named-asset-import-0.3.8.tgz",
+      "integrity": "sha1-a3+kPFkiloU2hoPCi8lzTyRSTMI=",
       "license": "MIT",
       "peerDependencies": {
         "@babel/core": "^7.1.0"
@@ -6852,8 +6830,8 @@
     },
     "node_modules/babel-plugin-polyfill-corejs2": {
       "version": "0.4.17",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.4.17.tgz",
-      "integrity": "sha512-aTyf30K/rqAsNwN76zYrdtx8obu0E4KoUME29B1xj+B3WxgvWkp943vYQ+z8Mv3lw9xHXMHpvSPOBxzAkIa94w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-plugin-polyfill-corejs2/-/babel-plugin-polyfill-corejs2-0.4.17.tgz",
+      "integrity": "sha1-GY+XDxyZqFa0ZtEYfojOML0ZnZE=",
       "license": "MIT",
       "dependencies": {
         "@babel/compat-data": "^7.28.6",
@@ -6866,8 +6844,8 @@
     },
     "node_modules/babel-plugin-polyfill-corejs2/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -6875,8 +6853,8 @@
     },
     "node_modules/babel-plugin-polyfill-corejs3": {
       "version": "0.14.2",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.14.2.tgz",
-      "integrity": "sha512-coWpDLJ410R781Npmn/SIBZEsAetR4xVi0SxLMXPaMO4lSf1MwnkGYMtkFxew0Dn8B3/CpbpYxN0JCgg8mn67g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-plugin-polyfill-corejs3/-/babel-plugin-polyfill-corejs3-0.14.2.tgz",
+      "integrity": "sha1-asCNLzEq/7cMTGnA+7pMtBfuVYc=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-define-polyfill-provider": "^0.6.8",
@@ -6888,8 +6866,8 @@
     },
     "node_modules/babel-plugin-polyfill-regenerator": {
       "version": "0.6.8",
-      "resolved": "https://registry.npmjs.org/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.6.8.tgz",
-      "integrity": "sha512-M762rNHfSF1EV3SLtnCJXFoQbbIIz0OyRwnCmV0KPC7qosSfCO0QLTSuJX3ayAebubhE6oYBAYPrBA5ljowaZg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-plugin-polyfill-regenerator/-/babel-plugin-polyfill-regenerator-0.6.8.tgz",
+      "integrity": "sha1-imv9XdVCOTYrPQbOR6xSstlddyE=",
       "license": "MIT",
       "dependencies": {
         "@babel/helper-define-polyfill-provider": "^0.6.8"
@@ -6900,14 +6878,14 @@
     },
     "node_modules/babel-plugin-transform-react-remove-prop-types": {
       "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/babel-plugin-transform-react-remove-prop-types/-/babel-plugin-transform-react-remove-prop-types-0.4.24.tgz",
-      "integrity": "sha512-eqj0hVcJUR57/Ug2zE1Yswsw4LhuqqHhD+8v120T1cl3kjg76QwtyBrdIk4WVwK+lAhBJVYCd/v+4nc4y+8JsA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-plugin-transform-react-remove-prop-types/-/babel-plugin-transform-react-remove-prop-types-0.4.24.tgz",
+      "integrity": "sha1-8u2vm0xqX75cHWeL+1MQeMFVXzo=",
       "license": "MIT"
     },
     "node_modules/babel-preset-current-node-syntax": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.2.0.tgz",
-      "integrity": "sha512-E/VlAEzRrsLEb2+dv8yp3bo4scof3l9nR4lrld+Iy5NyVqgVYUJnDAmunkhPMisRI32Qc4iRiz425d8vM++2fg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-preset-current-node-syntax/-/babel-preset-current-node-syntax-1.2.0.tgz",
+      "integrity": "sha1-IHMNbNx92l2JQByrEKxqMgZ6zeY=",
       "license": "MIT",
       "dependencies": {
         "@babel/plugin-syntax-async-generators": "^7.8.4",
@@ -6932,8 +6910,8 @@
     },
     "node_modules/babel-preset-jest": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-27.5.1.tgz",
-      "integrity": "sha512-Nptf2FzlPCWYuJg41HBqXVT8ym6bXOevuCTbhxlUpjwtysGaIWFvDEjp4y+G7fl13FgOdjs7P/DmErqH7da0Ag==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-preset-jest/-/babel-preset-jest-27.5.1.tgz",
+      "integrity": "sha1-kfEPWANMt5ictPlitp+m7vamvIE=",
       "license": "MIT",
       "dependencies": {
         "babel-plugin-jest-hoist": "^27.5.1",
@@ -6948,8 +6926,8 @@
     },
     "node_modules/babel-preset-react-app": {
       "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/babel-preset-react-app/-/babel-preset-react-app-10.1.0.tgz",
-      "integrity": "sha512-f9B1xMdnkCIqe+2dHrJsoQFRz7reChaAHE/65SdaykPklQqhme2WaC08oD3is77x9ff98/9EazAKFDZv5rFEQg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/babel-preset-react-app/-/babel-preset-react-app-10.1.0.tgz",
+      "integrity": "sha1-42fyI/bCeHjmzChHHQ1Qapq5+Ww=",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.16.0",
@@ -6973,8 +6951,8 @@
     },
     "node_modules/babel-preset-react-app/node_modules/@babel/plugin-proposal-private-property-in-object": {
       "version": "7.21.11",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.21.11.tgz",
-      "integrity": "sha512-0QZ8qP/3RLDVBwBFoWAwCtgcDZJVwA5LUJRZU8x2YFfKNuFq161wK3cuGrALu5yiPu+vzwTAg/sMWVNeWeNyaw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@babel/plugin-proposal-private-property-in-object/-/plugin-proposal-private-property-in-object-7.21.11.tgz",
+      "integrity": "sha1-adWXCGtnYMQSZSXPoVTzRjH/Jyw=",
       "deprecated": "This proposal has been merged to the ECMAScript standard and thus this plugin is no longer maintained. Please use @babel/plugin-transform-private-property-in-object instead.",
       "license": "MIT",
       "dependencies": {
@@ -6992,14 +6970,14 @@
     },
     "node_modules/balanced-match": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha1-6D46fj8wCzTLnYf2FfoMvzV2kO4=",
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.11.11",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.11.tgz",
-      "integrity": "sha512-/yImnXwyTvgMkhgekLHok/Rx5vO6E0BmStWlSqKWMVm2a2ITuZ1Tn+9bgLS+gZRdZmWtd8nxuhHpdmCUOWsTQQ==",
+      "version": "2.11.13",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/baseline-browser-mapping/-/baseline-browser-mapping-2.11.13.tgz",
+      "integrity": "sha1-ZgBzEDwb7pPlTfVfEXt1KK32rxk=",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -7010,14 +6988,14 @@
     },
     "node_modules/batch": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/batch/-/batch-0.6.1.tgz",
-      "integrity": "sha512-x+VAiMRL6UPkx+kudNvxTl6hB2XNNCG2r+7wixVfIYwu/2HKRXimwQyaumLjMveWvT2Hkd/cAJw+QBMfJ/EKVw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/batch/-/batch-0.6.1.tgz",
+      "integrity": "sha1-3DQxT05nkxgJP8dgJyUl+UvyXBY=",
       "license": "MIT"
     },
     "node_modules/bfj": {
       "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/bfj/-/bfj-7.1.0.tgz",
-      "integrity": "sha512-I6MMLkn+anzNdCUp9hMRyui1HaNEUCco50lxbvNS4+EyXg8lN3nJ48PjPWtbH8UVS9CuMoaKE9U2V3l29DaRQw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/bfj/-/bfj-7.1.0.tgz",
+      "integrity": "sha1-xRd9UiED+QQOGxKYD+jDjPQdP4s=",
       "license": "MIT",
       "dependencies": {
         "bluebird": "^3.7.2",
@@ -7032,8 +7010,8 @@
     },
     "node_modules/big.js": {
       "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/big.js/-/big.js-5.2.2.tgz",
-      "integrity": "sha512-vyL2OymJxmarO8gxMr0mhChsO9QGwhynfuu4+MHTAW6czfq9humCB7rKpUjDd9YUiDPU4mzpyupFSvOClAwbmQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/big.js/-/big.js-5.2.2.tgz",
+      "integrity": "sha1-ZfCvOC9Xi83HQr2cKB6cstd2gyg=",
       "license": "MIT",
       "engines": {
         "node": "*"
@@ -7041,8 +7019,8 @@
     },
     "node_modules/binary-extensions": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.3.0.tgz",
-      "integrity": "sha512-Ceh+7ox5qe7LJuLHoY0feh3pHuUDHAcRUeyL2VYghZwfpkNIy/+8Ocg0a3UuSoYzavmylwuLWQOf3hl0jjMMIw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/binary-extensions/-/binary-extensions-2.3.0.tgz",
+      "integrity": "sha1-9uFKl4WNMnJSIAJC1Mz+UixEVSI=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7053,14 +7031,14 @@
     },
     "node_modules/bluebird": {
       "version": "3.7.2",
-      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
-      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/bluebird/-/bluebird-3.7.2.tgz",
+      "integrity": "sha1-nyKcFb4nJFT/qXOs4NvueaGww28=",
       "license": "MIT"
     },
     "node_modules/body-parser": {
       "version": "1.20.6",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.6.tgz",
-      "integrity": "sha512-p5tAzS57i5MV9fZFDj9LeIiTZEufbSe2eDozP+ElheSUq1m74CRq1jI4mYNDdVs9vQztXFLuk/Gd6BWTdwRJ5g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/body-parser/-/body-parser-1.20.6.tgz",
+      "integrity": "sha1-YMeJx44JktkG2gop1xrgHRXB7XY=",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",
@@ -7083,8 +7061,8 @@
     },
     "node_modules/body-parser/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha1-XRKFFd8TT/Mn6QpMk/Tgd6U2NB8=",
       "license": "MIT",
       "dependencies": {
         "ms": "2.0.0"
@@ -7092,8 +7070,8 @@
     },
     "node_modules/body-parser/node_modules/iconv-lite": {
       "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha1-ICK0sl+93CHS9SSXSkdKr+czkIs=",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3"
@@ -7104,14 +7082,14 @@
     },
     "node_modules/body-parser/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
       "license": "MIT"
     },
     "node_modules/bonjour-service": {
       "version": "1.4.4",
-      "resolved": "https://registry.npmjs.org/bonjour-service/-/bonjour-service-1.4.4.tgz",
-      "integrity": "sha512-jCZcVv7eoc4QesRscwEZtSROBen+6LpKAmBIsQYQrsAeVHLyMXWX/t6eIV5KiRZYNUBl8eVqImEEMQ8L5+c/Kw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/bonjour-service/-/bonjour-service-1.4.4.tgz",
+      "integrity": "sha1-j/W4X6BkHgmWv0C89h/AxnJ7ZtM=",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
@@ -7120,14 +7098,14 @@
     },
     "node_modules/boolbase": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
-      "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/boolbase/-/boolbase-1.0.0.tgz",
+      "integrity": "sha1-aN/1++YMUes3cl6p4+0xDcwed24=",
       "license": "ISC"
     },
     "node_modules/brace-expansion": {
       "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha1-POdNiYhRNr4VNTQfjD1EJcKaXKs=",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -7136,8 +7114,8 @@
     },
     "node_modules/braces": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
-      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha1-SQMy9AkZRSJy1VqEgK3AxEE1h4k=",
       "license": "MIT",
       "dependencies": {
         "fill-range": "^7.1.1"
@@ -7148,14 +7126,14 @@
     },
     "node_modules/browser-process-hrtime": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/browser-process-hrtime/-/browser-process-hrtime-1.0.0.tgz",
-      "integrity": "sha512-9o5UecI3GhkpM6DrXr69PblIuWxPKk9Y0jHBRhdocZ2y7YECBFCsHm79Pr3OyR2AvjhDkabFJaDJMYRazHgsow==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/browser-process-hrtime/-/browser-process-hrtime-1.0.0.tgz",
+      "integrity": "sha1-PJtLfXgsgSHlbxAQbYTA0P/JRiY=",
       "license": "BSD-2-Clause"
     },
     "node_modules/browserslist": {
-      "version": "4.28.7",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.7.tgz",
-      "integrity": "sha512-JxV13hNrFxqjOc8alRbq9dK1MM79NEXYpma2B2J4wAtpWS5zIEIKqWPGCl7N4o7Uc7B7itylh7SuDujATRyyTw==",
+      "version": "4.28.8",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha1-o8ec63AChSfl2n2vyIfzIAtRaMA=",
       "funding": [
         {
           "type": "opencollective",
@@ -7172,11 +7150,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.44",
-        "caniuse-lite": "^1.0.30001806",
-        "electron-to-chromium": "^1.5.393",
-        "node-releases": "^2.0.51",
-        "update-browserslist-db": "^1.2.3"
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -7187,8 +7165,8 @@
     },
     "node_modules/bser": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz",
-      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/bser/-/bser-2.1.1.tgz",
+      "integrity": "sha1-5nh9og7OnQeZhTPP2d5vXDj0vAU=",
       "license": "Apache-2.0",
       "dependencies": {
         "node-int64": "^0.4.0"
@@ -7196,14 +7174,14 @@
     },
     "node_modules/buffer-from": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha1-KxRqb9cugLT1XSVfNe1Zo6mkG9U=",
       "license": "MIT"
     },
     "node_modules/builtin-modules": {
       "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/builtin-modules/-/builtin-modules-3.3.0.tgz",
-      "integrity": "sha512-zhaCDicdLuWN5UbN5IMnFqNMhNfo919sH85y2/ea+5Yg9TsTkeZxpL+JLbp6cgYFS4sRLp3YV4S6yDuqVWHYOw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/builtin-modules/-/builtin-modules-3.3.0.tgz",
+      "integrity": "sha1-yuYoEriYAellYzbkYiPgMDhr57Y=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -7214,8 +7192,8 @@
     },
     "node_modules/bytes": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha1-iwvuuYYFrfGxKPpDhkA8AJ4CIaU=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -7223,8 +7201,8 @@
     },
     "node_modules/call-bind": {
       "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/call-bind/-/call-bind-1.0.9.tgz",
-      "integrity": "sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/call-bind/-/call-bind-1.0.9.tgz",
+      "integrity": "sha1-OaZEcAyAvH0MqRAvxtHUOy/X7uc=",
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.2",
@@ -7241,8 +7219,8 @@
     },
     "node_modules/call-bind-apply-helpers": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha1-S1QowiK+mF15w9gmV0edvgtZstY=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -7254,8 +7232,8 @@
     },
     "node_modules/call-bound": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
-      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha1-I43pNdKippKSjFOMfM+pEGf9Bio=",
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.2",
@@ -7270,8 +7248,8 @@
     },
     "node_modules/callsites": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
-      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha1-s2MKvYlDQy9Us/BRkjjjPNffL3M=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -7279,8 +7257,8 @@
     },
     "node_modules/camel-case": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/camel-case/-/camel-case-4.1.2.tgz",
-      "integrity": "sha512-gxGWBrTT1JuMx6R+o5PTXMmUnhnVzLQ9SNutD4YqKtI6ap897t3tKECYla6gCWEkplXnlNybEkZg9GEGxKFCgw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/camel-case/-/camel-case-4.1.2.tgz",
+      "integrity": "sha1-lygHKpVPgFIoIlpt7qazhGHhvVo=",
       "license": "MIT",
       "dependencies": {
         "pascal-case": "^3.1.2",
@@ -7289,8 +7267,8 @@
     },
     "node_modules/camelcase": {
       "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
-      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/camelcase/-/camelcase-6.3.0.tgz",
+      "integrity": "sha1-VoW5XrIJrJwMF3Rnd4ychN9Yupo=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -7301,8 +7279,8 @@
     },
     "node_modules/camelcase-css": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/camelcase-css/-/camelcase-css-2.0.1.tgz",
-      "integrity": "sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/camelcase-css/-/camelcase-css-2.0.1.tgz",
+      "integrity": "sha1-7pePaUeRTMMMa0R0G27R338EP9U=",
       "license": "MIT",
       "engines": {
         "node": ">= 6"
@@ -7310,8 +7288,8 @@
     },
     "node_modules/caniuse-api": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/caniuse-api/-/caniuse-api-3.0.0.tgz",
-      "integrity": "sha512-bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/caniuse-api/-/caniuse-api-3.0.0.tgz",
+      "integrity": "sha1-Xk2Q4idJYdRikZl99Znj7QCO5MA=",
       "license": "MIT",
       "dependencies": {
         "browserslist": "^4.0.0",
@@ -7321,9 +7299,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001806",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001806.tgz",
-      "integrity": "sha512-72Cuvd95zbSYPKq6Fhg8eDJRlzgWDf7/mtoZv6Qe/DYNCEBdNxoA3+rZAU2ZhGCpZlns3EssFavaZomckT5Uuw==",
+      "version": "1.0.30001809",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/caniuse-lite/-/caniuse-lite-1.0.30001809.tgz",
+      "integrity": "sha1-5s9x8U3f4AjxFN0qhGkjvjwDoHs=",
       "funding": [
         {
           "type": "opencollective",
@@ -7342,8 +7320,8 @@
     },
     "node_modules/case-sensitive-paths-webpack-plugin": {
       "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/case-sensitive-paths-webpack-plugin/-/case-sensitive-paths-webpack-plugin-2.4.0.tgz",
-      "integrity": "sha512-roIFONhcxog0JSSWbvVAh3OocukmSgpqOH6YpMkCvav/ySIV3JKg4Dc8vYtQjYi/UxpNE36r/9v+VqTQqgkYmw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/case-sensitive-paths-webpack-plugin/-/case-sensitive-paths-webpack-plugin-2.4.0.tgz",
+      "integrity": "sha1-22QGbGQi7tLgjMFLmGykN5bbxtQ=",
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -7351,8 +7329,8 @@
     },
     "node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha1-qsTit3NKdAhnrrFr8CqtVWoeegE=",
       "license": "MIT",
       "dependencies": {
         "ansi-styles": "^4.1.0",
@@ -7367,8 +7345,8 @@
     },
     "node_modules/char-regex": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-1.0.2.tgz",
-      "integrity": "sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/char-regex/-/char-regex-1.0.2.tgz",
+      "integrity": "sha1-10Q1giYhf5ge1Y9Hmx1rzClUXc8=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -7376,8 +7354,8 @@
     },
     "node_modules/chart.js": {
       "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/chart.js/-/chart.js-4.5.1.tgz",
-      "integrity": "sha512-GIjfiT9dbmHRiYi6Nl2yFCq7kkwdkp1W/lp2J99rX0yo9tgJGn3lKQATztIjb5tVtevcBtIdICNWqlq5+E8/Pw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/chart.js/-/chart.js-4.5.1.tgz",
+      "integrity": "sha1-Gd0amjhqP2OXaRZyIxy1/JwFLDU=",
       "license": "MIT",
       "dependencies": {
         "@kurkle/color": "^0.3.0"
@@ -7388,14 +7366,14 @@
     },
     "node_modules/check-types": {
       "version": "11.2.3",
-      "resolved": "https://registry.npmjs.org/check-types/-/check-types-11.2.3.tgz",
-      "integrity": "sha512-+67P1GkJRaxQD6PKK0Et9DhwQB+vGg3PM5+aavopCpZT1lj9jeqfvpgTLAWErNj8qApkkmXlu/Ug74kmhagkXg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/check-types/-/check-types-11.2.3.tgz",
+      "integrity": "sha1-H/32j6rk6UH84lKECxeHuO3JO3E=",
       "license": "MIT"
     },
     "node_modules/chokidar": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.6.0.tgz",
-      "integrity": "sha512-7VT13fmjotKpGipCW9JEQAusEPE+Ei8nl6/g4FBAmIm0GOOLMua9NDDo/DWp0ZAxCr3cPq5ZpBqmPAQgDda2Pw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/chokidar/-/chokidar-3.6.0.tgz",
+      "integrity": "sha1-GXxsxmnvKo3F57TZfuTgksPrDVs=",
       "license": "MIT",
       "dependencies": {
         "anymatch": "~3.1.2",
@@ -7418,8 +7396,8 @@
     },
     "node_modules/chokidar/node_modules/glob-parent": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha1-hpgyxYA0/mikCTwX3BXoNA2EAcQ=",
       "license": "ISC",
       "dependencies": {
         "is-glob": "^4.0.1"
@@ -7430,8 +7408,8 @@
     },
     "node_modules/chrome-trace-event": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.4.tgz",
-      "integrity": "sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/chrome-trace-event/-/chrome-trace-event-1.0.4.tgz",
+      "integrity": "sha1-Bb/9f/koRlCTMUcIyTvfqb0fD1s=",
       "license": "MIT",
       "engines": {
         "node": ">=6.0"
@@ -7439,8 +7417,8 @@
     },
     "node_modules/ci-info": {
       "version": "3.9.0",
-      "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
-      "integrity": "sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ci-info/-/ci-info-3.9.0.tgz",
+      "integrity": "sha1-QnmmICinsfJi80c/yWBfXiGMWbQ=",
       "funding": [
         {
           "type": "github",
@@ -7454,14 +7432,14 @@
     },
     "node_modules/cjs-module-lexer": {
       "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-1.4.3.tgz",
-      "integrity": "sha512-9z8TZaGM1pfswYeXrUpzPrkx8UnWYdhJclsiYMm6x/w5+nN+8Tf/LnAgfLGQCm59qAOxU8WwHEq2vNwF6i4j+Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cjs-module-lexer/-/cjs-module-lexer-1.4.3.tgz",
+      "integrity": "sha1-D3lzHrjP4exyrNQGbvrJ1hmRsA0=",
       "license": "MIT"
     },
     "node_modules/clean-css": {
       "version": "5.3.3",
-      "resolved": "https://registry.npmjs.org/clean-css/-/clean-css-5.3.3.tgz",
-      "integrity": "sha512-D5J+kHaVb/wKSFcyyV75uCn8fiY4sV38XJoe4CUyGQ+mOU/fMVYUdH1hJC+CJQ5uY3EnW27SbJYS4X8BiLrAFg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/clean-css/-/clean-css-5.3.3.tgz",
+      "integrity": "sha1-szBlPNO9a3UAnMJccUyue5M1HM0=",
       "license": "MIT",
       "dependencies": {
         "source-map": "~0.6.0"
@@ -7472,8 +7450,8 @@
     },
     "node_modules/clean-css/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -7481,8 +7459,8 @@
     },
     "node_modules/cliui": {
       "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/cliui/-/cliui-7.0.4.tgz",
-      "integrity": "sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cliui/-/cliui-7.0.4.tgz",
+      "integrity": "sha1-oCZe5lVHb8gHrqnfPfjfd4OAi08=",
       "license": "ISC",
       "dependencies": {
         "string-width": "^4.2.0",
@@ -7492,8 +7470,8 @@
     },
     "node_modules/clsx": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
-      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/clsx/-/clsx-2.1.1.tgz",
+      "integrity": "sha1-7tOXyf2L2IK/sY3qtxAgSaLzKZk=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -7501,8 +7479,8 @@
     },
     "node_modules/co": {
       "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/co/-/co-4.6.0.tgz",
-      "integrity": "sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/co/-/co-4.6.0.tgz",
+      "integrity": "sha1-bqa989hTrlTMuOR7+gvz+QMfsYQ=",
       "license": "MIT",
       "engines": {
         "iojs": ">= 1.0.0",
@@ -7511,14 +7489,14 @@
     },
     "node_modules/collect-v8-coverage": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/collect-v8-coverage/-/collect-v8-coverage-1.0.3.tgz",
-      "integrity": "sha512-1L5aqIkwPfiodaMgQunkF1zRhNqifHBmtbbbxcr6yVxxBnliw4TDOW6NxpO8DJLgJ16OT+Y4ztZqP6p/FtXnAw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/collect-v8-coverage/-/collect-v8-coverage-1.0.3.tgz",
+      "integrity": "sha1-zB8B640CKYy8mkN8dMcKtOUhC4A=",
       "license": "MIT"
     },
     "node_modules/color-convert": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha1-ctOmjVmMm9s68q0ehPIdiWq9TeM=",
       "license": "MIT",
       "dependencies": {
         "color-name": "~1.1.4"
@@ -7529,26 +7507,26 @@
     },
     "node_modules/color-name": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha1-wqCah6y95pVD3m9j+jmVyCbFNqI=",
       "license": "MIT"
     },
     "node_modules/colord": {
       "version": "2.9.3",
-      "resolved": "https://registry.npmjs.org/colord/-/colord-2.9.3.tgz",
-      "integrity": "sha512-jeC1axXpnb0/2nn/Y1LPuLdgXBLH7aDcHu4KEKfqw3CUhX7ZpfBSlPKyqXE6btIgEzfWtrX3/tyBCaCvXvMkOw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/colord/-/colord-2.9.3.tgz",
+      "integrity": "sha1-T4zpGd5Fbx1cHDaMMH/iDz5Z+0M=",
       "license": "MIT"
     },
     "node_modules/colorette": {
       "version": "2.0.20",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
-      "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/colorette/-/colorette-2.0.20.tgz",
+      "integrity": "sha1-nreT5oMwZ/cjWQL807CZF6AAqVo=",
       "license": "MIT"
     },
     "node_modules/combined-stream": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
-      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha1-w9RaizT9cwYxoRCoolIGgrMdWn8=",
       "license": "MIT",
       "dependencies": {
         "delayed-stream": "~1.0.0"
@@ -7559,8 +7537,8 @@
     },
     "node_modules/commander": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-7.2.0.tgz",
-      "integrity": "sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/commander/-/commander-7.2.0.tgz",
+      "integrity": "sha1-o2y1fQtQHOEI5NIFWaFQo5HZerc=",
       "license": "MIT",
       "engines": {
         "node": ">= 10"
@@ -7568,8 +7546,8 @@
     },
     "node_modules/common-tags": {
       "version": "1.8.2",
-      "resolved": "https://registry.npmjs.org/common-tags/-/common-tags-1.8.2.tgz",
-      "integrity": "sha512-gk/Z852D2Wtb//0I+kRFNKKE9dIIVirjoqPoA1wJU+XePVXZfGeBpk45+A1rKO4Q43prqWBNY/MiIeRLbPWUaA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/common-tags/-/common-tags-1.8.2.tgz",
+      "integrity": "sha1-lOuzwHbSYDJ0X9VPrOf2iO9aycY=",
       "license": "MIT",
       "engines": {
         "node": ">=4.0.0"
@@ -7577,14 +7555,14 @@
     },
     "node_modules/commondir": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
-      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/commondir/-/commondir-1.0.1.tgz",
+      "integrity": "sha1-3dgA2gxmEnOTzKWVDqloo6rxJTs=",
       "license": "MIT"
     },
     "node_modules/compressible": {
       "version": "2.0.18",
-      "resolved": "https://registry.npmjs.org/compressible/-/compressible-2.0.18.tgz",
-      "integrity": "sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/compressible/-/compressible-2.0.18.tgz",
+      "integrity": "sha1-r1PMprBw1MPAdQ+9dyhqbXzEb7o=",
       "license": "MIT",
       "dependencies": {
         "mime-db": ">= 1.43.0 < 2"
@@ -7595,8 +7573,8 @@
     },
     "node_modules/compression": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
-      "integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/compression/-/compression-1.8.1.tgz",
+      "integrity": "sha1-SkXZCawWUJGVqaKL2RCUiJwYDXk=",
       "license": "MIT",
       "dependencies": {
         "bytes": "3.1.2",
@@ -7613,8 +7591,8 @@
     },
     "node_modules/compression/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha1-XRKFFd8TT/Mn6QpMk/Tgd6U2NB8=",
       "license": "MIT",
       "dependencies": {
         "ms": "2.0.0"
@@ -7622,26 +7600,26 @@
     },
     "node_modules/compression/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
       "license": "MIT"
     },
     "node_modules/concat-map": {
       "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=",
       "license": "MIT"
     },
     "node_modules/confusing-browser-globals": {
       "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/confusing-browser-globals/-/confusing-browser-globals-1.0.11.tgz",
-      "integrity": "sha512-JsPKdmh8ZkmnHxDk55FZ1TqVLvEQTvoByJZRN9jzI0UjxK/QgAmsphz7PGtqgPieQZ/CQcHWXCR7ATDNhGe+YA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/confusing-browser-globals/-/confusing-browser-globals-1.0.11.tgz",
+      "integrity": "sha1-rkDptXzdORVAiigF69OlWFYI3IE=",
       "license": "MIT"
     },
     "node_modules/connect-history-api-fallback": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/connect-history-api-fallback/-/connect-history-api-fallback-2.0.0.tgz",
-      "integrity": "sha512-U73+6lQFmfiNPrYbXqr6kZ1i1wiRqXnp2nhMsINseWXO8lDau0LGEffJ8kQi4EjLZympVgRdvqjAgiZ1tgzDDA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/connect-history-api-fallback/-/connect-history-api-fallback-2.0.0.tgz",
+      "integrity": "sha1-ZHJkhFJRoNryW5fOh4NMrOD18cg=",
       "license": "MIT",
       "engines": {
         "node": ">=0.8"
@@ -7649,8 +7627,8 @@
     },
     "node_modules/content-disposition": {
       "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
-      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/content-disposition/-/content-disposition-0.5.4.tgz",
+      "integrity": "sha1-i4K076yCUSoCuwsdzsnSxejrW/4=",
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "5.2.1"
@@ -7661,8 +7639,8 @@
     },
     "node_modules/content-type": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha1-i3cxYmVtHRCGeEyPI6VM5tc9eRg=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -7670,14 +7648,14 @@
     },
     "node_modules/convert-source-map": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha1-S1YPZJ/E6RjdCrdc9JYei8iC2Co=",
       "license": "MIT"
     },
     "node_modules/cookie": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
-      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha1-O7m9/II2nbnC9pyTycPOsxDIizw=",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -7689,28 +7667,34 @@
     },
     "node_modules/cookie-signature": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
-      "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cookie-signature/-/cookie-signature-1.0.7.tgz",
+      "integrity": "sha1-q13Xq3V8VOYPN+9lUPSBxCbRBFQ=",
       "license": "MIT"
     },
     "node_modules/core-js": {
-      "version": "3.49.0",
-      "resolved": "https://registry.npmjs.org/core-js/-/core-js-3.49.0.tgz",
-      "integrity": "sha512-es1U2+YTtzpwkxVLwAFdSpaIMyQaq0PBgm3YD1W3Qpsn1NAmO3KSgZfu+oGSWVu6NvLHoHCV/aYcsE5wiB7ALg==",
+      "version": "3.50.0",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/core-js/-/core-js-3.50.0.tgz",
+      "integrity": "sha1-oYZG/LAJdlAYm0UEyAPoh7yuTAo=",
       "hasInstallScript": true,
       "license": "MIT",
+      "engines": {
+        "node": "*"
+      },
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/core-js"
       }
     },
     "node_modules/core-js-compat": {
-      "version": "3.49.0",
-      "resolved": "https://registry.npmjs.org/core-js-compat/-/core-js-compat-3.49.0.tgz",
-      "integrity": "sha512-VQXt1jr9cBz03b331DFDCCP90b3fanciLkgiOoy8SBHy06gNf+vQ1A3WFLqG7I8TipYIKeYK9wxd0tUrvHcOZA==",
+      "version": "3.50.0",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/core-js-compat/-/core-js-compat-3.50.0.tgz",
+      "integrity": "sha1-1ZIsKmkqscumB4ySDnxVZ0Ia4I4=",
       "license": "MIT",
       "dependencies": {
-        "browserslist": "^4.28.1"
+        "browserslist": "^4.28.7"
+      },
+      "engines": {
+        "node": ">=6.4.0"
       },
       "funding": {
         "type": "opencollective",
@@ -7718,11 +7702,14 @@
       }
     },
     "node_modules/core-js-pure": {
-      "version": "3.49.0",
-      "resolved": "https://registry.npmjs.org/core-js-pure/-/core-js-pure-3.49.0.tgz",
-      "integrity": "sha512-XM4RFka59xATyJv/cS3O3Kml72hQXUeGRuuTmMYFxwzc9/7C8OYTaIR/Ji+Yt8DXzsFLNhat15cE/JP15HrCgw==",
+      "version": "3.50.0",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/core-js-pure/-/core-js-pure-3.50.0.tgz",
+      "integrity": "sha1-JjMT6DYGy1JwBYhdpb42wKKPZe8=",
       "hasInstallScript": true,
       "license": "MIT",
+      "engines": {
+        "node": "*"
+      },
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/core-js"
@@ -7730,14 +7717,14 @@
     },
     "node_modules/core-util-is": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
-      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/core-util-is/-/core-util-is-1.0.3.tgz",
+      "integrity": "sha1-pgQtNjTCsn6TKPg3uWX6yDgI24U=",
       "license": "MIT"
     },
     "node_modules/cosmiconfig": {
       "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-7.1.0.tgz",
-      "integrity": "sha512-AdmX6xUzdNASswsFtmwSt7Vj8po9IuqXm0UXz7QKPuEUmPB4XyjGfaAr2PSuELMwkRMVH1EpIkX5bTZGRB3eCA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cosmiconfig/-/cosmiconfig-7.1.0.tgz",
+      "integrity": "sha1-FEO5r6WWtnAILqRsvY9qYrhGNfY=",
       "license": "MIT",
       "dependencies": {
         "@types/parse-json": "^4.0.0",
@@ -7752,8 +7739,8 @@
     },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha1-ilj+ePANzXDDcEUXWd+/rwPo7p8=",
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -7766,8 +7753,8 @@
     },
     "node_modules/crypto-random-string": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/crypto-random-string/-/crypto-random-string-2.0.0.tgz",
-      "integrity": "sha512-v1plID3y9r/lPhviJ1wrXpLeyUIGAZ2SHNYTEapm7/8A9nLPoyvVp3RK/EPFqn5kEznyWgYZNsRtYYIWbuG8KA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/crypto-random-string/-/crypto-random-string-2.0.0.tgz",
+      "integrity": "sha1-7yp6lm7BEIM4g2m6oC6+rSKbMNU=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7775,8 +7762,8 @@
     },
     "node_modules/css-blank-pseudo": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/css-blank-pseudo/-/css-blank-pseudo-3.0.3.tgz",
-      "integrity": "sha512-VS90XWtsHGqoM0t4KpH053c4ehxZ2E6HtGI7x68YFV0pTo/QmkV/YFA+NnlvK8guxZVNWGQhVNJGC39Q8XF4OQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/css-blank-pseudo/-/css-blank-pseudo-3.0.3.tgz",
+      "integrity": "sha1-NlI7AcEqJdgS3zQ6MsMi0qIyRWE=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-selector-parser": "^6.0.9"
@@ -7793,8 +7780,8 @@
     },
     "node_modules/css-declaration-sorter": {
       "version": "6.4.1",
-      "resolved": "https://registry.npmjs.org/css-declaration-sorter/-/css-declaration-sorter-6.4.1.tgz",
-      "integrity": "sha512-rtdthzxKuyq6IzqX6jEcIzQF/YqccluefyCYheovBOLhFT/drQA9zj/UbRAa9J7C0o6EG6u3E6g+vKkay7/k3g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/css-declaration-sorter/-/css-declaration-sorter-6.4.1.tgz",
+      "integrity": "sha1-KL6sfCC61/F3W+OnEp1+rkCaOnE=",
       "license": "ISC",
       "engines": {
         "node": "^10 || ^12 || >=14"
@@ -7805,8 +7792,8 @@
     },
     "node_modules/css-has-pseudo": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/css-has-pseudo/-/css-has-pseudo-3.0.4.tgz",
-      "integrity": "sha512-Vse0xpR1K9MNlp2j5w1pgWIJtm1a8qS0JwS9goFYcImjlHEmywP9VUF05aGBXzGpDJF86QXk4L0ypBmwPhGArw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/css-has-pseudo/-/css-has-pseudo-3.0.4.tgz",
+      "integrity": "sha1-V/a+kcokLVyQIO4+Ubu1uJ/Hr3M=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-selector-parser": "^6.0.9"
@@ -7823,8 +7810,8 @@
     },
     "node_modules/css-loader": {
       "version": "6.11.0",
-      "resolved": "https://registry.npmjs.org/css-loader/-/css-loader-6.11.0.tgz",
-      "integrity": "sha512-CTJ+AEQJjq5NzLga5pE39qdiSV56F8ywCIsqNIRF0r7BDgWsN25aazToqAFg7ZrtA/U016xudB3ffgweORxX7g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/css-loader/-/css-loader-6.11.0.tgz",
+      "integrity": "sha1-M7rjv2Nj0KfCz5AxyWx0T/VNhbo=",
       "license": "MIT",
       "dependencies": {
         "icss-utils": "^5.1.0",
@@ -7858,8 +7845,8 @@
     },
     "node_modules/css-minimizer-webpack-plugin": {
       "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/css-minimizer-webpack-plugin/-/css-minimizer-webpack-plugin-3.4.1.tgz",
-      "integrity": "sha512-1u6D71zeIfgngN2XNRJefc/hY7Ybsxd74Jm4qngIXyUEk7fss3VUzuHxLAq/R8NAba4QU9OUSaMZlbpRc7bM4Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/css-minimizer-webpack-plugin/-/css-minimizer-webpack-plugin-3.4.1.tgz",
+      "integrity": "sha1-q3j3gc7ZGBmS/ntuTzQi52Qph48=",
       "license": "MIT",
       "dependencies": {
         "cssnano": "^5.0.6",
@@ -7896,8 +7883,8 @@
     },
     "node_modules/css-minimizer-webpack-plugin/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -7905,8 +7892,8 @@
     },
     "node_modules/css-prefers-color-scheme": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/css-prefers-color-scheme/-/css-prefers-color-scheme-6.0.3.tgz",
-      "integrity": "sha512-4BqMbZksRkJQx2zAjrokiGMd07RqOa2IxIrrN10lyBe9xhn9DEvjUK79J6jkeiv9D9hQFXKb6g1jwU62jziJZA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/css-prefers-color-scheme/-/css-prefers-color-scheme-6.0.3.tgz",
+      "integrity": "sha1-yooi5ZksEKW50xUVXnyu5iWQM0k=",
       "license": "CC0-1.0",
       "bin": {
         "css-prefers-color-scheme": "dist/cli.cjs"
@@ -7920,8 +7907,8 @@
     },
     "node_modules/css-select": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/css-select/-/css-select-4.3.0.tgz",
-      "integrity": "sha512-wPpOYtnsVontu2mODhA19JrqWxNsfdatRKd64kmpRbQgh1KtItko5sTnEpPdpSaJszTOhEMlF/RPz28qj4HqhQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/css-select/-/css-select-4.3.0.tgz",
+      "integrity": "sha1-23EpsoRmYv2GKM/ElquytZ5BUps=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "boolbase": "^1.0.0",
@@ -7936,8 +7923,8 @@
     },
     "node_modules/css-tree": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/css-tree/-/css-tree-1.1.3.tgz",
-      "integrity": "sha512-tRpdppF7TRazZrjJ6v3stzv93qxRcSsFmW6cX0Zm2NVKpxE1WV1HblnghVv9TreireHkqI/VDEsfolRF1p6y7Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/css-tree/-/css-tree-1.1.3.tgz",
+      "integrity": "sha1-60hw+2/XcHMn7JXC/yqwm16NuR0=",
       "license": "MIT",
       "dependencies": {
         "mdn-data": "2.0.14",
@@ -7949,8 +7936,8 @@
     },
     "node_modules/css-tree/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -7958,8 +7945,8 @@
     },
     "node_modules/css-what": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.2.2.tgz",
-      "integrity": "sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/css-what/-/css-what-6.2.2.tgz",
+      "integrity": "sha1-zcyPm2l3cZ/fvR3nrsJKv3Vrneo=",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">= 6"
@@ -7970,8 +7957,8 @@
     },
     "node_modules/cssdb": {
       "version": "7.11.2",
-      "resolved": "https://registry.npmjs.org/cssdb/-/cssdb-7.11.2.tgz",
-      "integrity": "sha512-lhQ32TFkc1X4eTefGfYPvgovRSzIMofHkigfH8nWtyRL4XJLsRhJFreRvEgKzept7x1rjBuy3J/MurXLaFxW/A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cssdb/-/cssdb-7.11.2.tgz",
+      "integrity": "sha1-EnovW5Ru5lM2Glr1Mz6oWjnfWuU=",
       "funding": [
         {
           "type": "opencollective",
@@ -7986,8 +7973,8 @@
     },
     "node_modules/cssesc": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cssesc/-/cssesc-3.0.0.tgz",
+      "integrity": "sha1-N3QZGZA7hoVl4cCep0dEXNGJg+4=",
       "license": "MIT",
       "bin": {
         "cssesc": "bin/cssesc"
@@ -7998,8 +7985,8 @@
     },
     "node_modules/cssnano": {
       "version": "5.1.15",
-      "resolved": "https://registry.npmjs.org/cssnano/-/cssnano-5.1.15.tgz",
-      "integrity": "sha512-j+BKgDcLDQA+eDifLx0EO4XSA56b7uut3BQFH+wbSaSTuGLuiyTa/wbRYthUXX8LC9mLg+WWKe8h+qJuwTAbHw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cssnano/-/cssnano-5.1.15.tgz",
+      "integrity": "sha1-3tZrVIDVEn/LRNrBLqWpg3VRNr8=",
       "license": "MIT",
       "dependencies": {
         "cssnano-preset-default": "^5.2.14",
@@ -8019,8 +8006,8 @@
     },
     "node_modules/cssnano-preset-default": {
       "version": "5.2.14",
-      "resolved": "https://registry.npmjs.org/cssnano-preset-default/-/cssnano-preset-default-5.2.14.tgz",
-      "integrity": "sha512-t0SFesj/ZV2OTylqQVOrFgEh5uanxbO6ZAdeCrNsUQ6fVuXwYTxJPNAGvGTxHbD68ldIJNec7PyYZDBrfDQ+6A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cssnano-preset-default/-/cssnano-preset-default-5.2.14.tgz",
+      "integrity": "sha1-MJ3vT3t+FtcaskOAUgkzMNmrRdg=",
       "license": "MIT",
       "dependencies": {
         "css-declaration-sorter": "^6.3.1",
@@ -8062,8 +8049,8 @@
     },
     "node_modules/cssnano-utils": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/cssnano-utils/-/cssnano-utils-3.1.0.tgz",
-      "integrity": "sha512-JQNR19/YZhz4psLX/rQ9M83e3z2Wf/HdJbryzte4a3NSuafyp9w/I4U+hx5C2S9g41qlstH7DEWnZaaj83OuEA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cssnano-utils/-/cssnano-utils-3.1.0.tgz",
+      "integrity": "sha1-lWhNCMkVEe38cNJjYzjKN+86aGE=",
       "license": "MIT",
       "engines": {
         "node": "^10 || ^12 || >=14.0"
@@ -8074,8 +8061,8 @@
     },
     "node_modules/csso": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/csso/-/csso-4.2.0.tgz",
-      "integrity": "sha512-wvlcdIbf6pwKEk7vHj8/Bkc0B4ylXZruLvOgs9doS5eOsOpuodOV2zJChSpkp+pRpYQLQMeF04nr3Z68Sta9jA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/csso/-/csso-4.2.0.tgz",
+      "integrity": "sha1-6jpWE0bo3J9UbW/r7dUBh884lSk=",
       "license": "MIT",
       "dependencies": {
         "css-tree": "^1.1.2"
@@ -8086,14 +8073,14 @@
     },
     "node_modules/cssom": {
       "version": "0.4.4",
-      "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.4.4.tgz",
-      "integrity": "sha512-p3pvU7r1MyyqbTk+WbNJIgJjG2VmTIaB10rI93LzVPrmDJKkzKYMtxxyAvQXR/NS6otuzveI7+7BBq3SjBS2mw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cssom/-/cssom-0.4.4.tgz",
+      "integrity": "sha1-WmbPk9LQtmHYC/akT7ZfXC5OChA=",
       "license": "MIT"
     },
     "node_modules/cssstyle": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/cssstyle/-/cssstyle-2.3.0.tgz",
-      "integrity": "sha512-AZL67abkUzIuvcHqk7c09cezpGNcxUxU4Ioi/05xHk4DQeTkWmGYftIE6ctU6AEt+Gn4n1lDStOtj7FKycP71A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cssstyle/-/cssstyle-2.3.0.tgz",
+      "integrity": "sha1-/2ZaDdvcMYZLCWR/NBY0Q9kLCFI=",
       "license": "MIT",
       "dependencies": {
         "cssom": "~0.3.6"
@@ -8104,20 +8091,20 @@
     },
     "node_modules/cssstyle/node_modules/cssom": {
       "version": "0.3.8",
-      "resolved": "https://registry.npmjs.org/cssom/-/cssom-0.3.8.tgz",
-      "integrity": "sha512-b0tGHbfegbhPJpxpiBPU2sCkigAqtM9O121le6bbOlgyV+NyGyCmVfJ6QW9eRjz8CpNfWEOYBIMIGRYkLwsIYg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cssom/-/cssom-0.3.8.tgz",
+      "integrity": "sha1-nxJ29bK0Y/IRTT8sdSUK+MGjb0o=",
       "license": "MIT"
     },
     "node_modules/csstype": {
       "version": "3.2.3",
-      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
-      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/csstype/-/csstype-3.2.3.tgz",
+      "integrity": "sha1-7EjA8+mT5QZIyG2lWeJhCZXPmJo=",
       "license": "MIT"
     },
     "node_modules/d3": {
       "version": "7.9.0",
-      "resolved": "https://registry.npmjs.org/d3/-/d3-7.9.0.tgz",
-      "integrity": "sha512-e1U46jVP+w7Iut8Jt8ri1YsPOvFpg46k+K8TpCb0P+zjCkjkPnV7WzfDJzMHy1LnA+wj5pLT1wjO901gLXeEhA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3/-/d3-7.9.0.tgz",
+      "integrity": "sha1-V556yz10nK+IYL0XQa6NNxBwzV0=",
       "license": "ISC",
       "dependencies": {
         "d3-array": "3",
@@ -8157,8 +8144,8 @@
     },
     "node_modules/d3-array": {
       "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/d3-array/-/d3-array-3.2.4.tgz",
-      "integrity": "sha512-tdQAmyA18i4J7wprpYq8ClcxZy3SC31QMeByyCFyRt7BVHdREQZ5lpzoe5mFEYZUWe+oq8HBvk9JjpibyEV4Jg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-array/-/d3-array-3.2.4.tgz",
+      "integrity": "sha1-Ff7DOyN/l6xdfJhtx32ic6jtC7U=",
       "license": "ISC",
       "dependencies": {
         "internmap": "1 - 2"
@@ -8169,8 +8156,8 @@
     },
     "node_modules/d3-axis": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-axis/-/d3-axis-3.0.0.tgz",
-      "integrity": "sha512-IH5tgjV4jE/GhHkRV0HiVYPDtvfjHQlQfJHs0usq7M30XcSBvOotpmH1IgkcXsO/5gEQZD43B//fc7SRT5S+xw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-axis/-/d3-axis-3.0.0.tgz",
+      "integrity": "sha1-xCpKE+gTHWN7dF/Clzgkz+r5MyI=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8178,8 +8165,8 @@
     },
     "node_modules/d3-brush": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-brush/-/d3-brush-3.0.0.tgz",
-      "integrity": "sha512-ALnjWlVYkXsVIGlOsuWH1+3udkYFI48Ljihfnh8FZPF2QS9o+PzGLBslO0PjzVoHLZ2KCVgAM8NVkXPJB2aNnQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-brush/-/d3-brush-3.0.0.tgz",
+      "integrity": "sha1-b3Z8Ttjct53n7ePhwPieY+9k0xw=",
       "license": "ISC",
       "dependencies": {
         "d3-dispatch": "1 - 3",
@@ -8194,8 +8181,8 @@
     },
     "node_modules/d3-chord": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-chord/-/d3-chord-3.0.1.tgz",
-      "integrity": "sha512-VE5S6TNa+j8msksl7HwjxMHDM2yNK3XCkusIlpX5kwauBfXuyLAtNg9jCp/iHH61tgI4sb6R/EIMWCqEIdjT/g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-chord/-/d3-chord-3.0.1.tgz",
+      "integrity": "sha1-0VbWH0hfzoMn5qvzOctB2Mu6aWY=",
       "license": "ISC",
       "dependencies": {
         "d3-path": "1 - 3"
@@ -8206,8 +8193,8 @@
     },
     "node_modules/d3-color": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-color/-/d3-color-3.1.0.tgz",
-      "integrity": "sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-color/-/d3-color-3.1.0.tgz",
+      "integrity": "sha1-OVsoM9+scVB/EqwvevI7+BneJOI=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8215,8 +8202,8 @@
     },
     "node_modules/d3-contour": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/d3-contour/-/d3-contour-4.0.2.tgz",
-      "integrity": "sha512-4EzFTRIikzs47RGmdxbeUvLWtGedDUNkTcmzoeyg4sP/dvCexO47AaQL7VKy/gul85TOxw+IBgA8US2xwbToNA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-contour/-/d3-contour-4.0.2.tgz",
+      "integrity": "sha1-u5IGO8jFZjrLJCL5nHPLtsauO8w=",
       "license": "ISC",
       "dependencies": {
         "d3-array": "^3.2.0"
@@ -8227,8 +8214,8 @@
     },
     "node_modules/d3-delaunay": {
       "version": "6.0.4",
-      "resolved": "https://registry.npmjs.org/d3-delaunay/-/d3-delaunay-6.0.4.tgz",
-      "integrity": "sha512-mdjtIZ1XLAM8bm/hx3WwjfHt6Sggek7qH043O8KEjDXN40xi3vx/6pYSVTwLjEgiXQTbvaouWKynLBiUZ6SK6A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-delaunay/-/d3-delaunay-6.0.4.tgz",
+      "integrity": "sha1-mBaQOHM6ClurvtpVBU95W7nkpYs=",
       "license": "ISC",
       "dependencies": {
         "delaunator": "5"
@@ -8239,8 +8226,8 @@
     },
     "node_modules/d3-dispatch": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-dispatch/-/d3-dispatch-3.0.1.tgz",
-      "integrity": "sha512-rzUyPU/S7rwUflMyLc1ETDeBj0NRuHKKAcvukozwhshr6g6c5d8zh4c2gQjY2bZ0dXeGLWc1PF174P2tVvKhfg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-dispatch/-/d3-dispatch-3.0.1.tgz",
+      "integrity": "sha1-X8dShOnCN1w2yDlBGgz1UMv8TV4=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8248,8 +8235,8 @@
     },
     "node_modules/d3-drag": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-drag/-/d3-drag-3.0.0.tgz",
-      "integrity": "sha512-pWbUJLdETVA8lQNJecMxoXfH6x+mO2UQo8rSmZ+QqxcbyA3hfeprFgIT//HW2nlHChWeIIMwS2Fq+gEARkhTkg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-drag/-/d3-drag-3.0.0.tgz",
+      "integrity": "sha1-mUqunNI8cZ9TteEOOgphCMaWB7o=",
       "license": "ISC",
       "dependencies": {
         "d3-dispatch": "1 - 3",
@@ -8261,8 +8248,8 @@
     },
     "node_modules/d3-dsv": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-dsv/-/d3-dsv-3.0.1.tgz",
-      "integrity": "sha512-UG6OvdI5afDIFP9w4G0mNq50dSOsXHJaRE8arAS5o9ApWnIElp8GZw1Dun8vP8OyHOZ/QJUKUJwxiiCCnUwm+Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-dsv/-/d3-dsv-3.0.1.tgz",
+      "integrity": "sha1-xjr5ePTWoNCEpSpnOSK+IWB4m3M=",
       "license": "ISC",
       "dependencies": {
         "commander": "7",
@@ -8286,8 +8273,8 @@
     },
     "node_modules/d3-ease": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-ease/-/d3-ease-3.0.1.tgz",
-      "integrity": "sha512-wR/XK3D3XcLIZwpbvQwQ5fK+8Ykds1ip7A2Txe0yxncXSdq1L9skcG7blcedkOX+ZcgxGAmLX1FrRGbADwzi0w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-ease/-/d3-ease-3.0.1.tgz",
+      "integrity": "sha1-llisOKIUDVnTRhYPH2ww/aC9EvQ=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=12"
@@ -8295,8 +8282,8 @@
     },
     "node_modules/d3-fetch": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-fetch/-/d3-fetch-3.0.1.tgz",
-      "integrity": "sha512-kpkQIM20n3oLVBKGg6oHrUchHM3xODkTzjMoj7aWQFq5QEM+R6E4WkzT5+tojDY7yjez8KgCBRoj4aEr99Fdqw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-fetch/-/d3-fetch-3.0.1.tgz",
+      "integrity": "sha1-gxQb/5hWoO21443onNz+Y9CmCiI=",
       "license": "ISC",
       "dependencies": {
         "d3-dsv": "1 - 3"
@@ -8307,8 +8294,8 @@
     },
     "node_modules/d3-force": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-force/-/d3-force-3.0.0.tgz",
-      "integrity": "sha512-zxV/SsA+U4yte8051P4ECydjD/S+qeYtnaIyAs9tgHCqfguma/aAQDjo85A9Z6EKhBirHRJHXIgJUlffT4wdLg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-force/-/d3-force-3.0.0.tgz",
+      "integrity": "sha1-Piuhph5wiI/j2RlOMNbRTuzhVcQ=",
       "license": "ISC",
       "dependencies": {
         "d3-dispatch": "1 - 3",
@@ -8321,8 +8308,8 @@
     },
     "node_modules/d3-format": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/d3-format/-/d3-format-3.1.2.tgz",
-      "integrity": "sha512-AJDdYOdnyRDV5b6ArilzCPPwc1ejkHcoyFarqlPqT7zRYjhavcT3uSrqcMvsgh2CgoPbK3RCwyHaVyxYcP2Arg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-format/-/d3-format-3.1.2.tgz",
+      "integrity": "sha1-Af20a1i+sfVbELQq1wtuNE1esq4=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8330,8 +8317,8 @@
     },
     "node_modules/d3-geo": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/d3-geo/-/d3-geo-3.1.1.tgz",
-      "integrity": "sha512-637ln3gXKXOwhalDzinUgY83KzNWZRKbYubaG+fGVuc/dxO64RRljtCTnf5ecMyE1RIdtqpkVcq0IbtU2S8j2Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-geo/-/d3-geo-3.1.1.tgz",
+      "integrity": "sha1-YCfPUSRvmy69ZPmeAdx8M2QDOk0=",
       "license": "ISC",
       "dependencies": {
         "d3-array": "2.5.0 - 3"
@@ -8342,8 +8329,8 @@
     },
     "node_modules/d3-hierarchy": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/d3-hierarchy/-/d3-hierarchy-3.1.2.tgz",
-      "integrity": "sha512-FX/9frcub54beBdugHjDCdikxThEqjnR93Qt7PvQTOHxyiNCAlvMrHhclk3cD5VeAaq9fxmfRp+CnWw9rEMBuA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-hierarchy/-/d3-hierarchy-3.1.2.tgz",
+      "integrity": "sha1-sBzULB7tPUbbd6WWbPcm+MCRYMY=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8351,8 +8338,8 @@
     },
     "node_modules/d3-interpolate": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
-      "integrity": "sha512-3bYs1rOD33uo8aqJfKP3JWPAibgw8Zm2+L9vBKEHJ2Rg+viTR7o5Mmv5mZcieN+FRYaAOWX5SJATX6k1PWz72g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-interpolate/-/d3-interpolate-3.0.1.tgz",
+      "integrity": "sha1-PEeqWzLFs9+1bvP9Q0IHimMrQA0=",
       "license": "ISC",
       "dependencies": {
         "d3-color": "1 - 3"
@@ -8363,8 +8350,8 @@
     },
     "node_modules/d3-path": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-path/-/d3-path-3.1.0.tgz",
-      "integrity": "sha512-p3KP5HCf/bvjBSSKuXid6Zqijx7wIfNW+J/maPs+iwR35at5JCbLUT0LzF1cnjbCHWhqzQTIN2Jpe8pRebIEFQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-path/-/d3-path-3.1.0.tgz",
+      "integrity": "sha1-It+TkDL7WnGuixgA1h3beFHEJSY=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8372,8 +8359,8 @@
     },
     "node_modules/d3-polygon": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-polygon/-/d3-polygon-3.0.1.tgz",
-      "integrity": "sha512-3vbA7vXYwfe1SYhED++fPUQlWSYTTGmFmQiany/gdbiWgU/iEyQzyymwL9SkJjFFuCS4902BSzewVGsHHmHtXg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-polygon/-/d3-polygon-3.0.1.tgz",
+      "integrity": "sha1-C0XT3RxIopyOBX5hNWk+yAvxY5g=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8381,8 +8368,8 @@
     },
     "node_modules/d3-quadtree": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-quadtree/-/d3-quadtree-3.0.1.tgz",
-      "integrity": "sha512-04xDrxQTDTCFwP5H6hRhsRcb9xxv2RzkcsygFzmkSIOJy3PeRJP7sNk3VRIbKXcog561P9oU0/rVH6vDROAgUw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-quadtree/-/d3-quadtree-3.0.1.tgz",
+      "integrity": "sha1-bco+i+Kzk8mp1RTau9gKkt7vGk8=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8390,8 +8377,8 @@
     },
     "node_modules/d3-random": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-random/-/d3-random-3.0.1.tgz",
-      "integrity": "sha512-FXMe9GfxTxqd5D6jFsQ+DJ8BJS4E/fT5mqqdjovykEB2oFbTMDVdg1MGFxfQW+FBOGoB++k8swBrgwSHT1cUXQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-random/-/d3-random-3.0.1.tgz",
+      "integrity": "sha1-1JJjeNMz2cC/0eb6AZTTCuuqIPQ=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8399,8 +8386,8 @@
     },
     "node_modules/d3-scale": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/d3-scale/-/d3-scale-4.0.2.tgz",
-      "integrity": "sha512-GZW464g1SH7ag3Y7hXjf8RoUuAFIqklOAq3MRl4OaWabTFJY9PN/E1YklhXLh+OQ3fM9yS2nOkCoS+WLZ6kvxQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-scale/-/d3-scale-4.0.2.tgz",
+      "integrity": "sha1-grOOjo/3CAdk+Nzsd71L45Nok5Y=",
       "license": "ISC",
       "dependencies": {
         "d3-array": "2.10.0 - 3",
@@ -8415,8 +8402,8 @@
     },
     "node_modules/d3-scale-chromatic": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-scale-chromatic/-/d3-scale-chromatic-3.1.0.tgz",
-      "integrity": "sha512-A3s5PWiZ9YCXFye1o246KoscMWqf8BsD9eRiJ3He7C9OBaxKhAd5TFCdEx/7VbKtxxTsu//1mMJFrEt572cEyQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-scale-chromatic/-/d3-scale-chromatic-3.1.0.tgz",
+      "integrity": "sha1-NMOdopiyPCDgLxpLI5vQ8i5/ExQ=",
       "license": "ISC",
       "dependencies": {
         "d3-color": "1 - 3",
@@ -8428,8 +8415,8 @@
     },
     "node_modules/d3-selection": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-3.0.0.tgz",
-      "integrity": "sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-selection/-/d3-selection-3.0.0.tgz",
+      "integrity": "sha1-wlM4IH76csxbm9FFihpBkB8eGzE=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8437,8 +8424,8 @@
     },
     "node_modules/d3-shape": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/d3-shape/-/d3-shape-3.2.0.tgz",
-      "integrity": "sha512-SaLBuwGm3MOViRq2ABk3eLoxwZELpH6zhl3FbAoJ7Vm1gofKx6El1Ib5z23NUEhF9AsGl7y+dzLe5Cw2AArGTA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-shape/-/d3-shape-3.2.0.tgz",
+      "integrity": "sha1-oag5y9m6RfKGdMadf4Vbz5HfxqU=",
       "license": "ISC",
       "dependencies": {
         "d3-path": "^3.1.0"
@@ -8449,8 +8436,8 @@
     },
     "node_modules/d3-time": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/d3-time/-/d3-time-3.1.0.tgz",
-      "integrity": "sha512-VqKjzBLejbSMT4IgbmVgDjpkYrNWUYJnbCGo874u7MMKIWsILRX+OpX/gTk8MqjpT1A/c6HY2dCA77ZN0lkQ2Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-time/-/d3-time-3.1.0.tgz",
+      "integrity": "sha1-kxDbVumS48AXXh7zheVF5Iqbtcc=",
       "license": "ISC",
       "dependencies": {
         "d3-array": "2 - 3"
@@ -8461,8 +8448,8 @@
     },
     "node_modules/d3-time-format": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/d3-time-format/-/d3-time-format-4.1.0.tgz",
-      "integrity": "sha512-dJxPBlzC7NugB2PDLwo9Q8JiTR3M3e4/XANkreKSUxF8vvXKqm1Yfq4Q5dl8budlunRVlUUaDUgFt7eA8D6NLg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-time-format/-/d3-time-format-4.1.0.tgz",
+      "integrity": "sha1-erUlelBB0R7LT+cKXH0WoZW7QIo=",
       "license": "ISC",
       "dependencies": {
         "d3-time": "1 - 3"
@@ -8473,8 +8460,8 @@
     },
     "node_modules/d3-timer": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-timer/-/d3-timer-3.0.1.tgz",
-      "integrity": "sha512-ndfJ/JxxMd3nw31uyKoY2naivF+r29V+Lc0svZxe1JvvIRmi8hUsrMvdOwgS1o6uBHmiz91geQ0ylPP0aj1VUA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-timer/-/d3-timer-3.0.1.tgz",
+      "integrity": "sha1-YoTSonCChbGrt+IB7aQ4CvNeY7A=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
@@ -8482,8 +8469,8 @@
     },
     "node_modules/d3-transition": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/d3-transition/-/d3-transition-3.0.1.tgz",
-      "integrity": "sha512-ApKvfjsSR6tg06xrL434C0WydLr7JewBB3V+/39RMHsaXTOG0zmt/OAXeng5M5LBm0ojmxJrpomQVZ1aPvBL4w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-transition/-/d3-transition-3.0.1.tgz",
+      "integrity": "sha1-aGn93hRIhoB3/dWYkgDLYbKhZF8=",
       "license": "ISC",
       "dependencies": {
         "d3-color": "1 - 3",
@@ -8501,8 +8488,8 @@
     },
     "node_modules/d3-zoom": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/d3-zoom/-/d3-zoom-3.0.0.tgz",
-      "integrity": "sha512-b8AmV3kfQaqWAuacbPuNbL6vahnOJflOhexLzMMNLga62+/nh0JzvJ0aO/5a5MVgUFGS7Hu1P9P03o3fJkDCyw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/d3-zoom/-/d3-zoom-3.0.0.tgz",
+      "integrity": "sha1-0T9BZccyF//qpUKVzWlps+eu6PM=",
       "license": "ISC",
       "dependencies": {
         "d3-dispatch": "1 - 3",
@@ -8517,14 +8504,14 @@
     },
     "node_modules/damerau-levenshtein": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/damerau-levenshtein/-/damerau-levenshtein-1.0.8.tgz",
-      "integrity": "sha512-sdQSFB7+llfUcQHUQO3+B8ERRj0Oa4w9POWMI/puGtuf7gFywGmkaLCElnudfTiKZV+NvHqL0ifzdrI8Ro7ESA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/damerau-levenshtein/-/damerau-levenshtein-1.0.8.tgz",
+      "integrity": "sha1-tD0obMvTa8Wy9+1ByvLQq6H4puc=",
       "license": "BSD-2-Clause"
     },
     "node_modules/data-urls": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/data-urls/-/data-urls-2.0.0.tgz",
-      "integrity": "sha512-X5eWTSXO/BJmpdIKCRuKUgSCgAN0OwliVK3yPKbwIWU1Tdw5BRajxlzMidvh+gwko9AfQ9zIj52pzF91Q3YAvQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/data-urls/-/data-urls-2.0.0.tgz",
+      "integrity": "sha1-FWSFpyljqXD11YIar2Qr7yvy25s=",
       "license": "MIT",
       "dependencies": {
         "abab": "^2.0.3",
@@ -8537,8 +8524,8 @@
     },
     "node_modules/data-view-buffer": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/data-view-buffer/-/data-view-buffer-1.0.2.tgz",
-      "integrity": "sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/data-view-buffer/-/data-view-buffer-1.0.2.tgz",
+      "integrity": "sha1-IRoDupXsr3eYqMcZjXlTYhH4hXA=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -8554,8 +8541,8 @@
     },
     "node_modules/data-view-byte-length": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/data-view-byte-length/-/data-view-byte-length-1.0.2.tgz",
-      "integrity": "sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/data-view-byte-length/-/data-view-byte-length-1.0.2.tgz",
+      "integrity": "sha1-noD3ylJFPOPpPSWjUxh2fqdwRzU=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -8571,8 +8558,8 @@
     },
     "node_modules/data-view-byte-offset": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/data-view-byte-offset/-/data-view-byte-offset-1.0.1.tgz",
-      "integrity": "sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/data-view-byte-offset/-/data-view-byte-offset-1.0.1.tgz",
+      "integrity": "sha1-BoMH+bcat2274QKROJ4CCFZgYZE=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -8588,8 +8575,8 @@
     },
     "node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha1-xq5DLZvZZiWC/OCHCbA4xY6ePWo=",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -8605,32 +8592,32 @@
     },
     "node_modules/decimal.js": {
       "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/decimal.js/-/decimal.js-10.6.0.tgz",
-      "integrity": "sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/decimal.js/-/decimal.js-10.6.0.tgz",
+      "integrity": "sha1-5kmkPjq5U6chkv9Zg4ZeUJ837Zo=",
       "license": "MIT"
     },
     "node_modules/decimal.js-light": {
       "version": "2.5.1",
-      "resolved": "https://registry.npmjs.org/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
-      "integrity": "sha512-qIMFpTMZmny+MMIitAB6D7iVPEorVw6YQRWkvarTkT4tBeSLLiHzcwj6q0MmYSFCiVpiqPJTJEYIrpcPzVEIvg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/decimal.js-light/-/decimal.js-light-2.5.1.tgz",
+      "integrity": "sha1-E0/TJQjxniCPT7L42sDSYmqGeTQ=",
       "license": "MIT"
     },
     "node_modules/dedent": {
       "version": "0.7.0",
-      "resolved": "https://registry.npmjs.org/dedent/-/dedent-0.7.0.tgz",
-      "integrity": "sha512-Q6fKUPqnAHAyhiUgFU7BUzLiv0kd8saH9al7tnu5Q/okj6dnupxyTgFIBjVzJATdfIAm9NAsvXNzjaKa+bxVyA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dedent/-/dedent-0.7.0.tgz",
+      "integrity": "sha1-JJXduvbrh0q7Dhvp3yLS5aVEMmw=",
       "license": "MIT"
     },
     "node_modules/deep-is": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha1-pvLc5hL63S7x9Rm3NVHxfoUZmDE=",
       "license": "MIT"
     },
     "node_modules/deepmerge": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
-      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/deepmerge/-/deepmerge-4.3.1.tgz",
+      "integrity": "sha1-RLXyFHzTsA1LVhN2hZZvJv0l3Uo=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -8638,8 +8625,8 @@
     },
     "node_modules/default-gateway": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/default-gateway/-/default-gateway-6.0.3.tgz",
-      "integrity": "sha512-fwSOJsbbNzZ/CUFpqFBqYfYNLj1NbMPm8MMCIzHjC83iSJRBEGmDUxU+WP661BaBQImeC2yHwXtz+P/O9o+XEg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/default-gateway/-/default-gateway-6.0.3.tgz",
+      "integrity": "sha1-gZSUyIgFO9t0PtvzQ9bN9/KUOnE=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "execa": "^5.0.0"
@@ -8650,8 +8637,8 @@
     },
     "node_modules/define-data-property": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/define-data-property/-/define-data-property-1.1.4.tgz",
-      "integrity": "sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/define-data-property/-/define-data-property-1.1.4.tgz",
+      "integrity": "sha1-iU3BQbt9MGCuQ2b2oBB+aPvkjF4=",
       "license": "MIT",
       "dependencies": {
         "es-define-property": "^1.0.0",
@@ -8667,8 +8654,8 @@
     },
     "node_modules/define-lazy-prop": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-2.0.0.tgz",
-      "integrity": "sha512-Ds09qNh8yw3khSjiJjiUInaGX9xlqZDY7JVryGxdxV7NPeuqQfplOpQ66yJFZut3jLa5zOwkXw1g9EI2uKh4Og==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/define-lazy-prop/-/define-lazy-prop-2.0.0.tgz",
+      "integrity": "sha1-P3rkIRKbyqrJvHSQXJigAJ7J7n8=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8676,8 +8663,8 @@
     },
     "node_modules/define-properties": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/define-properties/-/define-properties-1.2.1.tgz",
-      "integrity": "sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/define-properties/-/define-properties-1.2.1.tgz",
+      "integrity": "sha1-EHgcxhbrlRqAoDS6/Kpzd/avK2w=",
       "license": "MIT",
       "dependencies": {
         "define-data-property": "^1.0.1",
@@ -8693,8 +8680,8 @@
     },
     "node_modules/delaunator": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/delaunator/-/delaunator-5.1.0.tgz",
-      "integrity": "sha512-AGrQ4QSgssa1NGmWmLPqN5NY2KajF5MqxetNEO+o0n3ZwZZeTmt7bBnvzHWrmkZFxGgr4HdyFgelzgi06otLuQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/delaunator/-/delaunator-5.1.0.tgz",
+      "integrity": "sha1-0TJx+/Ov9nU/nqbiNVV/IJAQRuo=",
       "license": "ISC",
       "dependencies": {
         "robust-predicates": "^3.0.2"
@@ -8702,8 +8689,8 @@
     },
     "node_modules/delayed-stream": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
-      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha1-3zrhmayt+31ECqrgsp4icrJOxhk=",
       "license": "MIT",
       "engines": {
         "node": ">=0.4.0"
@@ -8711,8 +8698,8 @@
     },
     "node_modules/depd": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
-      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha1-tpYWPMdXVg0JzyLMj60Vcbeedt8=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -8720,8 +8707,8 @@
     },
     "node_modules/destroy": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
-      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/destroy/-/destroy-1.2.0.tgz",
+      "integrity": "sha1-SANzVQmti+VSk0xn32FPlOZvoBU=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8",
@@ -8730,8 +8717,8 @@
     },
     "node_modules/detect-newline": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
-      "integrity": "sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/detect-newline/-/detect-newline-3.1.0.tgz",
+      "integrity": "sha1-V29d/GOuGhkv8ZLYrTr2MImRtlE=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -8739,14 +8726,14 @@
     },
     "node_modules/detect-node": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
-      "integrity": "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/detect-node/-/detect-node-2.1.0.tgz",
+      "integrity": "sha1-yccHdaScPQO8LAbZpzvlUPl4+LE=",
       "license": "MIT"
     },
     "node_modules/detect-port-alt": {
       "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/detect-port-alt/-/detect-port-alt-1.1.6.tgz",
-      "integrity": "sha512-5tQykt+LqfJFBEYaDITx7S7cR7mJ/zQmLXZ2qt5w04ainYZw6tBf9dBunMjVeVOdYVRUzUOE4HkY5J7+uttb5Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/detect-port-alt/-/detect-port-alt-1.1.6.tgz",
+      "integrity": "sha1-JHB96r6TLUo89iEwICfCsmZWgnU=",
       "license": "MIT",
       "dependencies": {
         "address": "^1.0.1",
@@ -8762,8 +8749,8 @@
     },
     "node_modules/detect-port-alt/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha1-XRKFFd8TT/Mn6QpMk/Tgd6U2NB8=",
       "license": "MIT",
       "dependencies": {
         "ms": "2.0.0"
@@ -8771,20 +8758,20 @@
     },
     "node_modules/detect-port-alt/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
       "license": "MIT"
     },
     "node_modules/didyoumean": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/didyoumean/-/didyoumean-1.2.2.tgz",
-      "integrity": "sha512-gxtyfqMg7GKyhQmb056K7M3xszy/myH8w+B4RT+QXBQsvAOdc3XymqDDPHx1BgPgsdAA5SIifona89YtRATDzw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/didyoumean/-/didyoumean-1.2.2.tgz",
+      "integrity": "sha1-mJNG/+noObRVXs9WZu3qDT6K0Dc=",
       "license": "Apache-2.0"
     },
     "node_modules/diff-sequences": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/diff-sequences/-/diff-sequences-27.5.1.tgz",
-      "integrity": "sha512-k1gCAXAsNgLwEL+Y8Wvl+M6oEFj5bgazfZULpS5CneoPPXRaCCW7dm+q21Ky2VEE5X+VeRDBVg1Pcvvsr4TtNQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/diff-sequences/-/diff-sequences-27.5.1.tgz",
+      "integrity": "sha1-6uzA0yf9aMjZZyoeZKuNzLLvUyc=",
       "license": "MIT",
       "engines": {
         "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
@@ -8792,8 +8779,8 @@
     },
     "node_modules/dir-glob": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
-      "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dir-glob/-/dir-glob-3.0.1.tgz",
+      "integrity": "sha1-Vtv3PZkqSpO6FYT0U0Bj/S5BcX8=",
       "license": "MIT",
       "dependencies": {
         "path-type": "^4.0.0"
@@ -8804,14 +8791,14 @@
     },
     "node_modules/dlv": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/dlv/-/dlv-1.1.3.tgz",
-      "integrity": "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dlv/-/dlv-1.1.3.tgz",
+      "integrity": "sha1-XBmKihFFNZbnUUlNSYdLx3MvLnk=",
       "license": "MIT"
     },
     "node_modules/dns-packet": {
       "version": "5.6.1",
-      "resolved": "https://registry.npmjs.org/dns-packet/-/dns-packet-5.6.1.tgz",
-      "integrity": "sha512-l4gcSouhcgIKRvyy99RNVOgxXiicE+2jZoNmaNmZ6JXiGajBOJAesk1OBlJuM5k2c+eudGdLxDqXuPCKIj6kpw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dns-packet/-/dns-packet-5.6.1.tgz",
+      "integrity": "sha1-roiK1CWp0UeKBnQlarhm3hASzy8=",
       "license": "MIT",
       "dependencies": {
         "@leichtgewicht/ip-codec": "^2.0.1"
@@ -8822,8 +8809,8 @@
     },
     "node_modules/doctrine": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
-      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/doctrine/-/doctrine-3.0.0.tgz",
+      "integrity": "sha1-rd6+rXKmV023g2OdyHoSF3OXOWE=",
       "license": "Apache-2.0",
       "dependencies": {
         "esutils": "^2.0.2"
@@ -8834,8 +8821,8 @@
     },
     "node_modules/dom-converter": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/dom-converter/-/dom-converter-0.2.0.tgz",
-      "integrity": "sha512-gd3ypIPfOMr9h5jIKq8E3sHOTCjeirnl0WK5ZdS1AW0Odt0b1PaWaHdJ4Qk4klv+YB9aJBS7mESXjFoDQPu6DA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dom-converter/-/dom-converter-0.2.0.tgz",
+      "integrity": "sha1-ZyGp2u4uKTaClVtq/kFncWJ7t2g=",
       "license": "MIT",
       "dependencies": {
         "utila": "~0.4"
@@ -8843,8 +8830,8 @@
     },
     "node_modules/dom-helpers": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/dom-helpers/-/dom-helpers-5.2.1.tgz",
-      "integrity": "sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dom-helpers/-/dom-helpers-5.2.1.tgz",
+      "integrity": "sha1-2UAFNrK/giWtmP4FLgKUUaxA6QI=",
       "license": "MIT",
       "dependencies": {
         "@babel/runtime": "^7.8.7",
@@ -8853,8 +8840,8 @@
     },
     "node_modules/dom-serializer": {
       "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-1.4.1.tgz",
-      "integrity": "sha512-VHwB3KfrcOOkelEG2ZOfxqLZdfkil8PtJi4P8N2MMXucZq2yLp75ClViUlOVwyoHEDjYU433Aq+5zWP61+RGag==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dom-serializer/-/dom-serializer-1.4.1.tgz",
+      "integrity": "sha1-3l1Bsa6ikCFdxFptrorc8dMuLTA=",
       "license": "MIT",
       "dependencies": {
         "domelementtype": "^2.0.1",
@@ -8867,8 +8854,8 @@
     },
     "node_modules/domelementtype": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
-      "integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/domelementtype/-/domelementtype-2.3.0.tgz",
+      "integrity": "sha1-XEXo6GmVJiYzHXqrMm0B2vZdWJ0=",
       "funding": [
         {
           "type": "github",
@@ -8879,8 +8866,8 @@
     },
     "node_modules/domexception": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/domexception/-/domexception-2.0.1.tgz",
-      "integrity": "sha512-yxJ2mFy/sibVQlu5qHjOkf9J3K6zgmCxgJ94u2EdvDOV09H+32LtRswEcUsmUWN72pVLOEnTSRaIVVzVQgS0dg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/domexception/-/domexception-2.0.1.tgz",
+      "integrity": "sha1-+0Su+6eT4VdLCvau0oAdBXUp8wQ=",
       "deprecated": "Use your platform's native DOMException instead",
       "license": "MIT",
       "dependencies": {
@@ -8892,8 +8879,8 @@
     },
     "node_modules/domexception/node_modules/webidl-conversions": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-5.0.0.tgz",
-      "integrity": "sha512-VlZwKPCkYKxQgeSbH5EyngOmRp7Ww7I9rQLERETtf5ofd9pGeswWiOtogpEO850jziPRarreGxn5QIiTqpb2wA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/webidl-conversions/-/webidl-conversions-5.0.0.tgz",
+      "integrity": "sha1-rlnIoAsSFUOirMZcBDT1ew/BGv8=",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=8"
@@ -8901,8 +8888,8 @@
     },
     "node_modules/domhandler": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-4.3.1.tgz",
-      "integrity": "sha512-GrwoxYN+uWlzO8uhUXRl0P+kHE4GtVPfYzVLcUxPL7KNdHKj66vvlhiweIHqYYXWlw+T8iLMp42Lm67ghw4WMQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/domhandler/-/domhandler-4.3.1.tgz",
+      "integrity": "sha1-jXkgM0FvWdaLwDpap7AYwcqJJ5w=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "domelementtype": "^2.2.0"
@@ -8916,8 +8903,8 @@
     },
     "node_modules/domutils": {
       "version": "2.8.0",
-      "resolved": "https://registry.npmjs.org/domutils/-/domutils-2.8.0.tgz",
-      "integrity": "sha512-w96Cjofp72M5IIhpjgobBimYEfoPjx1Vx0BSX9P30WBdZW2WIKU0T1Bd0kz2eNZ9ikjKgHbEyKx8BB6H1L3h3A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/domutils/-/domutils-2.8.0.tgz",
+      "integrity": "sha1-RDfe9dtuLR9dbuhZvZXKfQIEgTU=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "dom-serializer": "^1.0.1",
@@ -8930,8 +8917,8 @@
     },
     "node_modules/dot-case": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/dot-case/-/dot-case-3.0.4.tgz",
-      "integrity": "sha512-Kv5nKlh6yRrdrGvxeJ2e5y2eRUpkUosIW4A2AS38zwSz27zu7ufDwQPi5Jhs3XAlGNetl3bmnGhQsMtkKJnj3w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dot-case/-/dot-case-3.0.4.tgz",
+      "integrity": "sha1-mytnDQCkMWZ6inW6Kc0bmICc51E=",
       "license": "MIT",
       "dependencies": {
         "no-case": "^3.0.4",
@@ -8940,8 +8927,8 @@
     },
     "node_modules/dotenv": {
       "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-10.0.0.tgz",
-      "integrity": "sha512-rlBi9d8jpv9Sf1klPjNfFAuWDjKLwTIJJ/VxtoTwIR6hnZxcEOQCZg2oIL3MWBYw5GpUDKOEnND7LXTbIpQ03Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dotenv/-/dotenv-10.0.0.tgz",
+      "integrity": "sha1-PUInuPuV+BCWzdK2ZlP7LHCFuoE=",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=10"
@@ -8949,14 +8936,14 @@
     },
     "node_modules/dotenv-expand": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/dotenv-expand/-/dotenv-expand-5.1.0.tgz",
-      "integrity": "sha512-YXQl1DSa4/PQyRfgrv6aoNjhasp/p4qs9FjJ4q4cQk+8m4r6k4ZSiEyytKG8f8W9gi8WsQtIObNmKd+tMzNTmA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dotenv-expand/-/dotenv-expand-5.1.0.tgz",
+      "integrity": "sha1-P7rwIL/XlIhAcuomsel5HUWmKfA=",
       "license": "BSD-2-Clause"
     },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha1-165mfh3INIL4tw/Q9u78UNow9Yo=",
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.1",
@@ -8969,20 +8956,20 @@
     },
     "node_modules/duplexer": {
       "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/duplexer/-/duplexer-0.1.2.tgz",
-      "integrity": "sha512-jtD6YG370ZCIi/9GTaJKQxWTZD045+4R4hTk/x1UyoqadyJ9x9CgSi1RlVDQF8U2sxLLSnFkCaMihqljHIWgMg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/duplexer/-/duplexer-0.1.2.tgz",
+      "integrity": "sha1-Or5DrvODX4rgd9E23c4PJ2sEAOY=",
       "license": "MIT"
     },
     "node_modules/ee-first": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
-      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha1-WQxhFWsK4vTwJVcyoViyZrxWsh0=",
       "license": "MIT"
     },
     "node_modules/ejs": {
       "version": "3.1.10",
-      "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
-      "integrity": "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ejs/-/ejs-3.1.10.tgz",
+      "integrity": "sha1-aauDWLFOiW+AzDnmIIe4hQDDrDs=",
       "license": "Apache-2.0",
       "dependencies": {
         "jake": "^10.8.5"
@@ -8995,21 +8982,21 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.399",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.399.tgz",
-      "integrity": "sha512-lEcqhErbHjXRvd41rnWLpzbyU/IXfIYo7QwaFWmxGeLiLyY2TBCdHnWY88vB+p3ubnihRypDm66panXl7TylLA==",
+      "version": "1.5.405",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/electron-to-chromium/-/electron-to-chromium-1.5.405.tgz",
+      "integrity": "sha1-I/FCADNDlaCAG3n8NxqG2vAv014=",
       "license": "ISC"
     },
     "node_modules/embla-carousel": {
       "version": "8.6.0",
-      "resolved": "https://registry.npmjs.org/embla-carousel/-/embla-carousel-8.6.0.tgz",
-      "integrity": "sha512-SjWyZBHJPbqxHOzckOfo8lHisEaJWmwd23XppYFYVh10bU66/Pn5tkVkbkCMZVdbUE5eTCI2nD8OyIP4Z+uwkA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/embla-carousel/-/embla-carousel-8.6.0.tgz",
+      "integrity": "sha1-q87f8r/zaZLqisJ80wCAyltqP1g=",
       "license": "MIT"
     },
     "node_modules/embla-carousel-autoplay": {
       "version": "8.6.0",
-      "resolved": "https://registry.npmjs.org/embla-carousel-autoplay/-/embla-carousel-autoplay-8.6.0.tgz",
-      "integrity": "sha512-OBu5G3nwaSXkZCo1A6LTaFMZ8EpkYbwIaH+bPqdBnDGQ2fh4+NbzjXjs2SktoPNKCtflfVMc75njaDHOYXcrsA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/embla-carousel-autoplay/-/embla-carousel-autoplay-8.6.0.tgz",
+      "integrity": "sha1-vIbJfeANUuw0sFBYc271Cvbg0OQ=",
       "license": "MIT",
       "peerDependencies": {
         "embla-carousel": "8.6.0"
@@ -9017,8 +9004,8 @@
     },
     "node_modules/embla-carousel-fade": {
       "version": "8.6.0",
-      "resolved": "https://registry.npmjs.org/embla-carousel-fade/-/embla-carousel-fade-8.6.0.tgz",
-      "integrity": "sha512-qaYsx5mwCz72ZrjlsXgs1nKejSrW+UhkbOMwLgfRT7w2LtdEB03nPRI06GHuHv5ac2USvbEiX2/nAHctcDwvpg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/embla-carousel-fade/-/embla-carousel-fade-8.6.0.tgz",
+      "integrity": "sha1-ktGezVREHrbzeRC/nhb9P1R+M3Q=",
       "license": "MIT",
       "peerDependencies": {
         "embla-carousel": "8.6.0"
@@ -9026,8 +9013,8 @@
     },
     "node_modules/emittery": {
       "version": "0.8.1",
-      "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.8.1.tgz",
-      "integrity": "sha512-uDfvUjVrfGJJhymx/kz6prltenw1u7WrCg1oa94zYY8xxVpLLUu045LAT0dhDZdXG58/EpPL/5kA180fQ/qudg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/emittery/-/emittery-0.8.1.tgz",
+      "integrity": "sha1-uyPMhtA7MKp1p/c0gZ3uLhunCGA=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -9038,14 +9025,14 @@
     },
     "node_modules/emoji-regex": {
       "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha1-hAyIA7DYBH9P8M+WMXazLU7z7XI=",
       "license": "MIT"
     },
     "node_modules/emojis-list": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/emojis-list/-/emojis-list-3.0.0.tgz",
-      "integrity": "sha512-/kyM18EfinwXZbno9FyUGeFh87KC8HRQBQGildHZbEuRyWFOmv1U10o9BBp8XVZDVNNuQKyIGIu5ZYAAXJ0V2Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/emojis-list/-/emojis-list-3.0.0.tgz",
+      "integrity": "sha1-VXBmIEatKeLpFucariYKvf9Pang=",
       "license": "MIT",
       "engines": {
         "node": ">= 4"
@@ -9053,8 +9040,8 @@
     },
     "node_modules/encodeurl": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha1-e46omAd9fkCdOsRUdOo46vCFelg=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -9062,8 +9049,8 @@
     },
     "node_modules/enhanced-resolve": {
       "version": "5.24.5",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.5.tgz",
-      "integrity": "sha512-L1l8TNvomm6UVW5B253AGxQagSQr+vGwhMlrrfRS2qmhx46AMpMVJKQYLvWYbysTMY8VoicOvzHzoHMbyzB+4A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/enhanced-resolve/-/enhanced-resolve-5.24.5.tgz",
+      "integrity": "sha1-tNrTJVt1RfB7pVNRiYaOn4X0dXM=",
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
@@ -9075,8 +9062,8 @@
     },
     "node_modules/entities": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/entities/-/entities-2.2.0.tgz",
-      "integrity": "sha512-p92if5Nz619I0w+akJrLZH0MX0Pb5DX39XOwQTtXSdQQOaYH03S1uIQp4mhOZtAXrxq4ViO67YTiLBo2638o9A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/entities/-/entities-2.2.0.tgz",
+      "integrity": "sha1-CY3JDruD2N/6CJ1VJWs1HTTE2lU=",
       "license": "BSD-2-Clause",
       "funding": {
         "url": "https://github.com/fb55/entities?sponsor=1"
@@ -9084,8 +9071,8 @@
     },
     "node_modules/error-ex": {
       "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.4.tgz",
-      "integrity": "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/error-ex/-/error-ex-1.3.4.tgz",
+      "integrity": "sha1-s6jYu2+S7swWKePifTyGB6ijJBQ=",
       "license": "MIT",
       "dependencies": {
         "is-arrayish": "^0.2.1"
@@ -9093,8 +9080,8 @@
     },
     "node_modules/error-stack-parser": {
       "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/error-stack-parser/-/error-stack-parser-2.1.4.tgz",
-      "integrity": "sha512-Sk5V6wVazPhq5MhpO+AUxJn5x7XSXGl1R93Vn7i+zS15KDVxQijejNCrz8340/2bgLBjR9GtEG8ZVKONDjcqGQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/error-stack-parser/-/error-stack-parser-2.1.4.tgz",
+      "integrity": "sha1-IpywHNv6hEQL+pGHYoW5RoAYgoY=",
       "license": "MIT",
       "dependencies": {
         "stackframe": "^1.3.4"
@@ -9102,8 +9089,8 @@
     },
     "node_modules/es-abstract": {
       "version": "1.24.2",
-      "resolved": "https://registry.npmjs.org/es-abstract/-/es-abstract-1.24.2.tgz",
-      "integrity": "sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-abstract/-/es-abstract-1.24.2.tgz",
+      "integrity": "sha1-Lb04wYBzXumD93WFFAonBqlj7Zo=",
       "license": "MIT",
       "dependencies": {
         "array-buffer-byte-length": "^1.0.2",
@@ -9170,8 +9157,8 @@
     },
     "node_modules/es-abstract-get": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/es-abstract-get/-/es-abstract-get-1.0.0.tgz",
-      "integrity": "sha512-6PMWXpdhshVvFp+FoWYs1EvG1Nj0tvk0dZM+XcK0xMEM1czRVcP6ohqPWHy6qPagSpC8j4+p89WXlT+xXJs/fg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-abstract-get/-/es-abstract-get-1.0.0.tgz",
+      "integrity": "sha1-Hq6HEB9Cvt62p0DoxQUSca74kIg=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -9188,8 +9175,8 @@
     },
     "node_modules/es-define-property": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha1-mD6y+aZyTpMD9hrd8BHHLgngsPo=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -9197,8 +9184,8 @@
     },
     "node_modules/es-errors": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha1-BfdaJdq5jk+x3NXhRywFRtUFfI8=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -9206,8 +9193,8 @@
     },
     "node_modules/es-iterator-helpers": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/es-iterator-helpers/-/es-iterator-helpers-1.4.0.tgz",
-      "integrity": "sha512-c/A0P0oxkACDc+cKWw8evLXK83oBKgn0qPOqCYT4x9uolpCIJAcYvJC9QYKNDRPsTeGyCrQ326jrvgZWdCdK5Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-iterator-helpers/-/es-iterator-helpers-1.4.0.tgz",
+      "integrity": "sha1-K0Y17j6NsihTeKR6Hqj43TSttlM=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.9",
@@ -9233,14 +9220,14 @@
     },
     "node_modules/es-module-lexer": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.1.tgz",
-      "integrity": "sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-module-lexer/-/es-module-lexer-2.3.1.tgz",
+      "integrity": "sha1-W/LfBpmdu+XwBqX0ahH7n1t7ORs=",
       "license": "MIT"
     },
     "node_modules/es-object-atoms": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
-      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha1-otCzcyBXJN+lJdI7DD4bHKWCyZs=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0"
@@ -9251,8 +9238,8 @@
     },
     "node_modules/es-set-tostringtag": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
-      "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz",
+      "integrity": "sha1-8x274MGDsAptJutjJcgQwP0YvU0=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -9266,8 +9253,8 @@
     },
     "node_modules/es-shim-unscopables": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/es-shim-unscopables/-/es-shim-unscopables-1.1.0.tgz",
-      "integrity": "sha512-d9T8ucsEhh8Bi1woXCf+TIKDIROLG5WCkxg8geBCbvk22kzwC5G2OnXVMO6FUsvQlgUUXQ2itephWDLqDzbeCw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-shim-unscopables/-/es-shim-unscopables-1.1.0.tgz",
+      "integrity": "sha1-Q43zVSDaxdEF85Q9knVJ6jsA9LU=",
       "license": "MIT",
       "dependencies": {
         "hasown": "^2.0.2"
@@ -9278,8 +9265,8 @@
     },
     "node_modules/es-to-primitive": {
       "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/es-to-primitive/-/es-to-primitive-1.3.4.tgz",
-      "integrity": "sha512-yPDz7wqpg1/mmHLmS3tcfTfbw5f1eryXvyghYBffGdERwe+mV7ZcWzTR8LR17Kvqt3qfPurjlonmnq3MKXIOXw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/es-to-primitive/-/es-to-primitive-1.3.4.tgz",
+      "integrity": "sha1-DIVCkc8Ne0Oda55XceqDf/rx+ZE=",
       "license": "MIT",
       "dependencies": {
         "es-abstract-get": "^1.0.0",
@@ -9298,8 +9285,8 @@
     },
     "node_modules/escalade": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
-      "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/escalade/-/escalade-3.2.0.tgz",
+      "integrity": "sha1-ARo/aYVroYnf+n3I/M6Z0qh5A+U=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -9307,14 +9294,14 @@
     },
     "node_modules/escape-html": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha1-Aljq5NPQwJdN4cFpGI7wBR0dGYg=",
       "license": "MIT"
     },
     "node_modules/escape-string-regexp": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
-      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha1-FLqDpdNz49MR5a/KKc9b+tllvzQ=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -9325,8 +9312,8 @@
     },
     "node_modules/escodegen": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/escodegen/-/escodegen-2.1.0.tgz",
-      "integrity": "sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/escodegen/-/escodegen-2.1.0.tgz",
+      "integrity": "sha1-upO7t6Q5htKdYEH5n1Ji2nc+Lhc=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "esprima": "^4.0.1",
@@ -9346,8 +9333,8 @@
     },
     "node_modules/escodegen/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "optional": true,
       "engines": {
@@ -9356,8 +9343,8 @@
     },
     "node_modules/eslint": {
       "version": "8.57.1",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.1.tgz",
-      "integrity": "sha512-ypowyDxpVSYpkXr9WPv2PAZCtNip1Mv5KTW0SCurXv/9iOpcrH9PaqUElksqEB6pChqHGDRCFTyrZlGhnLNGiA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint/-/eslint-8.57.1.tgz",
+      "integrity": "sha1-ffEJZUq6fju+XI6uUzxeRh08bKk=",
       "deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.",
       "license": "MIT",
       "dependencies": {
@@ -9412,8 +9399,8 @@
     },
     "node_modules/eslint-config-react-app": {
       "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/eslint-config-react-app/-/eslint-config-react-app-7.0.1.tgz",
-      "integrity": "sha512-K6rNzvkIeHaTd8m/QEh1Zko0KI7BACWkkneSs6s9cKZC/J27X3eZR6Upt1jkmZ/4FK+XUOPPxMEN7+lbUXfSlA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-config-react-app/-/eslint-config-react-app-7.0.1.tgz",
+      "integrity": "sha1-c7o5KZeAAcXIYnTAF+pX61+mRLQ=",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.16.0",
@@ -9440,8 +9427,8 @@
     },
     "node_modules/eslint-import-resolver-node": {
       "version": "0.3.10",
-      "resolved": "https://registry.npmjs.org/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.10.tgz",
-      "integrity": "sha512-tRrKqFyCaKict5hOd244sL6EQFNycnMQnBe+j8uqGNXYzsImGbGUU4ibtoaBmv5FLwJwcFJNeg1GeVjQfbMrDQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-import-resolver-node/-/eslint-import-resolver-node-0.3.10.tgz",
+      "integrity": "sha1-hM4wBav8MAWIzyO7rBqr7B/G6ME=",
       "license": "MIT",
       "dependencies": {
         "debug": "^3.2.7",
@@ -9451,8 +9438,8 @@
     },
     "node_modules/eslint-import-resolver-node/node_modules/debug": {
       "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-3.2.7.tgz",
+      "integrity": "sha1-clgLfpFF+zm2Z2+cXl+xALk0F5o=",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.1"
@@ -9460,8 +9447,8 @@
     },
     "node_modules/eslint-import-resolver-node/node_modules/resolve": {
       "version": "2.0.0-next.7",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.7.tgz",
-      "integrity": "sha512-tqt+NBWwyaMgw3zDsnygx4CByWjQEJHOPMdslYhppaQSJUtL/D4JO9CcBBlhPoI8lz9oJIDXkwXfhF4aWqP8xQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/resolve/-/resolve-2.0.0-next.7.tgz",
+      "integrity": "sha1-ujsDXUse58UiQm7uc8q8sP1VFd0=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -9483,8 +9470,8 @@
     },
     "node_modules/eslint-module-utils": {
       "version": "2.14.0",
-      "resolved": "https://registry.npmjs.org/eslint-module-utils/-/eslint-module-utils-2.14.0.tgz",
-      "integrity": "sha512-W2WCRZ9Dqntd+2u8jJcVMV2PKulc6RdLgUUoh/yQr3uB6lo/ZOeGx11sv60/8S4QFFKNslAlWhr9u0Ef7ZW6Ig==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-module-utils/-/eslint-module-utils-2.14.0.tgz",
+      "integrity": "sha1-YR+OHGzrKak+uUnhzGcLgod2SBk=",
       "license": "MIT",
       "dependencies": {
         "debug": "^3.2.7"
@@ -9500,8 +9487,8 @@
     },
     "node_modules/eslint-module-utils/node_modules/debug": {
       "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-3.2.7.tgz",
+      "integrity": "sha1-clgLfpFF+zm2Z2+cXl+xALk0F5o=",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.1"
@@ -9509,8 +9496,8 @@
     },
     "node_modules/eslint-plugin-flowtype": {
       "version": "8.0.3",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-flowtype/-/eslint-plugin-flowtype-8.0.3.tgz",
-      "integrity": "sha512-dX8l6qUL6O+fYPtpNRideCFSpmWOUVx5QcaGLVqe/vlDiBSe4vYljDWDETwnyFzpl7By/WVIu6rcrniCgH9BqQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-plugin-flowtype/-/eslint-plugin-flowtype-8.0.3.tgz",
+      "integrity": "sha1-4VV+NxGPJHNKoxIudTagONNKSRI=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "lodash": "^4.17.21",
@@ -9527,8 +9514,8 @@
     },
     "node_modules/eslint-plugin-import": {
       "version": "2.32.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-import/-/eslint-plugin-import-2.32.0.tgz",
-      "integrity": "sha512-whOE1HFo/qJDyX4SnXzP4N6zOWn79WhnCUY/iDR0mPfQZO8wcYE4JClzI2oZrhBnnMUCBCHZhO6VQyoBU95mZA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-plugin-import/-/eslint-plugin-import-2.32.0.tgz",
+      "integrity": "sha1-YCtV+qbkyuql6XDBmLXACjdwiYA=",
       "license": "MIT",
       "dependencies": {
         "@rtsao/scc": "^1.1.0",
@@ -9560,8 +9547,8 @@
     },
     "node_modules/eslint-plugin-import/node_modules/debug": {
       "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.7.tgz",
-      "integrity": "sha512-CFjzYYAi4ThfiQvizrFQevTTXHtnCqWfe7x1AhgEscTz6ZbLbfoLRLPugTQyBth6f8ZERVUSyWHFD/7Wu4t1XQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-3.2.7.tgz",
+      "integrity": "sha1-clgLfpFF+zm2Z2+cXl+xALk0F5o=",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.1"
@@ -9569,8 +9556,8 @@
     },
     "node_modules/eslint-plugin-import/node_modules/doctrine": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
-      "integrity": "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/doctrine/-/doctrine-2.1.0.tgz",
+      "integrity": "sha1-XNAfwQFiG0LEzX9dGmYkNxbT850=",
       "license": "Apache-2.0",
       "dependencies": {
         "esutils": "^2.0.2"
@@ -9581,8 +9568,8 @@
     },
     "node_modules/eslint-plugin-import/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -9590,8 +9577,8 @@
     },
     "node_modules/eslint-plugin-jest": {
       "version": "25.7.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-25.7.0.tgz",
-      "integrity": "sha512-PWLUEXeeF7C9QGKqvdSbzLOiLTx+bno7/HC9eefePfEb257QFHg7ye3dh80AZVkaa/RQsBB1Q/ORQvg2X7F0NQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-plugin-jest/-/eslint-plugin-jest-25.7.0.tgz",
+      "integrity": "sha1-/0rJdSC1OpYYe62cmBTn0A3gmmo=",
       "license": "MIT",
       "dependencies": {
         "@typescript-eslint/experimental-utils": "^5.0.0"
@@ -9614,8 +9601,8 @@
     },
     "node_modules/eslint-plugin-jsx-a11y": {
       "version": "6.10.2",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsx-a11y/-/eslint-plugin-jsx-a11y-6.10.2.tgz",
-      "integrity": "sha512-scB3nz4WmG75pV8+3eRUQOHZlNSUhFNq37xnpgRkCCELU3XMvXAxLk1eqWWyE22Ki4Q01Fnsw9BA3cJHDPgn2Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-plugin-jsx-a11y/-/eslint-plugin-jsx-a11y-6.10.2.tgz",
+      "integrity": "sha1-0oErsjvxq0Zl8XGOpELoNy5jhIM=",
       "license": "MIT",
       "dependencies": {
         "aria-query": "^5.3.2",
@@ -9643,8 +9630,8 @@
     },
     "node_modules/eslint-plugin-react": {
       "version": "7.37.5",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-react/-/eslint-plugin-react-7.37.5.tgz",
-      "integrity": "sha512-Qteup0SqU15kdocexFNAJMvCJEfa2xUKNV4CC1xsVMrIIqEy3SQ/rqyxCWNzfrd3/ldy6HMlD2e0JDVpDg2qIA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-plugin-react/-/eslint-plugin-react-7.37.5.tgz",
+      "integrity": "sha1-KXVRFHK92hsnKzTXeTNcmw6HcGU=",
       "license": "MIT",
       "dependencies": {
         "array-includes": "^3.1.8",
@@ -9675,8 +9662,8 @@
     },
     "node_modules/eslint-plugin-react-hooks": {
       "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-4.6.2.tgz",
-      "integrity": "sha512-QzliNJq4GinDBcD8gPB5v0wh6g8q3SUi6EFF0x8N/BL9PoVs0atuGc47ozMRyOWAKdwaZ5OnbOEa3WR+dSGKuQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-plugin-react-hooks/-/eslint-plugin-react-hooks-4.6.2.tgz",
+      "integrity": "sha1-yCnrBsDm9ISz+7hal+V3hPMoxZY=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -9687,8 +9674,8 @@
     },
     "node_modules/eslint-plugin-react/node_modules/doctrine": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-2.1.0.tgz",
-      "integrity": "sha512-35mSku4ZXK0vfCuHEDAwt55dg2jNajHZ1odvF+8SSr82EsZY4QmXfuWso8oEd8zRhVObSN18aM0CjSdoBX7zIw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/doctrine/-/doctrine-2.1.0.tgz",
+      "integrity": "sha1-XNAfwQFiG0LEzX9dGmYkNxbT850=",
       "license": "Apache-2.0",
       "dependencies": {
         "esutils": "^2.0.2"
@@ -9699,8 +9686,8 @@
     },
     "node_modules/eslint-plugin-react/node_modules/resolve": {
       "version": "2.0.0-next.7",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-2.0.0-next.7.tgz",
-      "integrity": "sha512-tqt+NBWwyaMgw3zDsnygx4CByWjQEJHOPMdslYhppaQSJUtL/D4JO9CcBBlhPoI8lz9oJIDXkwXfhF4aWqP8xQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/resolve/-/resolve-2.0.0-next.7.tgz",
+      "integrity": "sha1-ujsDXUse58UiQm7uc8q8sP1VFd0=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -9722,8 +9709,8 @@
     },
     "node_modules/eslint-plugin-react/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -9731,8 +9718,8 @@
     },
     "node_modules/eslint-plugin-testing-library": {
       "version": "5.11.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-testing-library/-/eslint-plugin-testing-library-5.11.1.tgz",
-      "integrity": "sha512-5eX9e1Kc2PqVRed3taaLnAAqPZGEX75C+M/rXzUAI3wIg/ZxzUm1OVAwfe/O+vE+6YXOLetSe9g5GKD2ecXipw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-plugin-testing-library/-/eslint-plugin-testing-library-5.11.1.tgz",
+      "integrity": "sha1-W0bNrpbUp4kYcRwLR5L5AIjmLSA=",
       "license": "MIT",
       "dependencies": {
         "@typescript-eslint/utils": "^5.58.0"
@@ -9747,8 +9734,8 @@
     },
     "node_modules/eslint-scope": {
       "version": "7.2.2",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.2.2.tgz",
-      "integrity": "sha512-dOt21O7lTMhDM+X9mB4GX+DZrZtCUJPL/wlcTqxyrx5IvO0IYtILdtrQGQp+8n5S0gwSVmOf9NQrjMOgfQZlIg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-scope/-/eslint-scope-7.2.2.tgz",
+      "integrity": "sha1-3rT5JWM5DzIAaJSvYqItuhxGQj8=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "esrecurse": "^4.3.0",
@@ -9763,8 +9750,8 @@
     },
     "node_modules/eslint-visitor-keys": {
       "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
-      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha1-DNcv6FUOPC6uFWqWpN3c0cisWAA=",
       "license": "Apache-2.0",
       "engines": {
         "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
@@ -9775,8 +9762,8 @@
     },
     "node_modules/eslint-webpack-plugin": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/eslint-webpack-plugin/-/eslint-webpack-plugin-3.2.0.tgz",
-      "integrity": "sha512-avrKcGncpPbPSUHX6B3stNGzkKFto3eL+DKM4+VyMrVnhPc3vRczVlCq3uhuFOdRvDHTVXuzwk1ZKUrqDQHQ9w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-webpack-plugin/-/eslint-webpack-plugin-3.2.0.tgz",
+      "integrity": "sha1-GXjNue3EYeSwGVog2pUM9XmINHw=",
       "license": "MIT",
       "dependencies": {
         "@types/eslint": "^7.29.0 || ^8.4.1",
@@ -9799,8 +9786,8 @@
     },
     "node_modules/eslint-webpack-plugin/node_modules/jest-worker": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-28.1.3.tgz",
-      "integrity": "sha512-CqRA220YV/6jCo8VWvAt1KKx6eek1VIHMPeLEbpcfSfkEeWyBNppynM/o6q+Wmw+sOhos2ml34wZbSX3G13//g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-worker/-/jest-worker-28.1.3.tgz",
+      "integrity": "sha1-fjxM4/oj0btqzLFp5/OW+Y7Uu5g=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
@@ -9813,8 +9800,8 @@
     },
     "node_modules/eslint-webpack-plugin/node_modules/supports-color": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/supports-color/-/supports-color-8.1.1.tgz",
+      "integrity": "sha1-zW/BfihQDP9WwbhsCn/UpUpzAFw=",
       "license": "MIT",
       "dependencies": {
         "has-flag": "^4.0.0"
@@ -9828,8 +9815,8 @@
     },
     "node_modules/eslint/node_modules/ajv": {
       "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha1-B+mCx0YmFnqnoklcU4F4ktcTlJI=",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
@@ -9844,14 +9831,14 @@
     },
     "node_modules/eslint/node_modules/argparse": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha1-JG9Q88p4oyQPbJl+ipvR6sSeSzg=",
       "license": "Python-2.0"
     },
     "node_modules/eslint/node_modules/find-up": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
-      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/find-up/-/find-up-5.0.0.tgz",
+      "integrity": "sha1-TJKBnstwg1YeT0okCoa+UZj1Nvw=",
       "license": "MIT",
       "dependencies": {
         "locate-path": "^6.0.0",
@@ -9866,8 +9853,8 @@
     },
     "node_modules/eslint/node_modules/js-yaml": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
-      "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/js-yaml/-/js-yaml-4.3.1.tgz",
+      "integrity": "sha1-ASFsAB1n9I4s1WDXCMevIQkKOEg=",
       "funding": [
         {
           "type": "github",
@@ -9888,14 +9875,14 @@
     },
     "node_modules/eslint/node_modules/json-schema-traverse": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha1-afaofZUTq4u4/mO9sJecRI5oRmA=",
       "license": "MIT"
     },
     "node_modules/eslint/node_modules/locate-path": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
-      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/locate-path/-/locate-path-6.0.0.tgz",
+      "integrity": "sha1-VTIeswn+u8WcSAHZMackUqaB0oY=",
       "license": "MIT",
       "dependencies": {
         "p-locate": "^5.0.0"
@@ -9909,8 +9896,8 @@
     },
     "node_modules/eslint/node_modules/p-limit": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha1-4drMvnjQ0TiMoYxk/qOOPlfjcGs=",
       "license": "MIT",
       "dependencies": {
         "yocto-queue": "^0.1.0"
@@ -9924,8 +9911,8 @@
     },
     "node_modules/eslint/node_modules/p-locate": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
-      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/p-locate/-/p-locate-5.0.0.tgz",
+      "integrity": "sha1-g8gxXGeFAF470CGDlBHJ4RDm2DQ=",
       "license": "MIT",
       "dependencies": {
         "p-limit": "^3.0.2"
@@ -9939,8 +9926,8 @@
     },
     "node_modules/espree": {
       "version": "9.6.1",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-9.6.1.tgz",
-      "integrity": "sha512-oruZaFkjorTpF32kDSI5/75ViwGeZginGGy2NoOSg3Q9bnwlnmDm4HLnkl0RE3n+njDXR037aY1+x58Z/zFdwQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/espree/-/espree-9.6.1.tgz",
+      "integrity": "sha1-oqF7jkNGkKVDLy+AGM5x0zGkjG8=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "acorn": "^8.9.0",
@@ -9956,8 +9943,8 @@
     },
     "node_modules/esprima": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha1-E7BM2z5sXRnfkatph6hpVhmwqnE=",
       "license": "BSD-2-Clause",
       "bin": {
         "esparse": "bin/esparse.js",
@@ -9969,8 +9956,8 @@
     },
     "node_modules/esquery": {
       "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
-      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/esquery/-/esquery-1.7.0.tgz",
+      "integrity": "sha1-CNBI8mHw3e21uulfRoCUY9nJSW0=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "estraverse": "^5.1.0"
@@ -9981,8 +9968,8 @@
     },
     "node_modules/esrecurse": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
-      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha1-eteWTWeauyi+5yzsY3WLHF0smSE=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "estraverse": "^5.2.0"
@@ -9993,8 +9980,8 @@
     },
     "node_modules/estraverse": {
       "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha1-LupSkHAvJquP5TcDcP+GyWXSESM=",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=4.0"
@@ -10002,14 +9989,14 @@
     },
     "node_modules/estree-walker": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-1.0.1.tgz",
-      "integrity": "sha512-1fMXF3YP4pZZVozF8j/ZLfvnR8NSIljt56UhbZ5PeeDmmGHpgpdwQt7ITlGvYaQukCvuBRMLEiKiYC+oeIg4cg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/estree-walker/-/estree-walker-1.0.1.tgz",
+      "integrity": "sha1-MbxdYSyWtwQQa0d+bdXYqhOMtwA=",
       "license": "MIT"
     },
     "node_modules/esutils": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha1-dNLrTeC42hKTcRkQ1Qd1ubcQ72Q=",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -10017,8 +10004,8 @@
     },
     "node_modules/etag": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
-      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha1-Qa4u62XvpiJorr/qg6x9eSmbCIc=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -10026,14 +10013,14 @@
     },
     "node_modules/eventemitter3": {
       "version": "4.0.7",
-      "resolved": "https://registry.npmjs.org/eventemitter3/-/eventemitter3-4.0.7.tgz",
-      "integrity": "sha512-8guHBZCwKnFhYdHr2ysuRWErTwhoN2X8XELRlrRwpmfeY2jjuUN4taQMsULKUVo1K4DvZl+0pgfyoysHxvmvEw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eventemitter3/-/eventemitter3-4.0.7.tgz",
+      "integrity": "sha1-Lem2j2Uo1WRO9cWVJqG0oHMGFp8=",
       "license": "MIT"
     },
     "node_modules/events": {
       "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
-      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/events/-/events-3.3.0.tgz",
+      "integrity": "sha1-Mala0Kkk4tLEGagTrrLE6HjqdAA=",
       "license": "MIT",
       "engines": {
         "node": ">=0.8.x"
@@ -10041,8 +10028,8 @@
     },
     "node_modules/execa": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
-      "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/execa/-/execa-5.1.1.tgz",
+      "integrity": "sha1-+ArZy/Qpj3vR1MlVXCHpN0HEEd0=",
       "license": "MIT",
       "dependencies": {
         "cross-spawn": "^7.0.3",
@@ -10064,16 +10051,16 @@
     },
     "node_modules/exit": {
       "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/exit/-/exit-0.1.2.tgz",
-      "integrity": "sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/exit/-/exit-0.1.2.tgz",
+      "integrity": "sha1-BjJjj42HfMghB9MKD/8aF8uhzQw=",
       "engines": {
         "node": ">= 0.8.0"
       }
     },
     "node_modules/expect": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/expect/-/expect-27.5.1.tgz",
-      "integrity": "sha512-E1q5hSUG2AmYQwQJ041nvgpkODHQvB+RKlB4IYdru6uJsyFTRyZAP463M+1lINorwbqAmUggi6+WwkD8lCS/Dw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/expect/-/expect-27.5.1.tgz",
+      "integrity": "sha1-g85Z8eW99fnSuUth0gUNtI8/73Q=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -10087,8 +10074,8 @@
     },
     "node_modules/express": {
       "version": "4.22.2",
-      "resolved": "https://registry.npmjs.org/express/-/express-4.22.2.tgz",
-      "integrity": "sha512-IuL+Elrou2ZvCFHs18/CIzy2Nzvo25nZ1/D2eIZlz7c+QUayAcYoiM2BthCjs+EBHVpjYjcuLDAiCWgeIX3X1Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/express/-/express-4.22.2.tgz",
+      "integrity": "sha1-wXrgmB5e/CSyInLw4EHEZiUDtwA=",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
@@ -10133,8 +10120,8 @@
     },
     "node_modules/express/node_modules/cookie": {
       "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha1-VWNpxHKiupEPKXmJG1JrNDYjftc=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -10142,8 +10129,8 @@
     },
     "node_modules/express/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha1-XRKFFd8TT/Mn6QpMk/Tgd6U2NB8=",
       "license": "MIT",
       "dependencies": {
         "ms": "2.0.0"
@@ -10151,20 +10138,20 @@
     },
     "node_modules/express/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
       "license": "MIT"
     },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha1-On1WtVnWy8PrUSMlJE5hmmXGxSU=",
       "license": "MIT"
     },
     "node_modules/fast-equals": {
       "version": "5.4.1",
-      "resolved": "https://registry.npmjs.org/fast-equals/-/fast-equals-5.4.1.tgz",
-      "integrity": "sha512-DjlFSM5Pk9cGcL0q5QXl66eGzx0N6szNgaswwc5ZphlBohjTVJSnGgI+rJVOgOi65qUoQnDZN4nDqi33udtydQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-equals/-/fast-equals-5.4.1.tgz",
+      "integrity": "sha1-qRdLA+7OUwfb1nW+bW1C9/odAO0=",
       "license": "MIT",
       "engines": {
         "node": ">=6.0.0"
@@ -10172,8 +10159,8 @@
     },
     "node_modules/fast-glob": {
       "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
-      "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-glob/-/fast-glob-3.3.3.tgz",
+      "integrity": "sha1-0G1YXOjbqQoWsFBcVDw8z7OuuBg=",
       "license": "MIT",
       "dependencies": {
         "@nodelib/fs.stat": "^2.0.2",
@@ -10188,8 +10175,8 @@
     },
     "node_modules/fast-glob/node_modules/glob-parent": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
-      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha1-hpgyxYA0/mikCTwX3BXoNA2EAcQ=",
       "license": "ISC",
       "dependencies": {
         "is-glob": "^4.0.1"
@@ -10200,20 +10187,20 @@
     },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha1-h0v2nG9ATCtdmcSBNBOZ/VWJJjM=",
       "license": "MIT"
     },
     "node_modules/fast-levenshtein": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
       "license": "MIT"
     },
     "node_modules/fast-uri": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fast-uri/-/fast-uri-3.1.5.tgz",
+      "integrity": "sha1-YQ83QZoDAnBDDOzWjXTj1NlnJdA=",
       "funding": [
         {
           "type": "github",
@@ -10228,8 +10215,8 @@
     },
     "node_modules/fastq": {
       "version": "1.20.1",
-      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
-      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fastq/-/fastq-1.20.1.tgz",
+      "integrity": "sha1-ynUKENySW8ixiDn9ID4+9LPO1nU=",
       "license": "ISC",
       "dependencies": {
         "reusify": "^1.0.4"
@@ -10237,8 +10224,8 @@
     },
     "node_modules/faye-websocket": {
       "version": "0.11.4",
-      "resolved": "https://registry.npmjs.org/faye-websocket/-/faye-websocket-0.11.4.tgz",
-      "integrity": "sha512-CzbClwlXAuiRQAlUyfqPgvPoNKTckTPGfwZV4ZdAhVcP2lh9KUxJg2b5GkE7XbjKQ3YJnQ9z6D9ntLAlB+tP8g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/faye-websocket/-/faye-websocket-0.11.4.tgz",
+      "integrity": "sha1-fw2Sdc/dhqHJY9yLZfzEUe3Lsdo=",
       "license": "Apache-2.0",
       "dependencies": {
         "websocket-driver": ">=0.5.1"
@@ -10249,8 +10236,8 @@
     },
     "node_modules/fb-watchman": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz",
-      "integrity": "sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fb-watchman/-/fb-watchman-2.0.2.tgz",
+      "integrity": "sha1-6VJO5rXHfp5QAa8PhfOtu4YjJVw=",
       "license": "Apache-2.0",
       "dependencies": {
         "bser": "2.1.1"
@@ -10258,8 +10245,8 @@
     },
     "node_modules/fdir": {
       "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha1-7Sq5Z6MxreYvGNB32uGSaE1Q01A=",
       "license": "MIT",
       "engines": {
         "node": ">=12.0.0"
@@ -10275,8 +10262,8 @@
     },
     "node_modules/file-entry-cache": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
-      "integrity": "sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
+      "integrity": "sha1-IRst2WWcsDlLBz5zI6w8kz1SICc=",
       "license": "MIT",
       "dependencies": {
         "flat-cache": "^3.0.4"
@@ -10287,8 +10274,8 @@
     },
     "node_modules/file-loader": {
       "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/file-loader/-/file-loader-6.2.0.tgz",
-      "integrity": "sha512-qo3glqyTa61Ytg4u73GultjHGjdRyig3tG6lPtyX/jOEJvHif9uB0/OCI2Kif6ctF3caQTW2G5gym21oAsI4pw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/file-loader/-/file-loader-6.2.0.tgz",
+      "integrity": "sha1-uu98+OGEDfMl5DkLRISHlIDuvk0=",
       "license": "MIT",
       "dependencies": {
         "loader-utils": "^2.0.0",
@@ -10307,8 +10294,8 @@
     },
     "node_modules/file-loader/node_modules/ajv": {
       "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha1-B+mCx0YmFnqnoklcU4F4ktcTlJI=",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
@@ -10323,8 +10310,8 @@
     },
     "node_modules/file-loader/node_modules/ajv-keywords": {
       "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
-      "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
+      "integrity": "sha1-MfKdpatuANHC0yms97WSlhTVAU0=",
       "license": "MIT",
       "peerDependencies": {
         "ajv": "^6.9.1"
@@ -10332,14 +10319,14 @@
     },
     "node_modules/file-loader/node_modules/json-schema-traverse": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha1-afaofZUTq4u4/mO9sJecRI5oRmA=",
       "license": "MIT"
     },
     "node_modules/file-loader/node_modules/schema-utils": {
       "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-3.3.0.tgz",
-      "integrity": "sha512-pN/yOAvcC+5rQ5nERGuwrjLlYvLTbCibnZ1I7B1LaiAz9BRBlE9GMgE/eqV30P7aJQUf7Ddimy/RsbYO/GrVGg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/schema-utils/-/schema-utils-3.3.0.tgz",
+      "integrity": "sha1-9QqIh3w8AWUqFbYirp6Xld96YP4=",
       "license": "MIT",
       "dependencies": {
         "@types/json-schema": "^7.0.8",
@@ -10356,8 +10343,8 @@
     },
     "node_modules/filelist": {
       "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/filelist/-/filelist-1.0.6.tgz",
-      "integrity": "sha512-5giy2PkLYY1cP39p17Ech+2xlpTRL9HLspOfEgm0L6CwBXBTgsK5ou0JtzYuepxkaQ/tvhCFIJ5uXo0OrM2DxA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/filelist/-/filelist-1.0.6.tgz",
+      "integrity": "sha1-HohwlCp8Y2yGL3xJuTlJN7aplaM=",
       "license": "Apache-2.0",
       "dependencies": {
         "minimatch": "^5.0.1"
@@ -10365,8 +10352,8 @@
     },
     "node_modules/filelist/node_modules/brace-expansion": {
       "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha1-WJ2rEcABjQNmvmTNi/Esjb7MgyY=",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0"
@@ -10374,8 +10361,8 @@
     },
     "node_modules/filelist/node_modules/minimatch": {
       "version": "5.1.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
-      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha1-EpPvFdsAmLOUVA6Pn3RPn9qN7ks=",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^2.0.1"
@@ -10386,8 +10373,8 @@
     },
     "node_modules/filesize": {
       "version": "8.0.7",
-      "resolved": "https://registry.npmjs.org/filesize/-/filesize-8.0.7.tgz",
-      "integrity": "sha512-pjmC+bkIF8XI7fWaH8KxHcZL3DPybs1roSKP4rKDvy20tAWwIObE4+JIseG2byfGKhud5ZnM4YSGKBz7Sh0ndQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/filesize/-/filesize-8.0.7.tgz",
+      "integrity": "sha1-aV5w2A9ORwEsEy1XoFnoDGtYC9g=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">= 0.4.0"
@@ -10395,8 +10382,8 @@
     },
     "node_modules/fill-range": {
       "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
-      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha1-RCZdPKwH4+p9wkdRY4BkN1SgUpI=",
       "license": "MIT",
       "dependencies": {
         "to-regex-range": "^5.0.1"
@@ -10407,8 +10394,8 @@
     },
     "node_modules/finalhandler": {
       "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.2.tgz",
-      "integrity": "sha512-aA4RyPcd3badbdABGDuTXCMTtOneUCAYH/gxoYRTZlIJdF0YPWuGqiAsIrhNnnqdXGswYk6dGujem4w80UJFhg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/finalhandler/-/finalhandler-1.3.2.tgz",
+      "integrity": "sha1-HrwiKPx2c6rEpHLDEMwFt32FK4g=",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
@@ -10425,8 +10412,8 @@
     },
     "node_modules/finalhandler/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha1-XRKFFd8TT/Mn6QpMk/Tgd6U2NB8=",
       "license": "MIT",
       "dependencies": {
         "ms": "2.0.0"
@@ -10434,14 +10421,14 @@
     },
     "node_modules/finalhandler/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
       "license": "MIT"
     },
     "node_modules/find-cache-dir": {
       "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-3.3.2.tgz",
-      "integrity": "sha512-wXZV5emFEjrridIgED11OoUKLxiYjAcqot/NJdAkOhlJ+vGzwhOAfcG5OX1jP+S0PcjEn8bdMJv+g2jwQ3Onig==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/find-cache-dir/-/find-cache-dir-3.3.2.tgz",
+      "integrity": "sha1-swxbbv8HMHMa6pu9nb7L2AJW1ks=",
       "license": "MIT",
       "dependencies": {
         "commondir": "^1.0.1",
@@ -10457,8 +10444,8 @@
     },
     "node_modules/find-up": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
-      "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/find-up/-/find-up-4.1.0.tgz",
+      "integrity": "sha1-l6/n1s3AvFkoWEt8jXsW6KmqXRk=",
       "license": "MIT",
       "dependencies": {
         "locate-path": "^5.0.0",
@@ -10470,8 +10457,8 @@
     },
     "node_modules/flat-cache": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-3.2.0.tgz",
-      "integrity": "sha512-CYcENa+FtcUKLmhhqyctpclsq7QF38pKjZHsGNiSQF5r4FtoKDWabFDl3hzaEQMvT1LHEysw5twgLvpYYb4vbw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/flat-cache/-/flat-cache-3.2.0.tgz",
+      "integrity": "sha1-LAwtUEDJmxYydxqdEFclwBFTY+4=",
       "license": "MIT",
       "dependencies": {
         "flatted": "^3.2.9",
@@ -10484,14 +10471,14 @@
     },
     "node_modules/flatted": {
       "version": "3.4.4",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz",
-      "integrity": "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/flatted/-/flatted-3.4.4.tgz",
+      "integrity": "sha1-ruyipQYwPwzuYcWebJ8qiNLyn8Y=",
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
       "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
-      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/follow-redirects/-/follow-redirects-1.16.0.tgz",
+      "integrity": "sha1-KEdKFZ07nRHvYgUKFO1g5N9tYbw=",
       "funding": [
         {
           "type": "individual",
@@ -10510,8 +10497,8 @@
     },
     "node_modules/for-each": {
       "version": "0.3.5",
-      "resolved": "https://registry.npmjs.org/for-each/-/for-each-0.3.5.tgz",
-      "integrity": "sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/for-each/-/for-each-0.3.5.tgz",
+      "integrity": "sha1-1lBogCeCaSD+6wr3R+57lCGkHUc=",
       "license": "MIT",
       "dependencies": {
         "is-callable": "^1.2.7"
@@ -10525,8 +10512,8 @@
     },
     "node_modules/fork-ts-checker-webpack-plugin": {
       "version": "6.5.3",
-      "resolved": "https://registry.npmjs.org/fork-ts-checker-webpack-plugin/-/fork-ts-checker-webpack-plugin-6.5.3.tgz",
-      "integrity": "sha512-SbH/l9ikmMWycd5puHJKTkZJKddF4iRLyW3DeZ08HTI7NGyLS38MXd/KGgeWumQO7YNQbW2u/NtPT2YowbPaGQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fork-ts-checker-webpack-plugin/-/fork-ts-checker-webpack-plugin-6.5.3.tgz",
+      "integrity": "sha1-7aLv9uIkdqJojRBmFojEf2EbN/M=",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.8.3",
@@ -10564,8 +10551,8 @@
     },
     "node_modules/fork-ts-checker-webpack-plugin/node_modules/ajv": {
       "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha1-B+mCx0YmFnqnoklcU4F4ktcTlJI=",
       "license": "MIT",
       "dependencies": {
         "fast-deep-equal": "^3.1.1",
@@ -10580,8 +10567,8 @@
     },
     "node_modules/fork-ts-checker-webpack-plugin/node_modules/ajv-keywords": {
       "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
-      "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
+      "integrity": "sha1-MfKdpatuANHC0yms97WSlhTVAU0=",
       "license": "MIT",
       "peerDependencies": {
         "ajv": "^6.9.1"
@@ -10589,8 +10576,8 @@
     },
     "node_modules/fork-ts-checker-webpack-plugin/node_modules/cosmiconfig": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/cosmiconfig/-/cosmiconfig-6.0.0.tgz",
-      "integrity": "sha512-xb3ZL6+L8b9JLLCx3ZdoZy4+2ECphCMo2PwqgP1tlfVq6M6YReyzBJtvWWtbDSpNr9hn96pkCiZqUcFEc+54Qg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cosmiconfig/-/cosmiconfig-6.0.0.tgz",
+      "integrity": "sha1-2k/uhTxS9rHmk19BwaL8UL1KmYI=",
       "license": "MIT",
       "dependencies": {
         "@types/parse-json": "^4.0.0",
@@ -10605,8 +10592,8 @@
     },
     "node_modules/fork-ts-checker-webpack-plugin/node_modules/fs-extra": {
       "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fs-extra/-/fs-extra-9.1.0.tgz",
+      "integrity": "sha1-WVRGDHZKjaIJS6NVS/g55rmnyG0=",
       "license": "MIT",
       "dependencies": {
         "at-least-node": "^1.0.0",
@@ -10620,14 +10607,14 @@
     },
     "node_modules/fork-ts-checker-webpack-plugin/node_modules/json-schema-traverse": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha1-afaofZUTq4u4/mO9sJecRI5oRmA=",
       "license": "MIT"
     },
     "node_modules/fork-ts-checker-webpack-plugin/node_modules/schema-utils": {
       "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.0.tgz",
-      "integrity": "sha512-0ilKFI6QQF5nxDZLFn2dMjvc4hjg/Wkg7rHd3jK6/A4a1Hl9VFdQWvgB1UMGoU94pad1P/8N7fMcEnLnSiju8A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/schema-utils/-/schema-utils-2.7.0.tgz",
+      "integrity": "sha1-FxUfdtjq5n+793lgwzxnatn078c=",
       "license": "MIT",
       "dependencies": {
         "@types/json-schema": "^7.0.4",
@@ -10644,8 +10631,8 @@
     },
     "node_modules/fork-ts-checker-webpack-plugin/node_modules/tapable": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-1.1.3.tgz",
-      "integrity": "sha512-4WK/bYZmj8xLr+HUCODHGF1ZFzsYffasLUgEiMBY4fgtltdO6B4WJtlSbPaDTLpYTcGVwM2qLnFTICEcNxs3kA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tapable/-/tapable-1.1.3.tgz",
+      "integrity": "sha1-ofzMBrWNth/XpF2i2kT186Pme6I=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -10653,8 +10640,8 @@
     },
     "node_modules/form-data": {
       "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
-      "integrity": "sha512-vKatAh4SlVfgbv+YtmhiRjhEMJsYpsG1Y2rMQtR+SVSbytsSD1YGzDIcrAJmdFec88u/+VoGmxnl+80gL1tRCQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/form-data/-/form-data-4.0.6.tgz",
+      "integrity": "sha1-KOhk4beG2+u2jbH0UvljUnhmWCc=",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
@@ -10669,8 +10656,8 @@
     },
     "node_modules/forwarded": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
-      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha1-ImmTZCiq1MFcfr6XeahL8LKoGBE=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -10678,8 +10665,8 @@
     },
     "node_modules/fraction.js": {
       "version": "5.3.4",
-      "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-5.3.4.tgz",
-      "integrity": "sha512-1X1NTtiJphryn/uLQz3whtY6jK3fTqoE3ohKs0tT+Ujr1W59oopxmoEh7Lu5p6vBaPbgoM0bzveAW4Qi5RyWDQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fraction.js/-/fraction.js-5.3.4.tgz",
+      "integrity": "sha1-jA/MapkIJi307Rl0J73u9WPgaZo=",
       "license": "MIT",
       "engines": {
         "node": "*"
@@ -10691,8 +10678,8 @@
     },
     "node_modules/fresh": {
       "version": "0.5.2",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
-      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fresh/-/fresh-0.5.2.tgz",
+      "integrity": "sha1-PYyt2Q2XZWn6g1qx+OSyOhBWBac=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -10700,8 +10687,8 @@
     },
     "node_modules/fs-extra": {
       "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-10.1.0.tgz",
-      "integrity": "sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fs-extra/-/fs-extra-10.1.0.tgz",
+      "integrity": "sha1-Aoc8+8QITd4SfqpfmQXu8jJdGr8=",
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.0",
@@ -10714,21 +10701,20 @@
     },
     "node_modules/fs-monkey": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/fs-monkey/-/fs-monkey-1.1.0.tgz",
-      "integrity": "sha512-QMUezzXWII9EV5aTFXW1UBVUO77wYPpjqIF8/AviUCThNeSYZykpoTixUeaNNBwmCev0AMDWMAni+f8Hxb1IFw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fs-monkey/-/fs-monkey-1.1.0.tgz",
+      "integrity": "sha1-YyqhWiDnGCjtVrJDAzY/sUFOWZc=",
       "license": "Unlicense"
     },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8=",
       "license": "ISC"
     },
     "node_modules/fsevents": {
       "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "hasInstallScript": true,
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha1-ysZAd4XQNnWipeGlMFxpezR9kNY=",
       "license": "MIT",
       "optional": true,
       "os": [
@@ -10740,8 +10726,8 @@
     },
     "node_modules/function-bind": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha1-LALYZNl/PqbIgwxGTL0Rq26rehw=",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -10749,8 +10735,8 @@
     },
     "node_modules/function.prototype.name": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/function.prototype.name/-/function.prototype.name-1.2.0.tgz",
-      "integrity": "sha512-jObKIik1P2QjPHP5nz5BaOtUlfgS0fWo8IUByNXkM+o+02sJOi94em77GwJKQSJ3gfPHdgzLNrHc1uokV4P/ew==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/function.prototype.name/-/function.prototype.name-1.2.0.tgz",
+      "integrity": "sha1-dY8+hPpUJnJFS9XhTLCBpc4H9ww=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.9",
@@ -10772,8 +10758,8 @@
     },
     "node_modules/functions-have-names": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/functions-have-names/-/functions-have-names-1.2.3.tgz",
-      "integrity": "sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/functions-have-names/-/functions-have-names-1.2.3.tgz",
+      "integrity": "sha1-BAT+TuK6L2B/Dg7DyAuumUEzuDQ=",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -10781,8 +10767,8 @@
     },
     "node_modules/generator-function": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/generator-function/-/generator-function-2.0.1.tgz",
-      "integrity": "sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/generator-function/-/generator-function-2.0.1.tgz",
+      "integrity": "sha1-DnXdQQ0SQ2h6C6LpUblO7bj3N6I=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -10790,8 +10776,8 @@
     },
     "node_modules/gensync": {
       "version": "1.0.0-beta.2",
-      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
-      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha1-MqbudsPX9S1GsrGuXZP+qFgKJeA=",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -10799,8 +10785,8 @@
     },
     "node_modules/get-caller-file": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
-      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/get-caller-file/-/get-caller-file-2.0.5.tgz",
+      "integrity": "sha1-T5RBKoLbMvNuOwuXQfipf+sDH34=",
       "license": "ISC",
       "engines": {
         "node": "6.* || 8.* || >= 10.*"
@@ -10808,8 +10794,8 @@
     },
     "node_modules/get-intrinsic": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha1-dD8OO2lkqTpUke0b/6rgVNf5jQE=",
       "license": "MIT",
       "dependencies": {
         "call-bind-apply-helpers": "^1.0.2",
@@ -10832,14 +10818,14 @@
     },
     "node_modules/get-own-enumerable-property-symbols": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/get-own-enumerable-property-symbols/-/get-own-enumerable-property-symbols-3.0.2.tgz",
-      "integrity": "sha512-I0UBV/XOz1XkIJHEUDMZAbzCThU/H8DxmSfmdGcKPnVhu2VfFqr34jr9777IyaTYvxjedWhqVIilEDsCdP5G6g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/get-own-enumerable-property-symbols/-/get-own-enumerable-property-symbols-3.0.2.tgz",
+      "integrity": "sha1-tf3nfyLL4185C04ImSLFC85u9mQ=",
       "license": "ISC"
     },
     "node_modules/get-package-type": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/get-package-type/-/get-package-type-0.1.0.tgz",
-      "integrity": "sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/get-package-type/-/get-package-type-0.1.0.tgz",
+      "integrity": "sha1-jeLYA8/0TfO8bEVuZmizbDkm4Ro=",
       "license": "MIT",
       "engines": {
         "node": ">=8.0.0"
@@ -10847,8 +10833,8 @@
     },
     "node_modules/get-proto": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha1-FQs/J0OGnvPoUewMSdFbHRTQDuE=",
       "license": "MIT",
       "dependencies": {
         "dunder-proto": "^1.0.1",
@@ -10860,8 +10846,8 @@
     },
     "node_modules/get-stream": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
-      "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/get-stream/-/get-stream-6.0.1.tgz",
+      "integrity": "sha1-omLY7vZ6ztV8KFKtYWdSakPL97c=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -10872,8 +10858,8 @@
     },
     "node_modules/get-symbol-description": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/get-symbol-description/-/get-symbol-description-1.1.0.tgz",
-      "integrity": "sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/get-symbol-description/-/get-symbol-description-1.1.0.tgz",
+      "integrity": "sha1-e91U4L7+j/yfO04gMiDZ8eiBtu4=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -10889,8 +10875,8 @@
     },
     "node_modules/glob": {
       "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha1-uN8PuAK7+o6JvR2Ti04WV47UTys=",
       "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "license": "ISC",
       "dependencies": {
@@ -10910,8 +10896,8 @@
     },
     "node_modules/glob-parent": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
-      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha1-bSN9mQg5UMeSkPJMdkKj3poo+eM=",
       "license": "ISC",
       "dependencies": {
         "is-glob": "^4.0.3"
@@ -10922,8 +10908,8 @@
     },
     "node_modules/global-modules": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/global-modules/-/global-modules-2.0.0.tgz",
-      "integrity": "sha512-NGbfmJBp9x8IxyJSd1P+otYK8vonoJactOogrVfFRIAEY1ukil8RSKDz2Yo7wh1oihl51l/r6W4epkeKJHqL8A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/global-modules/-/global-modules-2.0.0.tgz",
+      "integrity": "sha1-mXYFrSNF8n9RU5vqJldEISFcd4A=",
       "license": "MIT",
       "dependencies": {
         "global-prefix": "^3.0.0"
@@ -10934,8 +10920,8 @@
     },
     "node_modules/global-prefix": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/global-prefix/-/global-prefix-3.0.0.tgz",
-      "integrity": "sha512-awConJSVCHVGND6x3tmMaKcQvwXLhjdkmomy2W+Goaui8YPgYgXJZewhg3fWC+DlfqqQuWg8AwqjGTD2nAPVWg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/global-prefix/-/global-prefix-3.0.0.tgz",
+      "integrity": "sha1-/IX3MGTfafUEIfR/iD/luRO6m5c=",
       "license": "MIT",
       "dependencies": {
         "ini": "^1.3.5",
@@ -10948,8 +10934,8 @@
     },
     "node_modules/global-prefix/node_modules/which": {
       "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/which/-/which-1.3.1.tgz",
-      "integrity": "sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/which/-/which-1.3.1.tgz",
+      "integrity": "sha1-pFBD1U9YBTFtqNYvn1CRjT2nCwo=",
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -10960,8 +10946,8 @@
     },
     "node_modules/globals": {
       "version": "13.24.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-13.24.0.tgz",
-      "integrity": "sha512-AhO5QUcj8llrbG09iWhPU2B204J1xnPeL8kQmVorSsy+Sjj1sk8gIyh6cUocGmH4L0UuhAJy+hJMRA4mgA4mFQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/globals/-/globals-13.24.0.tgz",
+      "integrity": "sha1-hDKhnXjODB6DOUnDats0VAC7EXE=",
       "license": "MIT",
       "dependencies": {
         "type-fest": "^0.20.2"
@@ -10975,8 +10961,8 @@
     },
     "node_modules/globalthis": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/globalthis/-/globalthis-1.0.4.tgz",
-      "integrity": "sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/globalthis/-/globalthis-1.0.4.tgz",
+      "integrity": "sha1-dDDtOpddl7+1m8zkH1yruvplEjY=",
       "license": "MIT",
       "dependencies": {
         "define-properties": "^1.2.1",
@@ -10991,8 +10977,8 @@
     },
     "node_modules/globby": {
       "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz",
-      "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/globby/-/globby-11.1.0.tgz",
+      "integrity": "sha1-vUvpi7BC+D15b344EZkfvoKg00s=",
       "license": "MIT",
       "dependencies": {
         "array-union": "^2.1.0",
@@ -11011,8 +10997,8 @@
     },
     "node_modules/gopd": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha1-ifVrghe9vIgCvSmd9tfxCB1+UaE=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -11023,20 +11009,20 @@
     },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha1-QYPk6L8Iu24Fu7L30uDI9xLKQOM=",
       "license": "ISC"
     },
     "node_modules/graphemer": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/graphemer/-/graphemer-1.4.0.tgz",
-      "integrity": "sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/graphemer/-/graphemer-1.4.0.tgz",
+      "integrity": "sha1-+y8dVeDjoYSa7/yQxPoN1ToOZsY=",
       "license": "MIT"
     },
     "node_modules/gzip-size": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/gzip-size/-/gzip-size-6.0.0.tgz",
-      "integrity": "sha512-ax7ZYomf6jqPTQ4+XCpUGyXKHk5WweS+e05MBO4/y3WJ5RkmPXNKvX+bx1behVILVwr6JSQvZAku021CHPXG3Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/gzip-size/-/gzip-size-6.0.0.tgz",
+      "integrity": "sha1-BlNn/VDCOcBnHLy61b4+LusQ5GI=",
       "license": "MIT",
       "dependencies": {
         "duplexer": "^0.1.2"
@@ -11050,20 +11036,20 @@
     },
     "node_modules/handle-thing": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/handle-thing/-/handle-thing-2.0.1.tgz",
-      "integrity": "sha512-9Qn4yBxelxoh2Ow62nP+Ka/kMnOXRi8BXnRaUwezLNhqelnN49xKz4F/dPP8OYLxLxq6JDtZb2i9XznUQbNPTg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/handle-thing/-/handle-thing-2.0.1.tgz",
+      "integrity": "sha1-hX95zjWVgMNA1DCBzGSJcNC7I04=",
       "license": "MIT"
     },
     "node_modules/harmony-reflect": {
       "version": "1.6.2",
-      "resolved": "https://registry.npmjs.org/harmony-reflect/-/harmony-reflect-1.6.2.tgz",
-      "integrity": "sha512-HIp/n38R9kQjDEziXyDTuW3vvoxxyxjxFzXLrBr18uB47GnSt+G9D29fqrpM5ZkspMcPICud3XsBJQ4Y2URg8g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/harmony-reflect/-/harmony-reflect-1.6.2.tgz",
+      "integrity": "sha1-Mey9MuZIo00DDYattn1NR1R/5xA=",
       "license": "(Apache-2.0 OR MPL-1.1)"
     },
     "node_modules/has-bigints": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-bigints/-/has-bigints-1.1.0.tgz",
-      "integrity": "sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/has-bigints/-/has-bigints-1.1.0.tgz",
+      "integrity": "sha1-KGB+llrJZ+A80qLHCiY2oe2tSf4=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -11074,8 +11060,8 @@
     },
     "node_modules/has-flag": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha1-lEdx/ZyByBJlxNaUGGDaBrtZR5s=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -11083,8 +11069,8 @@
     },
     "node_modules/has-property-descriptors": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
-      "integrity": "sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz",
+      "integrity": "sha1-lj7X0HHce/XwhMW/vg0bYiJYaFQ=",
       "license": "MIT",
       "dependencies": {
         "es-define-property": "^1.0.0"
@@ -11095,8 +11081,8 @@
     },
     "node_modules/has-proto": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/has-proto/-/has-proto-1.2.0.tgz",
-      "integrity": "sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/has-proto/-/has-proto-1.2.0.tgz",
+      "integrity": "sha1-XeWm6r2V/f/ZgYtDBV6AZeOf6dU=",
       "license": "MIT",
       "dependencies": {
         "dunder-proto": "^1.0.0"
@@ -11110,8 +11096,8 @@
     },
     "node_modules/has-symbols": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha1-/JxqeDoISVHQuXH+EBjegTcHozg=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -11122,8 +11108,8 @@
     },
     "node_modules/has-tostringtag": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
-      "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/has-tostringtag/-/has-tostringtag-1.0.2.tgz",
+      "integrity": "sha1-LNxC1AvvLltO6rfAGnPFTOerWrw=",
       "license": "MIT",
       "dependencies": {
         "has-symbols": "^1.0.3"
@@ -11137,8 +11123,8 @@
     },
     "node_modules/hasown": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
-      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha1-jGLYy5C+sqrV0KW2dYGtmFTD8AM=",
       "license": "MIT",
       "dependencies": {
         "function-bind": "^1.1.2"
@@ -11149,8 +11135,8 @@
     },
     "node_modules/he": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz",
-      "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/he/-/he-1.2.0.tgz",
+      "integrity": "sha1-hK5l+n6vsWX922FWauFLrwVmTw8=",
       "license": "MIT",
       "bin": {
         "he": "bin/he"
@@ -11158,8 +11144,8 @@
     },
     "node_modules/hoopy": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/hoopy/-/hoopy-0.1.4.tgz",
-      "integrity": "sha512-HRcs+2mr52W0K+x8RzcLzuPPmVIKMSv97RGHy0Ea9y/mpcaK+xTrjICA04KAHi4GRzxliNqNJEFYWHghy3rSfQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/hoopy/-/hoopy-0.1.4.tgz",
+      "integrity": "sha1-YJIH1mEQADOpqUAq096mdzgcGx0=",
       "license": "MIT",
       "engines": {
         "node": ">= 6.0.0"
@@ -11167,8 +11153,8 @@
     },
     "node_modules/hpack.js": {
       "version": "2.1.6",
-      "resolved": "https://registry.npmjs.org/hpack.js/-/hpack.js-2.1.6.tgz",
-      "integrity": "sha512-zJxVehUdMGIKsRaNt7apO2Gqp0BdqW5yaiGHXXmbpvxgBYVZnAql+BJb4RO5ad2MgpbZKn5G6nMnegrH1FcNYQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/hpack.js/-/hpack.js-2.1.6.tgz",
+      "integrity": "sha1-h3dMCUnlE/QuhFdbPEVoH63ioLI=",
       "license": "MIT",
       "dependencies": {
         "inherits": "^2.0.1",
@@ -11179,14 +11165,14 @@
     },
     "node_modules/hpack.js/node_modules/isarray": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/isarray/-/isarray-1.0.0.tgz",
+      "integrity": "sha1-u5NdSFgsuhaMBoNJV6VKPgcSTxE=",
       "license": "MIT"
     },
     "node_modules/hpack.js/node_modules/readable-stream": {
       "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha1-kRJegEK7obmIf0k0X2J3Anzovps=",
       "license": "MIT",
       "dependencies": {
         "core-util-is": "~1.0.0",
@@ -11200,14 +11186,14 @@
     },
     "node_modules/hpack.js/node_modules/safe-buffer": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha1-mR7GnSluAxN0fVm9/St0XDX4go0=",
       "license": "MIT"
     },
     "node_modules/hpack.js/node_modules/string_decoder": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha1-nPFhG6YmhdcDCunkujQUnDrwP8g=",
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "~5.1.0"
@@ -11215,8 +11201,8 @@
     },
     "node_modules/html-encoding-sniffer": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/html-encoding-sniffer/-/html-encoding-sniffer-2.0.1.tgz",
-      "integrity": "sha512-D5JbOMBIR/TVZkubHT+OyT2705QvogUW4IBn6nHd756OwieSF9aDYFj4dv6HHEVGYbHaLETa3WggZYWWMyy3ZQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/html-encoding-sniffer/-/html-encoding-sniffer-2.0.1.tgz",
+      "integrity": "sha1-QqbcT9M/ACgRduiyN1nKTk+hhfM=",
       "license": "MIT",
       "dependencies": {
         "whatwg-encoding": "^1.0.5"
@@ -11227,8 +11213,8 @@
     },
     "node_modules/html-entities": {
       "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/html-entities/-/html-entities-2.6.0.tgz",
-      "integrity": "sha512-kig+rMn/QOVRvr7c86gQ8lWXq+Hkv6CbAH1hLu+RG338StTpE8Z0b44SDVaqVu7HGKf27frdmUYEs9hTUX/cLQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/html-entities/-/html-entities-2.6.0.tgz",
+      "integrity": "sha1-fGTx6js2gYzK49P7SLaXQgjphPg=",
       "funding": [
         {
           "type": "github",
@@ -11243,14 +11229,14 @@
     },
     "node_modules/html-escaper": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
-      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha1-39YAJ9o2o238viNiYsAKWCJoFFM=",
       "license": "MIT"
     },
     "node_modules/html-minifier-terser": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/html-minifier-terser/-/html-minifier-terser-6.1.0.tgz",
-      "integrity": "sha512-YXxSlJBZTP7RS3tWnQw74ooKa6L9b9i9QYXY21eUEvhZ3u9XLfv6OnFsQq6RxkhHygsaUMvYsZRV5rU/OVNZxw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/html-minifier-terser/-/html-minifier-terser-6.1.0.tgz",
+      "integrity": "sha1-v8gYk0zAeRj2s2afV3Ts39SPMqs=",
       "license": "MIT",
       "dependencies": {
         "camel-case": "^4.1.2",
@@ -11270,8 +11256,8 @@
     },
     "node_modules/html-minifier-terser/node_modules/commander": {
       "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
-      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/commander/-/commander-8.3.0.tgz",
+      "integrity": "sha1-SDfqGy2me5xhamevuw+v7lZ7ymY=",
       "license": "MIT",
       "engines": {
         "node": ">= 12"
@@ -11279,8 +11265,8 @@
     },
     "node_modules/html-webpack-plugin": {
       "version": "5.6.8",
-      "resolved": "https://registry.npmjs.org/html-webpack-plugin/-/html-webpack-plugin-5.6.8.tgz",
-      "integrity": "sha512-MZmKQcTnhEh1SPSyMiEytIeDZDUoBZVorNHivQGXMASHf/BSGGOrKa2xQ5bGx3TCe1n109ecCt+cpww7wwWhKA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/html-webpack-plugin/-/html-webpack-plugin-5.6.8.tgz",
+      "integrity": "sha1-VCXbxj61M/+lnpI0K+lIlKEl/CM=",
       "license": "MIT",
       "dependencies": {
         "@types/html-minifier-terser": "^6.0.0",
@@ -11311,8 +11297,8 @@
     },
     "node_modules/htmlparser2": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-6.1.0.tgz",
-      "integrity": "sha512-gyyPk6rgonLFEDGoeRgQNaEUvdJ4ktTmmUh/h2t7s+M8oPpIPxgNACWa+6ESR57kXstwqPiCut0V8NRpcwgU7A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/htmlparser2/-/htmlparser2-6.1.0.tgz",
+      "integrity": "sha1-xNditsM3GgXb5l6UrkOp+EX7j7c=",
       "funding": [
         "https://github.com/fb55/htmlparser2?sponsor=1",
         {
@@ -11330,14 +11316,14 @@
     },
     "node_modules/http-deceiver": {
       "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/http-deceiver/-/http-deceiver-1.2.7.tgz",
-      "integrity": "sha512-LmpOGxTfbpgtGVxJrj5k7asXHCgNZp5nLfp+hWc8QQRqtb7fUy6kRY3BO1h9ddF6yIPYUARgxGOwB42DnxIaNw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/http-deceiver/-/http-deceiver-1.2.7.tgz",
+      "integrity": "sha1-+nFolEq5pRnTN8sL7HKE3D5yPYc=",
       "license": "MIT"
     },
     "node_modules/http-errors": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha1-NtL2W8kJyHkAGN02+02T2myq4Gs=",
       "license": "MIT",
       "dependencies": {
         "depd": "~2.0.0",
@@ -11356,14 +11342,14 @@
     },
     "node_modules/http-parser-js": {
       "version": "0.5.10",
-      "resolved": "https://registry.npmjs.org/http-parser-js/-/http-parser-js-0.5.10.tgz",
-      "integrity": "sha512-Pysuw9XpUq5dVc/2SMHpuTY01RFl8fttgcyunjL7eEMhGM3cI4eOmiCycJDVCo/7O7ClfQD3SaI6ftDzqOXYMA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/http-parser-js/-/http-parser-js-0.5.10.tgz",
+      "integrity": "sha1-syd71tftVYjiDqc79yT8vkRgkHU=",
       "license": "MIT"
     },
     "node_modules/http-proxy": {
       "version": "1.18.1",
-      "resolved": "https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.1.tgz",
-      "integrity": "sha512-7mz/721AbnJwIVbnaSv1Cz3Am0ZLT/UBwkC92VlxhXv/k/BBQfM2fXElQNC27BVGr0uwUpplYPQM9LnaBMR5NQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/http-proxy/-/http-proxy-1.18.1.tgz",
+      "integrity": "sha1-QBVB8FNIhLv5UmAzTnL4juOXZUk=",
       "license": "MIT",
       "dependencies": {
         "eventemitter3": "^4.0.0",
@@ -11376,8 +11362,8 @@
     },
     "node_modules/http-proxy-agent": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz",
-      "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz",
+      "integrity": "sha1-ioyO9/WTLM+VPClsqCkblap0qjo=",
       "license": "MIT",
       "dependencies": {
         "@tootallnate/once": "1",
@@ -11390,8 +11376,8 @@
     },
     "node_modules/http-proxy-middleware": {
       "version": "2.0.10",
-      "resolved": "https://registry.npmjs.org/http-proxy-middleware/-/http-proxy-middleware-2.0.10.tgz",
-      "integrity": "sha512-RKzRWNPxUZqbuk3BC5mGVJbBnWgr+diEnjJexIOytFbBzDy88Fbh/YvBr3DsNrl1jYAfjWfpATEv0NO35FDuPQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/http-proxy-middleware/-/http-proxy-middleware-2.0.10.tgz",
+      "integrity": "sha1-st97cFID16jCaayEUM+WsAxTL5Q=",
       "license": "MIT",
       "dependencies": {
         "@types/http-proxy": "^1.17.8",
@@ -11414,8 +11400,8 @@
     },
     "node_modules/https-proxy-agent": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
-      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha1-xZ7yJKBP6LdU89sAY6Jeow0ABdY=",
       "license": "MIT",
       "dependencies": {
         "agent-base": "6",
@@ -11427,8 +11413,8 @@
     },
     "node_modules/human-signals": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
-      "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/human-signals/-/human-signals-2.1.0.tgz",
+      "integrity": "sha1-3JH8ukLk0G5Kuu0zs+ejwC9RTqA=",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=10.17.0"
@@ -11436,8 +11422,8 @@
     },
     "node_modules/iconv-lite": {
       "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha1-pS+AvzjaGVLrXGgXkHGYcaGnJQE=",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
@@ -11448,8 +11434,8 @@
     },
     "node_modules/icss-utils": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/icss-utils/-/icss-utils-5.1.0.tgz",
-      "integrity": "sha512-soFhflCVWLfRNOPU3iv5Z9VUdT44xFRbzjLsEzSr5AQmgqPMTHdU3PMT1Cf1ssx8fLNJDA1juftYl+PUcv3MqA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/icss-utils/-/icss-utils-5.1.0.tgz",
+      "integrity": "sha1-xr5oWKvQE9do6YNmrkfiXViHsa4=",
       "license": "ISC",
       "engines": {
         "node": "^10 || ^12 || >= 14"
@@ -11460,14 +11446,14 @@
     },
     "node_modules/idb": {
       "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/idb/-/idb-7.1.1.tgz",
-      "integrity": "sha512-gchesWBzyvGHRO9W8tzUWFDycow5gwjvFKfyV9FF32Y7F50yZMp7mP+T2mJIWFx49zicqyC4uefHM17o6xKIVQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/idb/-/idb-7.1.1.tgz",
+      "integrity": "sha1-2RDe2GbTLHztm+/Fv9829XLO1ys=",
       "license": "ISC"
     },
     "node_modules/identity-obj-proxy": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/identity-obj-proxy/-/identity-obj-proxy-3.0.0.tgz",
-      "integrity": "sha512-00n6YnVHKrinT9t0d9+5yZC6UBNJANpYEQvL2LlX6Ab9lnmxzIRcEmTPuyGScvl1+jKuCICX1Z0Ab1pPKKdikA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/identity-obj-proxy/-/identity-obj-proxy-3.0.0.tgz",
+      "integrity": "sha1-lNK9qWCERT7zb7xarsN+D3nx/BQ=",
       "license": "MIT",
       "dependencies": {
         "harmony-reflect": "^1.4.6"
@@ -11478,8 +11464,8 @@
     },
     "node_modules/ignore": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha1-PNQOcp82Q/2HywTlC/DrcivFlvU=",
       "license": "MIT",
       "engines": {
         "node": ">= 4"
@@ -11487,8 +11473,8 @@
     },
     "node_modules/immer": {
       "version": "9.0.21",
-      "resolved": "https://registry.npmjs.org/immer/-/immer-9.0.21.tgz",
-      "integrity": "sha512-bc4NBHqOqSfRW7POMkHd51LvClaeMXpm8dx0e8oE2GORbq5aRK7Bxl4FyzVLdGtLmvLKL7BTDBG5ACQm4HWjTA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/immer/-/immer-9.0.21.tgz",
+      "integrity": "sha1-HgJeoxpA8k+wZPH+8j6TFJYzAXY=",
       "license": "MIT",
       "funding": {
         "type": "opencollective",
@@ -11497,8 +11483,8 @@
     },
     "node_modules/import-fresh": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
-      "integrity": "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/import-fresh/-/import-fresh-3.3.1.tgz",
+      "integrity": "sha1-nOy1ZQPAraHydB271lRuSxO1fM8=",
       "license": "MIT",
       "dependencies": {
         "parent-module": "^1.0.0",
@@ -11513,8 +11499,8 @@
     },
     "node_modules/import-fresh/node_modules/resolve-from": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
-      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/resolve-from/-/resolve-from-4.0.0.tgz",
+      "integrity": "sha1-SrzYUq0y3Xuqv+m0DgCjbbXzkuY=",
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -11522,8 +11508,8 @@
     },
     "node_modules/import-local": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz",
-      "integrity": "sha512-2SPlun1JUPWoM6t3F0dw0FkCF/jWY8kttcY4f599GLTSjh2OCuuhdTkJQsEcZzBqbXZGKMK2OqW1oZsjtf/gQA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/import-local/-/import-local-3.2.0.tgz",
+      "integrity": "sha1-w9XHRXmMAqb4uJdyarpRABhu4mA=",
       "license": "MIT",
       "dependencies": {
         "pkg-dir": "^4.2.0",
@@ -11541,8 +11527,8 @@
     },
     "node_modules/imurmurhash": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha1-khi5srkoojixPcT7a21XbyMUU+o=",
       "license": "MIT",
       "engines": {
         "node": ">=0.8.19"
@@ -11550,8 +11536,8 @@
     },
     "node_modules/inflight": {
       "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
       "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
       "license": "ISC",
       "dependencies": {
@@ -11561,20 +11547,20 @@
     },
     "node_modules/inherits": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha1-D6LGT5MpF8NDOg3tVTY6rjdBa3w=",
       "license": "ISC"
     },
     "node_modules/ini": {
       "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha1-op2kJbSIBvNHZ6Tvzjlyaa8oQyw=",
       "license": "ISC"
     },
     "node_modules/internal-slot": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
-      "integrity": "sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/internal-slot/-/internal-slot-1.1.0.tgz",
+      "integrity": "sha1-HqyRdilH0vcFa8g42T4TsulgSWE=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -11587,17 +11573,17 @@
     },
     "node_modules/internmap": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/internmap/-/internmap-2.0.3.tgz",
-      "integrity": "sha512-5Hh7Y1wQbvY5ooGgPbDaL5iYLAPzMTUrjMulskHLH6wnv/A+1q5rgEaiuqEjB+oxGXIVZs1FF+R/KPN3ZSQYYg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/internmap/-/internmap-2.0.3.tgz",
+      "integrity": "sha1-ZoXyN1XkPFJOJR0py8lySOMGEAk=",
       "license": "ISC",
       "engines": {
         "node": ">=12"
       }
     },
     "node_modules/ipaddr.js": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-2.4.0.tgz",
-      "integrity": "sha512-9VGk3HGanVE6JoZXHiCpnGy5X0jYDnN4EA4lntFPj+1vIWlFhIylq2CrrCOJH9EAhc5CYhq18F2Av2tgoAPsYQ==",
+      "version": "2.5.0",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ipaddr.js/-/ipaddr.js-2.5.0.tgz",
+      "integrity": "sha1-fUtsOfk5L7Yc+AfebkJeIsEOBh8=",
       "license": "MIT",
       "engines": {
         "node": ">= 10"
@@ -11605,8 +11591,8 @@
     },
     "node_modules/is-array-buffer": {
       "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/is-array-buffer/-/is-array-buffer-3.0.5.tgz",
-      "integrity": "sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-array-buffer/-/is-array-buffer-3.0.5.tgz",
+      "integrity": "sha1-ZXQuHmh70sxmYlMGj9hwf+TUQoA=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -11622,14 +11608,14 @@
     },
     "node_modules/is-arrayish": {
       "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
-      "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-arrayish/-/is-arrayish-0.2.1.tgz",
+      "integrity": "sha1-d8mYQFJ6qOyxqLppe4BkWnqSap0=",
       "license": "MIT"
     },
     "node_modules/is-async-function": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-async-function/-/is-async-function-2.1.1.tgz",
-      "integrity": "sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-async-function/-/is-async-function-2.1.1.tgz",
+      "integrity": "sha1-PmkBjI4E5ztzh5PQIL/ohLn9NSM=",
       "license": "MIT",
       "dependencies": {
         "async-function": "^1.0.0",
@@ -11647,8 +11633,8 @@
     },
     "node_modules/is-bigint": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/is-bigint/-/is-bigint-1.1.0.tgz",
-      "integrity": "sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-bigint/-/is-bigint-1.1.0.tgz",
+      "integrity": "sha1-3aejRF31ekJYPbQihoLrp8QXBnI=",
       "license": "MIT",
       "dependencies": {
         "has-bigints": "^1.0.2"
@@ -11662,8 +11648,8 @@
     },
     "node_modules/is-binary-path": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
-      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-binary-path/-/is-binary-path-2.1.0.tgz",
+      "integrity": "sha1-6h9/O4DwZCNug0cPhsCcJU+0Wwk=",
       "license": "MIT",
       "dependencies": {
         "binary-extensions": "^2.0.0"
@@ -11674,8 +11660,8 @@
     },
     "node_modules/is-boolean-object": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/is-boolean-object/-/is-boolean-object-1.2.2.tgz",
-      "integrity": "sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-boolean-object/-/is-boolean-object-1.2.2.tgz",
+      "integrity": "sha1-cGf0dwmAmjk8cf9bs+E12KkhXZ4=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -11690,8 +11676,8 @@
     },
     "node_modules/is-callable": {
       "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/is-callable/-/is-callable-1.2.7.tgz",
-      "integrity": "sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-callable/-/is-callable-1.2.7.tgz",
+      "integrity": "sha1-O8KoXqdC2eNiBdys3XLKH9xRsFU=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -11702,8 +11688,8 @@
     },
     "node_modules/is-core-module": {
       "version": "2.16.2",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.2.tgz",
-      "integrity": "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-core-module/-/is-core-module-2.16.2.tgz",
+      "integrity": "sha1-PgdFCoCA684/vwysSU9NKrMk4II=",
       "license": "MIT",
       "dependencies": {
         "hasown": "^2.0.3"
@@ -11717,8 +11703,8 @@
     },
     "node_modules/is-data-view": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-data-view/-/is-data-view-1.0.2.tgz",
-      "integrity": "sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-data-view/-/is-data-view-1.0.2.tgz",
+      "integrity": "sha1-uuCkG5aImGwhiN2mZX5WuPnmO44=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -11734,8 +11720,8 @@
     },
     "node_modules/is-date-object": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/is-date-object/-/is-date-object-1.1.0.tgz",
-      "integrity": "sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-date-object/-/is-date-object-1.1.0.tgz",
+      "integrity": "sha1-rYVUGZb8eqiycpcB0ntzGfldgvc=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -11750,8 +11736,8 @@
     },
     "node_modules/is-docker": {
       "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
-      "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-docker/-/is-docker-2.2.1.tgz",
+      "integrity": "sha1-M+6r4jz+hvFL3kQIoCwM+4U6zao=",
       "license": "MIT",
       "bin": {
         "is-docker": "cli.js"
@@ -11765,8 +11751,8 @@
     },
     "node_modules/is-document.all": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-document.all/-/is-document.all-1.0.0.tgz",
-      "integrity": "sha512-+XSoyS05OdBbhFuELhgTCpFNHkpBOJqtsZfUFFpe5QTw+9Sjbh8zitxhQkYAo6wV7e1Vb8cAPvpCk9jGam/82g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-document.all/-/is-document.all-1.0.0.tgz",
+      "integrity": "sha1-FjpL+zYsbtexGM5GzezE433uMZU=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.4"
@@ -11780,8 +11766,8 @@
     },
     "node_modules/is-extglob": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
-      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -11789,8 +11775,8 @@
     },
     "node_modules/is-finalizationregistry": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-finalizationregistry/-/is-finalizationregistry-1.1.1.tgz",
-      "integrity": "sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-finalizationregistry/-/is-finalizationregistry-1.1.1.tgz",
+      "integrity": "sha1-7v3NxslN3QZ02chYh7+T+USpfJA=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3"
@@ -11804,8 +11790,8 @@
     },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha1-8Rb4Bk/pCz94RKOJl8C3UFEmnx0=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -11813,8 +11799,8 @@
     },
     "node_modules/is-generator-fn": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/is-generator-fn/-/is-generator-fn-2.1.0.tgz",
-      "integrity": "sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-generator-fn/-/is-generator-fn-2.1.0.tgz",
+      "integrity": "sha1-fRQK3DiarzARqPKipM+m+q3/sRg=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -11822,8 +11808,8 @@
     },
     "node_modules/is-generator-function": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/is-generator-function/-/is-generator-function-1.1.2.tgz",
-      "integrity": "sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-generator-function/-/is-generator-function-1.1.2.tgz",
+      "integrity": "sha1-rjth49XqTkg5uQutIrAjNQUaF9U=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.4",
@@ -11841,8 +11827,8 @@
     },
     "node_modules/is-glob": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
-      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha1-ZPYeQsu7LuwgcanawLKLoeZdUIQ=",
       "license": "MIT",
       "dependencies": {
         "is-extglob": "^2.1.1"
@@ -11853,8 +11839,8 @@
     },
     "node_modules/is-map": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/is-map/-/is-map-2.0.3.tgz",
-      "integrity": "sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-map/-/is-map-2.0.3.tgz",
+      "integrity": "sha1-7elrf+HicLPERl46RlZYdkkm1i4=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -11865,14 +11851,14 @@
     },
     "node_modules/is-module": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-module/-/is-module-1.0.0.tgz",
-      "integrity": "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-module/-/is-module-1.0.0.tgz",
+      "integrity": "sha1-Mlj7afeMFNW4FdZkM2tM/7ZEFZE=",
       "license": "MIT"
     },
     "node_modules/is-negative-zero": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/is-negative-zero/-/is-negative-zero-2.0.3.tgz",
-      "integrity": "sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-negative-zero/-/is-negative-zero-2.0.3.tgz",
+      "integrity": "sha1-ztkDoCespjgbd3pXQwadc3akl0c=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -11883,8 +11869,8 @@
     },
     "node_modules/is-number": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
-      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha1-dTU0W4lnNNX4DE0GxQlVUnoU8Ss=",
       "license": "MIT",
       "engines": {
         "node": ">=0.12.0"
@@ -11892,8 +11878,8 @@
     },
     "node_modules/is-number-object": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-number-object/-/is-number-object-1.1.1.tgz",
-      "integrity": "sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-number-object/-/is-number-object-1.1.1.tgz",
+      "integrity": "sha1-FEsh6VobwUggXcwoFKkTTsQbJUE=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -11908,8 +11894,8 @@
     },
     "node_modules/is-obj": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/is-obj/-/is-obj-1.0.1.tgz",
-      "integrity": "sha512-l4RyHgRqGN4Y3+9JHVrNqO+tN0rV5My76uW5/nuO4K1b6vw5G8d/cmFjP9tRfEsdhZNt0IFdZuK/c2Vr4Nb+Qg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-obj/-/is-obj-1.0.1.tgz",
+      "integrity": "sha1-PkcprB9f3gJc19g6iW2rn09n2w8=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -11917,8 +11903,8 @@
     },
     "node_modules/is-path-inside": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/is-path-inside/-/is-path-inside-3.0.3.tgz",
-      "integrity": "sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-path-inside/-/is-path-inside-3.0.3.tgz",
+      "integrity": "sha1-0jE2LlOgf/Kw4Op/7QSRYf/RYoM=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -11926,8 +11912,8 @@
     },
     "node_modules/is-plain-obj": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-3.0.0.tgz",
-      "integrity": "sha512-gwsOE28k+23GP1B6vFl1oVh/WOzmawBrKwo5Ev6wMKzPkaXaCDIQKzLnvsA42DRlbVTWorkgTKIviAKCWkfUwA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-plain-obj/-/is-plain-obj-3.0.0.tgz",
+      "integrity": "sha1-r28uoUrFpkYYOlu9tbqrvBVq2dc=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -11938,14 +11924,14 @@
     },
     "node_modules/is-potential-custom-element-name": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
-      "integrity": "sha512-bCYeRA2rVibKZd+s2625gGnGF/t7DSqDs4dP7CrLA1m7jKWz6pps0LpYLJN8Q64HtmPKJ1hrN3nzPNKFEKOUiQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-potential-custom-element-name/-/is-potential-custom-element-name-1.0.1.tgz",
+      "integrity": "sha1-Fx7W8Z46xVQ5Tt94yqBXhKRb67U=",
       "license": "MIT"
     },
     "node_modules/is-regex": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/is-regex/-/is-regex-1.2.1.tgz",
-      "integrity": "sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-regex/-/is-regex-1.2.1.tgz",
+      "integrity": "sha1-dtcKPtEO+b5I61d4h9dCBb8MrSI=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -11962,8 +11948,8 @@
     },
     "node_modules/is-regexp": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-regexp/-/is-regexp-1.0.0.tgz",
-      "integrity": "sha512-7zjFAPO4/gwyQAAgRRmqeEeyIICSdmCqa3tsVHMdBzaXXRiqopZL4Cyghg/XulGWrtABTpbnYYzzIRffLkP4oA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-regexp/-/is-regexp-1.0.0.tgz",
+      "integrity": "sha1-/S2INUXEa6xaYz57mgnof6LLUGk=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -11971,8 +11957,8 @@
     },
     "node_modules/is-root": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/is-root/-/is-root-2.1.0.tgz",
-      "integrity": "sha512-AGOriNp96vNBd3HtU+RzFEc75FfR5ymiYv8E553I71SCeXBiMsVDUtdio1OEFvrPyLIQ9tVR5RxXIFe5PUFjMg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-root/-/is-root-2.1.0.tgz",
+      "integrity": "sha1-gJ4YEpzxEpZEMCpPhUQDXVGYSpw=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -11980,8 +11966,8 @@
     },
     "node_modules/is-set": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/is-set/-/is-set-2.0.3.tgz",
-      "integrity": "sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-set/-/is-set-2.0.3.tgz",
+      "integrity": "sha1-irIJ6kJGCBQTct7W4MsgDvHZ0B0=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -11992,8 +11978,8 @@
     },
     "node_modules/is-shared-array-buffer": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/is-shared-array-buffer/-/is-shared-array-buffer-1.0.4.tgz",
-      "integrity": "sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-shared-array-buffer/-/is-shared-array-buffer-1.0.4.tgz",
+      "integrity": "sha1-m2eES9m38ka6BwjDqT40Jpx3T28=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3"
@@ -12007,8 +11993,8 @@
     },
     "node_modules/is-stream": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
-      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha1-+sHj1TuXrVqdCunO8jifWBClwHc=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -12019,8 +12005,8 @@
     },
     "node_modules/is-string": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-string/-/is-string-1.1.1.tgz",
-      "integrity": "sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-string/-/is-string-1.1.1.tgz",
+      "integrity": "sha1-kuo/PVxbbgOcqGd+WsjQfqdzy7k=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -12035,8 +12021,8 @@
     },
     "node_modules/is-symbol": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-symbol/-/is-symbol-1.1.1.tgz",
-      "integrity": "sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-symbol/-/is-symbol-1.1.1.tgz",
+      "integrity": "sha1-9HdhJ59TLisFpwJKdQbbvtrNBjQ=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -12052,8 +12038,8 @@
     },
     "node_modules/is-typed-array": {
       "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/is-typed-array/-/is-typed-array-1.1.15.tgz",
-      "integrity": "sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-typed-array/-/is-typed-array-1.1.15.tgz",
+      "integrity": "sha1-S/tKRbYc7oOlpG+6d45OjVnAzgs=",
       "license": "MIT",
       "dependencies": {
         "which-typed-array": "^1.1.16"
@@ -12067,14 +12053,14 @@
     },
     "node_modules/is-typedarray": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz",
-      "integrity": "sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-typedarray/-/is-typedarray-1.0.0.tgz",
+      "integrity": "sha1-5HnICFjfDBsR3dppQPlgEfzaSpo=",
       "license": "MIT"
     },
     "node_modules/is-weakmap": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/is-weakmap/-/is-weakmap-2.0.2.tgz",
-      "integrity": "sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-weakmap/-/is-weakmap-2.0.2.tgz",
+      "integrity": "sha1-v3JhXWSd/l9pkHnFS4PkfRrhnP0=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -12085,8 +12071,8 @@
     },
     "node_modules/is-weakref": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/is-weakref/-/is-weakref-1.1.1.tgz",
-      "integrity": "sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-weakref/-/is-weakref-1.1.1.tgz",
+      "integrity": "sha1-7qQwGCvo1kF0vZa/+8RvIb8/kpM=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3"
@@ -12100,8 +12086,8 @@
     },
     "node_modules/is-weakset": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/is-weakset/-/is-weakset-2.0.4.tgz",
-      "integrity": "sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-weakset/-/is-weakset-2.0.4.tgz",
+      "integrity": "sha1-yfXesLwZBsbW8QJ/KE3fRZJJ2so=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -12116,8 +12102,8 @@
     },
     "node_modules/is-wsl": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
-      "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/is-wsl/-/is-wsl-2.2.0.tgz",
+      "integrity": "sha1-dKTHbnfKn9P5MvKQwX6jJs0VcnE=",
       "license": "MIT",
       "dependencies": {
         "is-docker": "^2.0.0"
@@ -12128,20 +12114,20 @@
     },
     "node_modules/isarray": {
       "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-2.0.5.tgz",
-      "integrity": "sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/isarray/-/isarray-2.0.5.tgz",
+      "integrity": "sha1-ivHkwSISRMxiRZ+vOJQNTmRKVyM=",
       "license": "MIT"
     },
     "node_modules/isexe": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
       "license": "ISC"
     },
     "node_modules/istanbul-lib-coverage": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
-      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
+      "integrity": "sha1-LRZsSwZE1Do58Ev2wu3R5YXzF1Y=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=8"
@@ -12149,8 +12135,8 @@
     },
     "node_modules/istanbul-lib-instrument": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-instrument/-/istanbul-lib-instrument-5.2.1.tgz",
-      "integrity": "sha512-pzqtp31nLv/XFOzXGuvhCb8qhjmTVo5vjVk19XE4CRlSWz0KoeJ3bw9XsA7nOp9YBf4qHjwBxkDzKcME/J29Yg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/istanbul-lib-instrument/-/istanbul-lib-instrument-5.2.1.tgz",
+      "integrity": "sha1-0QyIhcISVXThwjHKyt+VVnXhzj0=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@babel/core": "^7.12.3",
@@ -12165,8 +12151,8 @@
     },
     "node_modules/istanbul-lib-instrument/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -12174,8 +12160,8 @@
     },
     "node_modules/istanbul-lib-report": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
-      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
+      "integrity": "sha1-kIMFusmlvRdaxqdEier9D8JEWn0=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "istanbul-lib-coverage": "^3.0.0",
@@ -12188,8 +12174,8 @@
     },
     "node_modules/istanbul-lib-report/node_modules/make-dir": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
-      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/make-dir/-/make-dir-4.0.0.tgz",
+      "integrity": "sha1-w8IwencSd82WODBfkVwprnQbYU4=",
       "license": "MIT",
       "dependencies": {
         "semver": "^7.5.3"
@@ -12203,8 +12189,8 @@
     },
     "node_modules/istanbul-lib-source-maps": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-source-maps/-/istanbul-lib-source-maps-4.0.1.tgz",
-      "integrity": "sha512-n3s8EwkdFIJCG3BPKBYvskgXGoy88ARzvegkitk60NxRdwltLOTaH7CUiMRXvwYorl0Q712iEjcWB+fK/MrWVw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/istanbul-lib-source-maps/-/istanbul-lib-source-maps-4.0.1.tgz",
+      "integrity": "sha1-iV86cJ/PujTG3lpCk5Ai8+Q1hVE=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "debug": "^4.1.1",
@@ -12217,8 +12203,8 @@
     },
     "node_modules/istanbul-lib-source-maps/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -12226,8 +12212,8 @@
     },
     "node_modules/istanbul-reports": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
-      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
+      "integrity": "sha1-y0U1FitXhKpiPO4hpyUs8sgHrJM=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "html-escaper": "^2.0.0",
@@ -12239,8 +12225,8 @@
     },
     "node_modules/iterator.prototype": {
       "version": "1.1.5",
-      "resolved": "https://registry.npmjs.org/iterator.prototype/-/iterator.prototype-1.1.5.tgz",
-      "integrity": "sha512-H0dkQoCa3b2VEeKQBOxFph+JAbcrQdE7KC0UkqwpLmv2EC4P41QXP+rqo9wYodACiG5/WM5s9oDApTU8utwj9g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/iterator.prototype/-/iterator.prototype-1.1.5.tgz",
+      "integrity": "sha1-EslZop3jLeCqO7u4AfTXdwZtrjk=",
       "license": "MIT",
       "dependencies": {
         "define-data-property": "^1.1.4",
@@ -12256,8 +12242,8 @@
     },
     "node_modules/jake": {
       "version": "10.9.4",
-      "resolved": "https://registry.npmjs.org/jake/-/jake-10.9.4.tgz",
-      "integrity": "sha512-wpHYzhxiVQL+IV05BLE2Xn34zW1S223hvjtqk0+gsPrwd/8JNLXJgZZM/iPFsYc1xyphF+6M6EvdE5E9MBGkDA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jake/-/jake-10.9.4.tgz",
+      "integrity": "sha1-1ibaEIxj1c+wCrXCX63H4AhK+OY=",
       "license": "Apache-2.0",
       "dependencies": {
         "async": "^3.2.6",
@@ -12273,8 +12259,8 @@
     },
     "node_modules/jest": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest/-/jest-27.5.1.tgz",
-      "integrity": "sha512-Yn0mADZB89zTtjkPJEXwrac3LHudkQMR+Paqa8uxJHCBr9agxztUifWCyiYrjhMPBoUVBjyny0I7XH6ozDr7QQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest/-/jest-27.5.1.tgz",
+      "integrity": "sha1-2t8zunCneb56b8MwFYQ7UUlPY/w=",
       "license": "MIT",
       "dependencies": {
         "@jest/core": "^27.5.1",
@@ -12298,8 +12284,8 @@
     },
     "node_modules/jest-changed-files": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-27.5.1.tgz",
-      "integrity": "sha512-buBLMiByfWGCoMsLLzGUUSpAmIAGnbR2KJoMN10ziLhOLvP4e0SlypHnAel8iqQXTrcbmfEY9sSqae5sgUsTvw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-changed-files/-/jest-changed-files-27.5.1.tgz",
+      "integrity": "sha1-o0iu0A7Jv2ccxYpm/L58Pf1qaPU=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -12312,8 +12298,8 @@
     },
     "node_modules/jest-circus": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-27.5.1.tgz",
-      "integrity": "sha512-D95R7x5UtlMA5iBYsOHFFbMD/GVA4R/Kdq15f7xYWUfWHBto9NYRsOvnSauTgdF+ogCpJ4tyKOXhUifxS65gdw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-circus/-/jest-circus-27.5.1.tgz",
+      "integrity": "sha1-N6WkRZt79EBuU9Y3tJ0ixl0SXsw=",
       "license": "MIT",
       "dependencies": {
         "@jest/environment": "^27.5.1",
@@ -12342,8 +12328,8 @@
     },
     "node_modules/jest-cli": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-27.5.1.tgz",
-      "integrity": "sha512-Hc6HOOwYq4/74/c62dEE3r5elx8wjYqxY0r0G/nFrLDPMFRu6RA/u8qINOIkvhxG7mMQ5EJsOGfRpI8L6eFUVw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-cli/-/jest-cli-27.5.1.tgz",
+      "integrity": "sha1-J4eUpuZFjqgClUfmxsv2c70wsUU=",
       "license": "MIT",
       "dependencies": {
         "@jest/core": "^27.5.1",
@@ -12376,8 +12362,8 @@
     },
     "node_modules/jest-config": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-27.5.1.tgz",
-      "integrity": "sha512-5sAsjm6tGdsVbW9ahcChPAFCk4IlkQUknH5AvKjuLTSlcO/wCZKyFdn7Rg0EkC+OGgWODEy2hDpWB1PgzH0JNA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-config/-/jest-config-27.5.1.tgz",
+      "integrity": "sha1-XDh94z3KP5mtY1fd7M2RvzoOSkE=",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.8.0",
@@ -12419,8 +12405,8 @@
     },
     "node_modules/jest-diff": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-27.5.1.tgz",
-      "integrity": "sha512-m0NvkX55LDt9T4mctTEgnZk3fmEg3NRYutvMPWM/0iPnkFj2wIeF45O1718cMSOFO1vINkqmxqD8vE37uTEbqw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-diff/-/jest-diff-27.5.1.tgz",
+      "integrity": "sha1-oH9QEayeZkPPipWkYrex7PZoDe8=",
       "license": "MIT",
       "dependencies": {
         "chalk": "^4.0.0",
@@ -12434,8 +12420,8 @@
     },
     "node_modules/jest-docblock": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-27.5.1.tgz",
-      "integrity": "sha512-rl7hlABeTsRYxKiUfpHrQrG4e2obOiTQWfMEH3PxPjOtdsfLQO4ReWSZaQ7DETm4xu07rl4q/h4zcKXyU0/OzQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-docblock/-/jest-docblock-27.5.1.tgz",
+      "integrity": "sha1-FAkvNkpCxhCNQsM8jPMOBY4l9sA=",
       "license": "MIT",
       "dependencies": {
         "detect-newline": "^3.0.0"
@@ -12446,8 +12432,8 @@
     },
     "node_modules/jest-each": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-27.5.1.tgz",
-      "integrity": "sha512-1Ff6p+FbhT/bXQnEouYy00bkNSY7OUpfIcmdl8vZ31A1UUaurOLPA8a8BbJOF2RDUElwJhmeaV7LnagI+5UwNQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-each/-/jest-each-27.5.1.tgz",
+      "integrity": "sha1-W8hwFvRe2VB/7W5HAqW0aKWyxE4=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -12462,8 +12448,8 @@
     },
     "node_modules/jest-environment-jsdom": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-environment-jsdom/-/jest-environment-jsdom-27.5.1.tgz",
-      "integrity": "sha512-TFBvkTC1Hnnnrka/fUb56atfDtJ9VMZ94JkjTbggl1PEpwrYtUBKMezB3inLmWqQsXYLcMwNoDQwoBTAvFfsfw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-environment-jsdom/-/jest-environment-jsdom-27.5.1.tgz",
+      "integrity": "sha1-6pzNH8YQIJZVp3iY+GsrVZUWpUY=",
       "license": "MIT",
       "dependencies": {
         "@jest/environment": "^27.5.1",
@@ -12480,8 +12466,8 @@
     },
     "node_modules/jest-environment-node": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-27.5.1.tgz",
-      "integrity": "sha512-Jt4ZUnxdOsTGwSRAfKEnE6BcwsSPNOijjwifq5sDFSA2kesnXTvNqKHYgM0hDq3549Uf/KzdXNYn4wMZJPlFLw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-environment-node/-/jest-environment-node-27.5.1.tgz",
+      "integrity": "sha1-3tws/lL6trj1cUtICK76hTV6Nl4=",
       "license": "MIT",
       "dependencies": {
         "@jest/environment": "^27.5.1",
@@ -12497,8 +12483,8 @@
     },
     "node_modules/jest-get-type": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-get-type/-/jest-get-type-27.5.1.tgz",
-      "integrity": "sha512-2KY95ksYSaK7DMBWQn6dQz3kqAf3BB64y2udeG+hv4KfSOb9qwcYQstTJc1KCbsix+wLZWZYN8t7nwX3GOBLRw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-get-type/-/jest-get-type-27.5.1.tgz",
+      "integrity": "sha1-PNYTxQew96zgE99Aehwc1Xi8tPE=",
       "license": "MIT",
       "engines": {
         "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
@@ -12506,8 +12492,8 @@
     },
     "node_modules/jest-haste-map": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-27.5.1.tgz",
-      "integrity": "sha512-7GgkZ4Fw4NFbMSDSpZwXeBiIbx+t/46nJ2QitkOjvwPYyZmqttu2TDSimMHP1EkPOi4xUZAN1doE5Vd25H4Jng==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-haste-map/-/jest-haste-map-27.5.1.tgz",
+      "integrity": "sha1-n9i9fntPpQLZxhZMVkBRK06BHn8=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -12532,8 +12518,8 @@
     },
     "node_modules/jest-jasmine2": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-jasmine2/-/jest-jasmine2-27.5.1.tgz",
-      "integrity": "sha512-jtq7VVyG8SqAorDpApwiJJImd0V2wv1xzdheGHRGyuT7gZm6gG47QEskOlzsN1PG/6WNaCo5pmwMHDf3AkG2pQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-jasmine2/-/jest-jasmine2-27.5.1.tgz",
+      "integrity": "sha1-oDewA070mp89ccQ3WnlvOyMNGsQ=",
       "license": "MIT",
       "dependencies": {
         "@jest/environment": "^27.5.1",
@@ -12560,8 +12546,8 @@
     },
     "node_modules/jest-leak-detector": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-27.5.1.tgz",
-      "integrity": "sha512-POXfWAMvfU6WMUXftV4HolnJfnPOGEu10fscNCA76KBpRRhcMN2c8d3iT2pxQS3HLbA+5X4sOUPzYO2NUyIlHQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-leak-detector/-/jest-leak-detector-27.5.1.tgz",
+      "integrity": "sha1-bsnVTDV53W4+ZtcONJit+A/eP7g=",
       "license": "MIT",
       "dependencies": {
         "jest-get-type": "^27.5.1",
@@ -12573,8 +12559,8 @@
     },
     "node_modules/jest-matcher-utils": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-27.5.1.tgz",
-      "integrity": "sha512-z2uTx/T6LBaCoNWNFWwChLBKYxTMcGBRjAt+2SbP929/Fflb9aa5LGma654Rz8z9HLxsrUaYzxE9T/EFIL/PAw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-matcher-utils/-/jest-matcher-utils-27.5.1.tgz",
+      "integrity": "sha1-nAzb2oJFvCLSMxcp0QkTCLQM+Ks=",
       "license": "MIT",
       "dependencies": {
         "chalk": "^4.0.0",
@@ -12588,8 +12574,8 @@
     },
     "node_modules/jest-message-util": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-27.5.1.tgz",
-      "integrity": "sha512-rMyFe1+jnyAAf+NHwTclDz0eAaLkVDdKVHHBFWsBWHnnh5YeJMNWWsv7AbFYXfK3oTqvL7VTWkhNLu1jX24D+g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-message-util/-/jest-message-util-27.5.1.tgz",
+      "integrity": "sha1-vdpygG2hDZ7WQl4Sr/84zRRYts8=",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.12.13",
@@ -12608,8 +12594,8 @@
     },
     "node_modules/jest-mock": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-27.5.1.tgz",
-      "integrity": "sha512-K4jKbY1d4ENhbrG2zuPWaQBvDly+iZ2yAW+T1fATN78hc0sInwn7wZB8XtlNnvHug5RMwV897Xm4LqmPM4e2Og==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-mock/-/jest-mock-27.5.1.tgz",
+      "integrity": "sha1-GZSDNtSe9NnFICHTSse182/5Z9Y=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -12621,8 +12607,8 @@
     },
     "node_modules/jest-pnp-resolver": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz",
-      "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz",
+      "integrity": "sha1-kwsVRhZNStWTfVVA5xHU041MrS4=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -12638,8 +12624,8 @@
     },
     "node_modules/jest-regex-util": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-27.5.1.tgz",
-      "integrity": "sha512-4bfKq2zie+x16okqDXjXn9ql2B0dScQu+vcwe4TvFVhkVyuWLqpZrZtXxLLWoXYgn0E87I6r6GRYHF7wFZBUvg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-regex-util/-/jest-regex-util-27.5.1.tgz",
+      "integrity": "sha1-TaFD9+n9HlQtSqaWF7OOSng2W5U=",
       "license": "MIT",
       "engines": {
         "node": "^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0"
@@ -12647,8 +12633,8 @@
     },
     "node_modules/jest-resolve": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-27.5.1.tgz",
-      "integrity": "sha512-FFDy8/9E6CV83IMbDpcjOhumAQPDyETnU2KZ1O98DwTnz8AOBsW/Xv3GySr1mOZdItLR+zDZ7I/UdTFbgSOVCw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-resolve/-/jest-resolve-27.5.1.tgz",
+      "integrity": "sha1-ovHFoHluwY/p6xU2rDgUwjYXs4Q=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -12668,8 +12654,8 @@
     },
     "node_modules/jest-resolve-dependencies": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-27.5.1.tgz",
-      "integrity": "sha512-QQOOdY4PE39iawDn5rzbIePNigfe5B9Z91GDD1ae/xNDlu9kaat8QQ5EKnNmVWPV54hUdxCVwwj6YMgR2O7IOg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-resolve-dependencies/-/jest-resolve-dependencies-27.5.1.tgz",
+      "integrity": "sha1-2BHsyDBecxzIbdeXQe6Y/tBvHag=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -12682,8 +12668,8 @@
     },
     "node_modules/jest-runner": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-27.5.1.tgz",
-      "integrity": "sha512-g4NPsM4mFCOwFKXO4p/H/kWGdJp9V8kURY2lX8Me2drgXqG7rrZAx5kv+5H7wtt/cdFIjhqYx1HrlqWHaOvDaQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-runner/-/jest-runner-27.5.1.tgz",
+      "integrity": "sha1-Bxsnwfow2QVAgFxWRaDsFnx7YuU=",
       "license": "MIT",
       "dependencies": {
         "@jest/console": "^27.5.1",
@@ -12714,8 +12700,8 @@
     },
     "node_modules/jest-runtime": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-27.5.1.tgz",
-      "integrity": "sha512-o7gxw3Gf+H2IGt8fv0RiyE1+r83FJBRruoA+FXrlHw6xEyBsU8ugA6IPfTdVyA0w8HClpbK+DGJxH59UrNMx8A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-runtime/-/jest-runtime-27.5.1.tgz",
+      "integrity": "sha1-SJYAPXozT36OSlO6k/ubzT2woa8=",
       "license": "MIT",
       "dependencies": {
         "@jest/environment": "^27.5.1",
@@ -12747,8 +12733,8 @@
     },
     "node_modules/jest-serializer": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-serializer/-/jest-serializer-27.5.1.tgz",
-      "integrity": "sha512-jZCyo6iIxO1aqUxpuBlwTDMkzOAJS4a3eYz3YzgxxVQFwLeSA7Jfq5cbqCY+JLvTDrWirgusI/0KwxKMgrdf7w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-serializer/-/jest-serializer-27.5.1.tgz",
+      "integrity": "sha1-gUOEEKMOpm/Vf/cwg1Ej3qH7H2Q=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
@@ -12760,8 +12746,8 @@
     },
     "node_modules/jest-snapshot": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-27.5.1.tgz",
-      "integrity": "sha512-yYykXI5a0I31xX67mgeLw1DZ0bJB+gpq5IpSuCAoyDi0+BhgU/RIrL+RTzDmkNTchvDFWKP8lp+w/42Z3us5sA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-snapshot/-/jest-snapshot-27.5.1.tgz",
+      "integrity": "sha1-tmjVDSPTgFSlG0LEA5yrWa5utqE=",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.7.2",
@@ -12793,8 +12779,8 @@
     },
     "node_modules/jest-util": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-27.5.1.tgz",
-      "integrity": "sha512-Kv2o/8jNvX1MQ0KGtw480E/w4fBCDOnH6+6DmeKi6LZUIlKA5kwY0YNdlzaWTiVgxqAqik11QyxDOKk543aKXw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-util/-/jest-util-27.5.1.tgz",
+      "integrity": "sha1-O6l3Ho4xoLhdpI/gsIkfuGwBwvk=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -12810,8 +12796,8 @@
     },
     "node_modules/jest-validate": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-27.5.1.tgz",
-      "integrity": "sha512-thkNli0LYTmOI1tDB3FI1S1RTp/Bqyd9pTarJwL87OIBFuqEb5Apv5EaApEudYg4g86e3CT6kM0RowkhtEnCBQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-validate/-/jest-validate-27.5.1.tgz",
+      "integrity": "sha1-kZfVTcC9tSJguNtAtGrmaOBN8Gc=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^27.5.1",
@@ -12827,8 +12813,8 @@
     },
     "node_modules/jest-watch-typeahead": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/jest-watch-typeahead/-/jest-watch-typeahead-1.1.0.tgz",
-      "integrity": "sha512-Va5nLSJTN7YFtC2jd+7wsoe1pNe5K4ShLux/E5iHEwlB9AxaxmggY7to9KUqKojhaJw3aXqt5WAb4jGPOolpEw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-watch-typeahead/-/jest-watch-typeahead-1.1.0.tgz",
+      "integrity": "sha1-tKaCbfuclCDaL3vJAN5Z2tESZqk=",
       "license": "MIT",
       "dependencies": {
         "ansi-escapes": "^4.3.1",
@@ -12848,8 +12834,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/@jest/console": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/console/-/console-28.1.3.tgz",
-      "integrity": "sha512-QPAkP5EwKdK/bxIr6C1I4Vs0rm2nHiANzj/Z5X2JQkrZo6IqvC4ldZ9K95tF0HdidhA8Bo6egxSzUFPYKcEXLw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/console/-/console-28.1.3.tgz",
+      "integrity": "sha1-IDBgbsA6GMMYA7ijY4J2LkR2Vd8=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^28.1.3",
@@ -12865,8 +12851,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/@jest/console/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha1-ZTm+hwwWWtvVJAIg2+Nh8bxNRjQ=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -12874,8 +12860,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/@jest/test-result": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-28.1.3.tgz",
-      "integrity": "sha512-kZAkxnSE+FqE8YjW8gNuoVkkC9I7S1qmenl8sGcDOLropASP+BkcGKwhXoyqQuGOGeYY0y/ixjrd/iERpEXHNg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/test-result/-/test-result-28.1.3.tgz",
+      "integrity": "sha1-Xq6UX9n0uPz8500jnm9yW2vwdsU=",
       "license": "MIT",
       "dependencies": {
         "@jest/console": "^28.1.3",
@@ -12889,8 +12875,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/@jest/types": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-28.1.3.tgz",
-      "integrity": "sha512-RyjiyMUZrKz/c+zlMFO1pm70DcIlST8AeWTkoUdZevew44wcNZQHsEVOiCVtgVnlFFD82FPaXycys58cf2muVQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@jest/types/-/types-28.1.3.tgz",
+      "integrity": "sha1-sF3oCZb/ElErxc6x0ggoWn0RdIs=",
       "license": "MIT",
       "dependencies": {
         "@jest/schemas": "^28.1.3",
@@ -12906,8 +12892,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/@types/yargs": {
       "version": "17.0.35",
-      "resolved": "https://registry.npmjs.org/@types/yargs/-/yargs-17.0.35.tgz",
-      "integrity": "sha512-qUHkeCyQFxMXg79wQfTtfndEC+N9ZZg76HJftDJp+qH2tV7Gj4OJi7l+PiWwJ+pWtW8GwSmqsDj/oymhrTWXjg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/@types/yargs/-/yargs-17.0.35.tgz",
+      "integrity": "sha1-BwE+RqpNfX1QpJ4VYEwcU0DU6yQ=",
       "license": "MIT",
       "dependencies": {
         "@types/yargs-parser": "*"
@@ -12915,8 +12901,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/ansi-styles": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
-      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha1-B0SWkK1Fd30ZJKwquy/IiV26g2s=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -12927,8 +12913,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/emittery": {
       "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/emittery/-/emittery-0.10.2.tgz",
-      "integrity": "sha512-aITqOwnLanpHLNXZJENbOgjUBeHocD+xsSJmNrjovKBW5HbSpW3d1pEls7GFQPUWXiwG9+0P4GtHfEqC/4M0Iw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/emittery/-/emittery-0.10.2.tgz",
+      "integrity": "sha1-kC7siu24xBk4xG6ThenbfgMYKTM=",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -12939,8 +12925,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/jest-message-util": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-28.1.3.tgz",
-      "integrity": "sha512-PFdn9Iewbt575zKPf1286Ht9EPoJmYT7P0kY+RibeYZ2XtOr53pDLEFoTWXbd1h4JiGiWpTBC84fc8xMXQMb7g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-message-util/-/jest-message-util-28.1.3.tgz",
+      "integrity": "sha1-Iy3vfy4zPx7syQZJtblLAFXnxD0=",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.12.13",
@@ -12959,8 +12945,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/jest-message-util/node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha1-ZTm+hwwWWtvVJAIg2+Nh8bxNRjQ=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -12968,8 +12954,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/jest-regex-util": {
       "version": "28.0.2",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-28.0.2.tgz",
-      "integrity": "sha512-4s0IgyNIy0y9FK+cjoVYoxamT7Zeo7MhzqRGx7YDYmaQn1wucY9rotiGkBzzcMXTtjrCAP/f7f+E0F7+fxPNdw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-regex-util/-/jest-regex-util-28.0.2.tgz",
+      "integrity": "sha1-r9w3ejsl+26Aglrc92yFTlv0fq0=",
       "license": "MIT",
       "engines": {
         "node": "^12.13.0 || ^14.15.0 || ^16.10.0 || >=17.0.0"
@@ -12977,8 +12963,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/jest-util": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-28.1.3.tgz",
-      "integrity": "sha512-XdqfpHwpcSRko/C35uLYFM2emRAltIIKZiJ9eAmhjsj0CqZMa0p1ib0R5fWIqGhn1a103DebTbpqIaP1qCQ6tQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-util/-/jest-util-28.1.3.tgz",
+      "integrity": "sha1-9PkyqgB08GeZQyIP+cu6fklwKLA=",
       "license": "MIT",
       "dependencies": {
         "@jest/types": "^28.1.3",
@@ -12994,8 +12980,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/jest-watcher": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-28.1.3.tgz",
-      "integrity": "sha512-t4qcqj9hze+jviFPUN3YAtAEeFnr/azITXQEMARf5cMwKY2SMBRnCQTXLixTl20OR6mLh9KLMrgVJgJISym+1g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-watcher/-/jest-watcher-28.1.3.tgz",
+      "integrity": "sha1-xgI6WboiVeO0xXF5/JQWSz5zq9Q=",
       "license": "MIT",
       "dependencies": {
         "@jest/test-result": "^28.1.3",
@@ -13013,8 +12999,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/jest-watcher/node_modules/string-length": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/string-length/-/string-length-4.0.2.tgz",
-      "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string-length/-/string-length-4.0.2.tgz",
+      "integrity": "sha1-qKjce9XBqCubPIuH4SX2aHG25Xo=",
       "license": "MIT",
       "dependencies": {
         "char-regex": "^1.0.2",
@@ -13026,8 +13012,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/jest-watcher/node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha1-nibGPTD1NEPpSJSVshBdN7Z6hdk=",
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -13038,8 +13024,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/pretty-format": {
       "version": "28.1.3",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-28.1.3.tgz",
-      "integrity": "sha512-8gFb/To0OmxHR9+ZTb14Df2vNxdGCX8g1xWGUTqUw5TiZvcQf5sHKObd5UcPyLLyowNwDAMTF3XWOG1B6mxl1Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/pretty-format/-/pretty-format-28.1.3.tgz",
+      "integrity": "sha1-yfuozt+ZzlCWOhGyfZgqmukJcNU=",
       "license": "MIT",
       "dependencies": {
         "@jest/schemas": "^28.1.3",
@@ -13053,14 +13039,14 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/react-is": {
       "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-is/-/react-is-18.3.1.tgz",
+      "integrity": "sha1-6DVX3BLq5jqZ4AOkY4ix3LtE234=",
       "license": "MIT"
     },
     "node_modules/jest-watch-typeahead/node_modules/slash": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
-      "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/slash/-/slash-4.0.0.tgz",
+      "integrity": "sha1-JCI3IXbExsWt214q2oha+YSzlqc=",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -13071,8 +13057,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/string-length": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/string-length/-/string-length-5.0.1.tgz",
-      "integrity": "sha512-9Ep08KAMUn0OadnVaBuRdE2l615CQ508kr0XMadjClfYpdCyvrbFp6Taebo8yyxokQ4viUd/xPPUA4FGgUa0ow==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string-length/-/string-length-5.0.1.tgz",
+      "integrity": "sha1-PWR/SXtujo1B5CL34LI7xTbIOB4=",
       "license": "MIT",
       "dependencies": {
         "char-regex": "^2.0.0",
@@ -13087,8 +13073,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/string-length/node_modules/char-regex": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/char-regex/-/char-regex-2.0.2.tgz",
-      "integrity": "sha512-cbGOjAptfM2LVmWhwRFHEKTPkLwNddVmuqYZQt895yXwAsWsXObCG+YN4DGQ/JBtT4GP1a1lPPdio2z413LmTg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/char-regex/-/char-regex-2.0.2.tgz",
+      "integrity": "sha1-gThbsHGvTfd0v/hyHQyhXvKeoLs=",
       "license": "MIT",
       "engines": {
         "node": ">=12.20"
@@ -13096,8 +13082,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/strip-ansi": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha1-0iomlSKDamJ6+NBLXD/Sx/o+MuM=",
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^6.2.2"
@@ -13111,8 +13097,8 @@
     },
     "node_modules/jest-watch-typeahead/node_modules/strip-ansi/node_modules/ansi-regex": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ansi-regex/-/ansi-regex-6.2.2.tgz",
+      "integrity": "sha1-YCFu6kZNhkWXzigyAAc4oFiWUME=",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -13123,8 +13109,8 @@
     },
     "node_modules/jest-watcher": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-27.5.1.tgz",
-      "integrity": "sha512-z676SuD6Z8o8qbmEGhoEUFOM1+jfEiL3DXHK/xgEiG2EyNYfFG60jluWcupY6dATjfEsKQuibReS1djInQnoVw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-watcher/-/jest-watcher-27.5.1.tgz",
+      "integrity": "sha1-cb2F+5veOiwuxNw1NDeXHEPGQqI=",
       "license": "MIT",
       "dependencies": {
         "@jest/test-result": "^27.5.1",
@@ -13141,8 +13127,8 @@
     },
     "node_modules/jest-worker": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-27.5.1.tgz",
-      "integrity": "sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-worker/-/jest-worker-27.5.1.tgz",
+      "integrity": "sha1-jRRvCQDolzsQa29zzB6ajLhvjbA=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
@@ -13155,8 +13141,8 @@
     },
     "node_modules/jest-worker/node_modules/supports-color": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
-      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/supports-color/-/supports-color-8.1.1.tgz",
+      "integrity": "sha1-zW/BfihQDP9WwbhsCn/UpUpzAFw=",
       "license": "MIT",
       "dependencies": {
         "has-flag": "^4.0.0"
@@ -13170,8 +13156,8 @@
     },
     "node_modules/jiti": {
       "version": "1.21.7",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-1.21.7.tgz",
-      "integrity": "sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jiti/-/jiti-1.21.7.tgz",
+      "integrity": "sha1-ndgQQ0JKPShFixk9ll8NGKIwC6k=",
       "license": "MIT",
       "bin": {
         "jiti": "bin/jiti.js"
@@ -13179,14 +13165,27 @@
     },
     "node_modules/js-tokens": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
-      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha1-GSA/tZmR35jjoocFDUZHzerzJJk=",
       "license": "MIT"
     },
+    "node_modules/js-yaml": {
+      "version": "3.15.1",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/js-yaml/-/js-yaml-3.15.1.tgz",
+      "integrity": "sha1-JLyVAo82HNqqhHRbBqEJxEhnc8A=",
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^1.0.7",
+        "esprima": "^4.0.0"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
     "node_modules/jsdom": {
       "version": "16.7.0",
-      "resolved": "https://registry.npmjs.org/jsdom/-/jsdom-16.7.0.tgz",
-      "integrity": "sha512-u9Smc2G1USStM+s/x1ru5Sxrl6mPYCbByG1U/hUmqaVsm4tbNyS7CicOSRyuGQYZhTu0h84qkZZQ/I+dzizSVw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jsdom/-/jsdom-16.7.0.tgz",
+      "integrity": "sha1-kYrnGWVCSxl8gZ+Bg6dU4Yl3txA=",
       "license": "MIT",
       "dependencies": {
         "abab": "^2.0.5",
@@ -13231,8 +13230,8 @@
     },
     "node_modules/jsdom/node_modules/form-data": {
       "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-3.0.5.tgz",
-      "integrity": "sha512-j23EibVLnp4zNXGW7LjryXYa2X6U/M96yoOX+ybZxwkYajdxRNEqYY3zhh7y0i6kfISKS2jr+EJq1YTUDEv5+w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/form-data/-/form-data-3.0.5.tgz",
+      "integrity": "sha1-LqPsJPDct+AmKhHvtzIDEkDqjp8=",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
@@ -13247,8 +13246,8 @@
     },
     "node_modules/jsesc": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-3.1.0.tgz",
-      "integrity": "sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jsesc/-/jsesc-3.1.0.tgz",
+      "integrity": "sha1-dNM1ojT2ftGZB/2t+sfM+dQJgl0=",
       "license": "MIT",
       "bin": {
         "jsesc": "bin/jsesc"
@@ -13259,32 +13258,32 @@
     },
     "node_modules/json-buffer": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json-buffer/-/json-buffer-3.0.1.tgz",
+      "integrity": "sha1-kziAKjDTtmBfvgYT4JQAjKjAWhM=",
       "license": "MIT"
     },
     "node_modules/json-parse-even-better-errors": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
-      "integrity": "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json-parse-even-better-errors/-/json-parse-even-better-errors-2.3.1.tgz",
+      "integrity": "sha1-fEeAWpQxmSjgV3dAXcEuH3pO4C0=",
       "license": "MIT"
     },
     "node_modules/json-schema-traverse": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha1-rnvLNlard6c7pcSb9lTzjmtoYOI=",
       "license": "MIT"
     },
     "node_modules/json-stable-stringify-without-jsonify": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
       "license": "MIT"
     },
     "node_modules/json5": {
       "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha1-eM1vGhm9wStz21rQxh79ZsHikoM=",
       "license": "MIT",
       "bin": {
         "json5": "lib/cli.js"
@@ -13295,8 +13294,8 @@
     },
     "node_modules/jsonfile": {
       "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
-      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jsonfile/-/jsonfile-6.2.1.tgz",
+      "integrity": "sha1-tuMXF/Isw3MwsIHOAFHtXeU68vY=",
       "license": "MIT",
       "dependencies": {
         "universalify": "^2.0.0"
@@ -13307,8 +13306,8 @@
     },
     "node_modules/jsonpath": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/jsonpath/-/jsonpath-1.3.0.tgz",
-      "integrity": "sha512-0kjkYHJBkAy50Z5QzArZ7udmvxrJzkpKYW27fiF//BrMY7TQibYLl+FYIXN2BiYmwMIVzSfD8aDRj6IzgBX2/w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jsonpath/-/jsonpath-1.3.0.tgz",
+      "integrity": "sha1-YjGXlw+0M4RcaAJL+eK4ZPU3arI=",
       "license": "MIT",
       "dependencies": {
         "esprima": "1.2.5",
@@ -13318,8 +13317,8 @@
     },
     "node_modules/jsonpath/node_modules/esprima": {
       "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-1.2.5.tgz",
-      "integrity": "sha512-S9VbPDU0adFErpDai3qDkjq8+G05ONtKzcyNrPKg/ZKa+tf879nX2KexNU95b31UoTJjRLInNBHHHjFPoCd7lQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/esprima/-/esprima-1.2.5.tgz",
+      "integrity": "sha1-CZNQL+r2aBODJXVvMPmlH+7sEek=",
       "bin": {
         "esparse": "bin/esparse.js",
         "esvalidate": "bin/esvalidate.js"
@@ -13330,8 +13329,8 @@
     },
     "node_modules/jsonpointer": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/jsonpointer/-/jsonpointer-5.0.1.tgz",
-      "integrity": "sha512-p/nXbhSEcu3pZRdkW1OfJhpsVtW1gd4Wa1fnQc9YLiTfAjn0312eMKimbdIQzuZl9aa9xUGaRlP9T/CJE/ditQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jsonpointer/-/jsonpointer-5.0.1.tgz",
+      "integrity": "sha1-IRDgrwkA/TdGe1kH7NE6eIShtVk=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -13339,8 +13338,8 @@
     },
     "node_modules/jsx-ast-utils": {
       "version": "3.3.5",
-      "resolved": "https://registry.npmjs.org/jsx-ast-utils/-/jsx-ast-utils-3.3.5.tgz",
-      "integrity": "sha512-ZZow9HBI5O6EPgSJLUb8n2NKgmVWTwCvHGwFuJlMjvLFqlGG6pjirPhtdsseaLZjSibD8eegzmYpUZwoIlj2cQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jsx-ast-utils/-/jsx-ast-utils-3.3.5.tgz",
+      "integrity": "sha1-R2a9BajioRryIr7NGeFVdeUqhTo=",
       "license": "MIT",
       "dependencies": {
         "array-includes": "^3.1.6",
@@ -13354,14 +13353,14 @@
     },
     "node_modules/keyborg": {
       "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/keyborg/-/keyborg-2.14.1.tgz",
-      "integrity": "sha512-/WmmVBa6Me3hIKAOIyIq1sql+6oydQZzGMBDLNfOcJ8710byMsq3KSLS8GQhBJHOMtvnXnUBrDAIbABcZVipcg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/keyborg/-/keyborg-2.14.1.tgz",
+      "integrity": "sha1-BElZ/w5PldBi0eB+LToPvCrRHTA=",
       "license": "MIT"
     },
     "node_modules/keyv": {
       "version": "4.5.4",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/keyv/-/keyv-4.5.4.tgz",
+      "integrity": "sha1-qHmpnilFL5QkOfKkBeOvizHU3pM=",
       "license": "MIT",
       "dependencies": {
         "json-buffer": "3.0.1"
@@ -13369,8 +13368,8 @@
     },
     "node_modules/kind-of": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
-      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/kind-of/-/kind-of-6.0.3.tgz",
+      "integrity": "sha1-B8BQNKbDSfoG4k+jWqdttFgM5N0=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -13378,8 +13377,8 @@
     },
     "node_modules/kleur": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz",
-      "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/kleur/-/kleur-3.0.3.tgz",
+      "integrity": "sha1-p5yezIbuHOP6YgbRIWxQHxR/wH4=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -13387,8 +13386,8 @@
     },
     "node_modules/klona": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/klona/-/klona-2.0.6.tgz",
-      "integrity": "sha512-dhG34DXATL5hSxJbIexCft8FChFXtmskoZYnoPWjXQuebWYCNkVeV3KkGegCK9CP1oswI/vQibS2GY7Em/sJJA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/klona/-/klona-2.0.6.tgz",
+      "integrity": "sha1-hb/7+BnAOy9TJwQSQgpFVe+ILiI=",
       "license": "MIT",
       "engines": {
         "node": ">= 8"
@@ -13396,14 +13395,14 @@
     },
     "node_modules/language-subtag-registry": {
       "version": "0.3.23",
-      "resolved": "https://registry.npmjs.org/language-subtag-registry/-/language-subtag-registry-0.3.23.tgz",
-      "integrity": "sha512-0K65Lea881pHotoGEa5gDlMxt3pctLi2RplBb7Ezh4rRdLEOtgi7n4EwK9lamnUCkKBqaeKRVebTq6BAxSkpXQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/language-subtag-registry/-/language-subtag-registry-0.3.23.tgz",
+      "integrity": "sha1-I1KeBNnjt0Z51wFC3z/S627Fcuc=",
       "license": "CC0-1.0"
     },
     "node_modules/language-tags": {
       "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/language-tags/-/language-tags-1.0.9.tgz",
-      "integrity": "sha512-MbjN408fEndfiQXbFQ1vnd+1NoLDsnQW41410oQBXiyXDMYH5z505juWa4KUE1LqxRC7DgOgZDbKLxHIwm27hA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/language-tags/-/language-tags-1.0.9.tgz",
+      "integrity": "sha1-H/3NDsD6+0sb5/ixHzBq0PnAh3c=",
       "license": "MIT",
       "dependencies": {
         "language-subtag-registry": "^0.3.20"
@@ -13414,8 +13413,8 @@
     },
     "node_modules/launch-editor": {
       "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/launch-editor/-/launch-editor-2.14.1.tgz",
-      "integrity": "sha512-QWBrQsMpH7gPr965dsKD/3cKWiNoTjpATQf++Xq63N6sKRGMwlVXz41O1IZTMfZQgBctD/K5Zt06+/I6pP6+HA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/launch-editor/-/launch-editor-2.14.1.tgz",
+      "integrity": "sha1-9+DaP1iq6gP+oBB02EC19zntfdw=",
       "license": "MIT",
       "dependencies": {
         "picocolors": "^1.1.1",
@@ -13424,8 +13423,8 @@
     },
     "node_modules/leven": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/leven/-/leven-3.1.0.tgz",
-      "integrity": "sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/leven/-/leven-3.1.0.tgz",
+      "integrity": "sha1-d4kd6DQGTMy6gq54QrtrFKE+1/I=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -13433,8 +13432,8 @@
     },
     "node_modules/levn": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
-      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha1-rkViwAdHO5MqYgDUAyaN0v/8at4=",
       "license": "MIT",
       "dependencies": {
         "prelude-ls": "^1.2.1",
@@ -13446,8 +13445,8 @@
     },
     "node_modules/lilconfig": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.1.0.tgz",
-      "integrity": "sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lilconfig/-/lilconfig-2.1.0.tgz",
+      "integrity": "sha1-eOI6yJ67fhv78lsYBD3nVlSOf1I=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -13455,14 +13454,14 @@
     },
     "node_modules/lines-and-columns": {
       "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-1.2.4.tgz",
-      "integrity": "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lines-and-columns/-/lines-and-columns-1.2.4.tgz",
+      "integrity": "sha1-7KKE910pZQeTCdwK2SVauy68FjI=",
       "license": "MIT"
     },
     "node_modules/loader-utils": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.4.tgz",
-      "integrity": "sha512-xXqpXoINfFhgua9xiqD8fPFHgkoq1mmmpE92WlDbm9rNRd/EbRb+Gqf908T2DMfuHjjJlksiK2RbHVOdD/MqSw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/loader-utils/-/loader-utils-2.0.4.tgz",
+      "integrity": "sha1-i1yzi1w0qaAY7h/A5qBm0d/MUow=",
       "license": "MIT",
       "dependencies": {
         "big.js": "^5.2.2",
@@ -13475,8 +13474,8 @@
     },
     "node_modules/locate-path": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
-      "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/locate-path/-/locate-path-5.0.0.tgz",
+      "integrity": "sha1-Gvujlq/WdqbUJQTQpno6frn2KqA=",
       "license": "MIT",
       "dependencies": {
         "p-locate": "^4.1.0"
@@ -13487,38 +13486,38 @@
     },
     "node_modules/lodash": {
       "version": "4.18.1",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
-      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha1-/ytmwfYybVlRPeJAe/iBQ5gSdxw=",
       "license": "MIT"
     },
     "node_modules/lodash.debounce": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
-      "integrity": "sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lodash.debounce/-/lodash.debounce-4.0.8.tgz",
+      "integrity": "sha1-gteb/zCmfEAF/9XiUVMArZyk168=",
       "license": "MIT"
     },
     "node_modules/lodash.memoize": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/lodash.memoize/-/lodash.memoize-4.1.2.tgz",
-      "integrity": "sha512-t7j+NzmgnQzTAYXcsHYLgimltOV1MXHtlOWf6GjL9Kj8GK5FInw5JotxvbOs+IvV1/Dzo04/fCGfLVs7aXb4Ag==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lodash.memoize/-/lodash.memoize-4.1.2.tgz",
+      "integrity": "sha1-vMbEmkKihA7Zl/Mj6tpezRguC/4=",
       "license": "MIT"
     },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
-      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lodash.merge/-/lodash.merge-4.6.2.tgz",
+      "integrity": "sha1-VYqlO0O2YeGSWgr9+japoQhf5Xo=",
       "license": "MIT"
     },
     "node_modules/lodash.uniq": {
       "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.uniq/-/lodash.uniq-4.5.0.tgz",
-      "integrity": "sha512-xfBaXQd9ryd9dlSDvnvI0lvxfLJlYAZzXomUYzLKtUeOQvOP5piqAWuGtrhWeqaXK9hhoM/iyJc5AV+XfsX3HQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lodash.uniq/-/lodash.uniq-4.5.0.tgz",
+      "integrity": "sha1-0CJTc662Uq3BvILklFM5qEJ1R3M=",
       "license": "MIT"
     },
     "node_modules/loose-envify": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
-      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/loose-envify/-/loose-envify-1.4.0.tgz",
+      "integrity": "sha1-ce5R+nvkyuwaY4OffmgtgTLTDK8=",
       "license": "MIT",
       "dependencies": {
         "js-tokens": "^3.0.0 || ^4.0.0"
@@ -13529,8 +13528,8 @@
     },
     "node_modules/lower-case": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/lower-case/-/lower-case-2.0.2.tgz",
-      "integrity": "sha512-7fm3l3NAF9WfN6W3JOmf5drwpVqX78JtoGJ3A6W0a6ZnldM41w2fV5D490psKFTpMds8TJse/eHLFFsNHHjHgg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lower-case/-/lower-case-2.0.2.tgz",
+      "integrity": "sha1-b6I3xj29xKgsoP2ILkci3F5jTig=",
       "license": "MIT",
       "dependencies": {
         "tslib": "^2.0.3"
@@ -13538,8 +13537,8 @@
     },
     "node_modules/lru-cache": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
-      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lru-cache/-/lru-cache-5.1.1.tgz",
+      "integrity": "sha1-HaJ+ZxAnGUdpXa9oSOhH8B2EuSA=",
       "license": "ISC",
       "dependencies": {
         "yallist": "^3.0.2"
@@ -13547,8 +13546,8 @@
     },
     "node_modules/magic-string": {
       "version": "0.25.9",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.25.9.tgz",
-      "integrity": "sha512-RmF0AsMzgt25qzqqLc1+MbHmhdx0ojF2Fvs4XnOqz2ZOBXzzkEwc/dJQZCYHAn7v1jbVOjAZfK8msRn4BxO4VQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/magic-string/-/magic-string-0.25.9.tgz",
+      "integrity": "sha1-3n+fr5HvihyR0CwuUxTIJ3283Rw=",
       "license": "MIT",
       "dependencies": {
         "sourcemap-codec": "^1.4.8"
@@ -13556,8 +13555,8 @@
     },
     "node_modules/make-dir": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-3.1.0.tgz",
-      "integrity": "sha512-g3FeP20LNwhALb/6Cz6Dd4F2ngze0jz7tbzrD2wAV+o9FeNHe4rL+yK2md0J/fiSf1sa1ADhXqi5+oVwOM/eGw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/make-dir/-/make-dir-3.1.0.tgz",
+      "integrity": "sha1-QV6WcEazp/HRhSd9hKpYIDcmoT8=",
       "license": "MIT",
       "dependencies": {
         "semver": "^6.0.0"
@@ -13571,8 +13570,8 @@
     },
     "node_modules/make-dir/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -13580,8 +13579,8 @@
     },
     "node_modules/makeerror": {
       "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
-      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/makeerror/-/makeerror-1.0.12.tgz",
+      "integrity": "sha1-Pl3SB5qC6BLpg8xmEMSiyw6qgBo=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "tmpl": "1.0.5"
@@ -13589,8 +13588,8 @@
     },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha1-oN10voHiqlwvJ+Zc4oNgXuTit/k=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -13598,14 +13597,14 @@
     },
     "node_modules/mdn-data": {
       "version": "2.0.14",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.0.14.tgz",
-      "integrity": "sha512-dn6wd0uw5GsdswPFfsgMp5NSB0/aDe6fK94YJV/AJDYXL6HVLWBsxeq7js7Ad+mU2K9LAlwpk6kN2D5mwCPVow==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/mdn-data/-/mdn-data-2.0.14.tgz",
+      "integrity": "sha1-cRP8QoGRfWPOKbQ0RvcB5owlulA=",
       "license": "CC0-1.0"
     },
     "node_modules/media-typer": {
       "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
-      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/media-typer/-/media-typer-0.3.0.tgz",
+      "integrity": "sha1-hxDXrwqmJvj/+hzgAWhUUmMlV0g=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -13613,8 +13612,8 @@
     },
     "node_modules/memfs": {
       "version": "3.5.3",
-      "resolved": "https://registry.npmjs.org/memfs/-/memfs-3.5.3.tgz",
-      "integrity": "sha512-UERzLsxzllchadvbPs5aolHh65ISpKpM+ccLbOJ8/vvpBKmAWf+la7dXFy7Mr0ySHbdHrFv5kGFCUHHe6GFEmw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/memfs/-/memfs-3.5.3.tgz",
+      "integrity": "sha1-2bQP5PjVeIxfiVvagEzQ2e7unzs=",
       "license": "Unlicense",
       "dependencies": {
         "fs-monkey": "^1.0.4"
@@ -13625,8 +13624,8 @@
     },
     "node_modules/merge-descriptors": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
-      "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+      "integrity": "sha1-2AMZpl88eTU1Hlz9rI+TGFBNvtU=",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
@@ -13634,14 +13633,14 @@
     },
     "node_modules/merge-stream": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
-      "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/merge-stream/-/merge-stream-2.0.0.tgz",
+      "integrity": "sha1-UoI2KaFN0AyXcPtq1H3GMQ8sH2A=",
       "license": "MIT"
     },
     "node_modules/merge2": {
       "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
-      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha1-Q2iJL4hekHRVpv19xVwMnUBJkK4=",
       "license": "MIT",
       "engines": {
         "node": ">= 8"
@@ -13649,8 +13648,8 @@
     },
     "node_modules/methods": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
-      "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/methods/-/methods-1.1.2.tgz",
+      "integrity": "sha1-VSmk1nZUE07cxSZmVoNbD4Ua/O4=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -13658,8 +13657,8 @@
     },
     "node_modules/micromatch": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
-      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha1-1m+hjzpHB2eJMgubGvMr2G2fogI=",
       "license": "MIT",
       "dependencies": {
         "braces": "^3.0.3",
@@ -13671,8 +13670,8 @@
     },
     "node_modules/mime": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
-      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/mime/-/mime-1.6.0.tgz",
+      "integrity": "sha1-Ms2eXGRVO9WNGaVor0Uqz/BJgbE=",
       "license": "MIT",
       "bin": {
         "mime": "cli.js"
@@ -13683,8 +13682,8 @@
     },
     "node_modules/mime-db": {
       "version": "1.52.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
-      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha1-u6vNwChZ9JhzAchW4zh85exDv3A=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -13692,8 +13691,8 @@
     },
     "node_modules/mime-types": {
       "version": "2.1.35",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
-      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha1-OBqHG2KnNEUGYK497uRIE/cNlZo=",
       "license": "MIT",
       "dependencies": {
         "mime-db": "1.52.0"
@@ -13704,8 +13703,8 @@
     },
     "node_modules/mimic-fn": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
-      "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/mimic-fn/-/mimic-fn-2.1.0.tgz",
+      "integrity": "sha1-ftLCzMyvhNP/y3pptXcR/CCDQBs=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -13713,8 +13712,8 @@
     },
     "node_modules/mini-css-extract-plugin": {
       "version": "2.10.2",
-      "resolved": "https://registry.npmjs.org/mini-css-extract-plugin/-/mini-css-extract-plugin-2.10.2.tgz",
-      "integrity": "sha512-AOSS0IdEB95ayVkxn5oGzNQwqAi2J0Jb/kKm43t7H73s8+f5873g0yuj0PNvK4dO75mu5DHg4nlgp4k6Kga8eg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/mini-css-extract-plugin/-/mini-css-extract-plugin-2.10.2.tgz",
+      "integrity": "sha1-XIXslFDAXSbjJTG0ZaFaCMOlclM=",
       "license": "MIT",
       "dependencies": {
         "schema-utils": "^4.0.0",
@@ -13733,14 +13732,14 @@
     },
     "node_modules/minimalistic-assert": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
-      "integrity": "sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
+      "integrity": "sha1-LhlN4ERibUoQ5/f7wAznPoPk1cc=",
       "license": "ISC"
     },
     "node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha1-WAyI+NVEXyvWqo88re+g3nn71p4=",
       "license": "ISC",
       "dependencies": {
         "brace-expansion": "^1.1.7"
@@ -13751,8 +13750,8 @@
     },
     "node_modules/minimist": {
       "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha1-waRk52kzAuCCoHXO4MBXdBrEdyw=",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
@@ -13760,8 +13759,8 @@
     },
     "node_modules/minimizer-webpack-plugin": {
       "version": "5.6.1",
-      "resolved": "https://registry.npmjs.org/minimizer-webpack-plugin/-/minimizer-webpack-plugin-5.6.1.tgz",
-      "integrity": "sha512-DoeAZz8Q1C1znwsUzej1fdoi4jCf7/+Em27ouLqfK/+3m8G+D7yDhUwrc3CNhjSzGUN1kn7Iv4sWmjflQHenpw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/minimizer-webpack-plugin/-/minimizer-webpack-plugin-5.6.1.tgz",
+      "integrity": "sha1-KJkipMlsTtHdt2uKAL2AdOiaL38=",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "^0.3.25",
@@ -13820,14 +13819,14 @@
     },
     "node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha1-V0yBOM4dK1hh8LRFedut1gxmFbI=",
       "license": "MIT"
     },
     "node_modules/multicast-dns": {
       "version": "7.2.5",
-      "resolved": "https://registry.npmjs.org/multicast-dns/-/multicast-dns-7.2.5.tgz",
-      "integrity": "sha512-2eznPJP8z2BFLX50tf0LuODrpINqP1RVIm/CObbTcBRITQgmC/TjcREF1NeTBzIcR5XO/ukWo+YHOjBbFwIupg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/multicast-dns/-/multicast-dns-7.2.5.tgz",
+      "integrity": "sha1-d+tGBX9NetvRbZKQ+nKZ9vpkzO0=",
       "license": "MIT",
       "dependencies": {
         "dns-packet": "^5.2.2",
@@ -13839,8 +13838,8 @@
     },
     "node_modules/mz": {
       "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/mz/-/mz-2.7.0.tgz",
-      "integrity": "sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/mz/-/mz-2.7.0.tgz",
+      "integrity": "sha1-lQCAV6Vsr63CvGPd5/n/aVWUjjI=",
       "license": "MIT",
       "dependencies": {
         "any-promise": "^1.0.0",
@@ -13849,9 +13848,9 @@
       }
     },
     "node_modules/nanoid": {
-      "version": "3.3.16",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
-      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
+      "version": "3.3.18",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/nanoid/-/nanoid-3.3.18.tgz",
+      "integrity": "sha1-9mot4Rmf/eD88hyKXxMQaxwIGRM=",
       "funding": [
         {
           "type": "github",
@@ -13868,20 +13867,20 @@
     },
     "node_modules/natural-compare": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
       "license": "MIT"
     },
     "node_modules/natural-compare-lite": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare-lite/-/natural-compare-lite-1.4.0.tgz",
-      "integrity": "sha512-Tj+HTDSJJKaZnfiuw+iaF9skdPpTo2GtEly5JHnWV/hfv2Qj/9RKsGISQtLh2ox3l5EAGw487hnBee0sIJ6v2g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/natural-compare-lite/-/natural-compare-lite-1.4.0.tgz",
+      "integrity": "sha1-F7CVgZiJef3a/gIB6TG6kzyWy7Q=",
       "license": "MIT"
     },
     "node_modules/negotiator": {
       "version": "0.6.4",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.4.tgz",
-      "integrity": "sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/negotiator/-/negotiator-0.6.4.tgz",
+      "integrity": "sha1-d3lI4kUmUcVwtxLdAcI+JicT//c=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -13889,14 +13888,14 @@
     },
     "node_modules/neo-async": {
       "version": "2.6.2",
-      "resolved": "https://registry.npmjs.org/neo-async/-/neo-async-2.6.2.tgz",
-      "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/neo-async/-/neo-async-2.6.2.tgz",
+      "integrity": "sha1-tKr7k+OustgXTKU88WOrfXMIMF8=",
       "license": "MIT"
     },
     "node_modules/no-case": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/no-case/-/no-case-3.0.4.tgz",
-      "integrity": "sha512-fgAN3jGAh+RoxUGZHTSOLJIqUc2wmoBwGR4tbpNAKmmovFoWq0OdRkb0VkldReO2a2iBT/OEulG9XSUc10r3zg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/no-case/-/no-case-3.0.4.tgz",
+      "integrity": "sha1-02H9XJgA9VhVGoNp/A3NRmK2Ek0=",
       "license": "MIT",
       "dependencies": {
         "lower-case": "^2.0.2",
@@ -13905,8 +13904,8 @@
     },
     "node_modules/node-exports-info": {
       "version": "1.6.2",
-      "resolved": "https://registry.npmjs.org/node-exports-info/-/node-exports-info-1.6.2.tgz",
-      "integrity": "sha512-kXs9Go0cah0qHVV2v389IXQLdLCeE1xfFtjOAF+iobu0OIoG1pje8At2vMHyaPMiPMnG/LWP50twML21eMcAag==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/node-exports-info/-/node-exports-info-1.6.2.tgz",
+      "integrity": "sha1-JDoxBWd9Z4HNJuanI1D9kopctG8=",
       "license": "MIT",
       "dependencies": {
         "array.prototype.flatmap": "^1.3.3",
@@ -13923,8 +13922,8 @@
     },
     "node_modules/node-exports-info/node_modules/semver": {
       "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-6.3.1.tgz",
+      "integrity": "sha1-VW0u+GiRRuRtzqS/3QlfNDTf/LQ=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -13932,8 +13931,8 @@
     },
     "node_modules/node-forge": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
-      "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/node-forge/-/node-forge-1.4.0.tgz",
+      "integrity": "sha1-HHt9i9wtB4c59YKH1YnZA6EbL8I=",
       "license": "(BSD-3-Clause OR GPL-2.0)",
       "engines": {
         "node": ">= 6.13.0"
@@ -13941,14 +13940,14 @@
     },
     "node_modules/node-int64": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
-      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/node-int64/-/node-int64-0.4.0.tgz",
+      "integrity": "sha1-h6kGXNs1XTGC2PlM4RGIuCXGijs=",
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.51",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz",
-      "integrity": "sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==",
+      "version": "2.0.53",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/node-releases/-/node-releases-2.0.53.tgz",
+      "integrity": "sha1-D+Wtink14HUXL1dOVvDCDwf6Qa8=",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -13956,8 +13955,8 @@
     },
     "node_modules/normalize-path": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
-      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha1-Dc1p/yOhybEf0JeDFmRKA4ghamU=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -13965,8 +13964,8 @@
     },
     "node_modules/normalize-url": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-6.1.0.tgz",
-      "integrity": "sha512-DlL+XwOy3NxAQ8xuC0okPgK46iuVNAK01YN7RueYBqqFeGsBjV9XmCAzAdgt+667bCl5kPh9EqKKDwnaPG1I7A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/normalize-url/-/normalize-url-6.1.0.tgz",
+      "integrity": "sha1-QNCIW1Nd7/4/MUe+yHfQX+TFZoo=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -13977,8 +13976,8 @@
     },
     "node_modules/npm-run-path": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
-      "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/npm-run-path/-/npm-run-path-4.0.1.tgz",
+      "integrity": "sha1-t+zR5e1T2o43pV4cImnguX7XSOo=",
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.0.0"
@@ -13989,8 +13988,8 @@
     },
     "node_modules/nth-check": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/nth-check/-/nth-check-2.0.1.tgz",
-      "integrity": "sha512-it1vE95zF6dTT9lBsYbxvqh0Soy4SPowchj0UBGj/V6cTPnXXtQOPUbhZ6CmGzAD/rW22LQK6E96pcdJXk4A4w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/nth-check/-/nth-check-2.0.1.tgz",
+      "integrity": "sha1-Lv4WL1w9oGoolZ+9PbddvuqfD8I=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "boolbase": "^1.0.0"
@@ -14001,14 +14000,14 @@
     },
     "node_modules/nwsapi": {
       "version": "2.2.24",
-      "resolved": "https://registry.npmjs.org/nwsapi/-/nwsapi-2.2.24.tgz",
-      "integrity": "sha512-7YRhZ3jS45LwmSCT4b2sVFHt/WuovaktDU07QrtOBY2PXskss5a9jfmR9jptyumwXST+rFjrmppMY1KT/yn35A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/nwsapi/-/nwsapi-2.2.24.tgz",
+      "integrity": "sha1-+JJwQ9TJtRar3r6ASjLI0flITR8=",
       "license": "MIT"
     },
     "node_modules/object-assign": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha1-IQmtx5ZYh8/AXLvUQsrIv7s2CGM=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -14016,8 +14015,8 @@
     },
     "node_modules/object-hash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-3.0.0.tgz",
-      "integrity": "sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/object-hash/-/object-hash-3.0.0.tgz",
+      "integrity": "sha1-c/l/dT57r/wOLMnW4HkHl0Ssguk=",
       "license": "MIT",
       "engines": {
         "node": ">= 6"
@@ -14025,8 +14024,8 @@
     },
     "node_modules/object-inspect": {
       "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
-      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha1-g3UmXiG8IND6WCwi4bE0hdbgAhM=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -14037,8 +14036,8 @@
     },
     "node_modules/object-keys": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/object-keys/-/object-keys-1.1.1.tgz",
-      "integrity": "sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/object-keys/-/object-keys-1.1.1.tgz",
+      "integrity": "sha1-HEfyct8nfzsdrwYWd9nILiMixg4=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -14046,8 +14045,8 @@
     },
     "node_modules/object.assign": {
       "version": "4.1.7",
-      "resolved": "https://registry.npmjs.org/object.assign/-/object.assign-4.1.7.tgz",
-      "integrity": "sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/object.assign/-/object.assign-4.1.7.tgz",
+      "integrity": "sha1-jBTKGkJMalYbC7KiL2b1BJqUXT0=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -14066,8 +14065,8 @@
     },
     "node_modules/object.entries": {
       "version": "1.1.9",
-      "resolved": "https://registry.npmjs.org/object.entries/-/object.entries-1.1.9.tgz",
-      "integrity": "sha512-8u/hfXFRBD1O0hPUjioLhoWFHRmt6tKA4/vZPyckBr18l1KE9uHrFaFaUi8MDRTpi4uak2goyPTSNJLXX2k2Hw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/object.entries/-/object.entries-1.1.9.tgz",
+      "integrity": "sha1-5HcKahREr7Yb05+YQBi1vt4l+LM=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -14081,8 +14080,8 @@
     },
     "node_modules/object.fromentries": {
       "version": "2.0.8",
-      "resolved": "https://registry.npmjs.org/object.fromentries/-/object.fromentries-2.0.8.tgz",
-      "integrity": "sha512-k6E21FzySsSK5a21KRADBd/NGneRegFO5pLHfdQLpRDETUNJueLXs3WCzyQ3tFRDYgbq3KHGXfTbi2bs8WQ6rQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/object.fromentries/-/object.fromentries-2.0.8.tgz",
+      "integrity": "sha1-9xldipuXvZXLwZmeqTns0aKwDGU=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.7",
@@ -14099,8 +14098,8 @@
     },
     "node_modules/object.groupby": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/object.groupby/-/object.groupby-1.0.3.tgz",
-      "integrity": "sha512-+Lhy3TQTuzXI5hevh8sBGqbmurHbbIjAi0Z4S63nthVLmLxfbj4T54a4CfZrXIrt9iP4mVAPYMo/v99taj3wjQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/object.groupby/-/object.groupby-1.0.3.tgz",
+      "integrity": "sha1-mxJcNiOBKfb3thlUoecXYUjVAC4=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.7",
@@ -14113,8 +14112,8 @@
     },
     "node_modules/object.values": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/object.values/-/object.values-1.2.1.tgz",
-      "integrity": "sha512-gXah6aZrcUxjWg2zR2MwouP2eHlCBzdV4pygudehaKXSGW4v2AsRQUK+lwwXhii6KFZcunEnmSUoYp5CXibxtA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/object.values/-/object.values-1.2.1.tgz",
+      "integrity": "sha1-3u1SClCAn/f3Wnz9S8ZMegOMYhY=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -14131,14 +14130,14 @@
     },
     "node_modules/obuf": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/obuf/-/obuf-1.1.2.tgz",
-      "integrity": "sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/obuf/-/obuf-1.1.2.tgz",
+      "integrity": "sha1-Cb6jND1BhZ69RGKS0RydTbYZCE4=",
       "license": "MIT"
     },
     "node_modules/on-finished": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha1-WMjEQRblSEWtV/FKsQsDUzGErD8=",
       "license": "MIT",
       "dependencies": {
         "ee-first": "1.1.1"
@@ -14149,8 +14148,8 @@
     },
     "node_modules/on-headers": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
-      "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/on-headers/-/on-headers-1.1.0.tgz",
+      "integrity": "sha1-WdpPkcRfX5icbkvO3Fo7Cu1w/2U=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -14158,8 +14157,8 @@
     },
     "node_modules/once": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/once/-/once-1.4.0.tgz",
+      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
       "license": "ISC",
       "dependencies": {
         "wrappy": "1"
@@ -14167,8 +14166,8 @@
     },
     "node_modules/onetime": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
-      "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/onetime/-/onetime-5.1.2.tgz",
+      "integrity": "sha1-0Oluu1awdHbfHdnEgG5SN5hcpF4=",
       "license": "MIT",
       "dependencies": {
         "mimic-fn": "^2.1.0"
@@ -14182,8 +14181,8 @@
     },
     "node_modules/open": {
       "version": "8.4.2",
-      "resolved": "https://registry.npmjs.org/open/-/open-8.4.2.tgz",
-      "integrity": "sha512-7x81NCL719oNbsq/3mh+hVrAWmFuEYUqrq/Iw3kUzH8ReypT9QQ0BLoJS7/G9k6N81XjW4qHWtjWwe/9eLy1EQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/open/-/open-8.4.2.tgz",
+      "integrity": "sha1-W1/+Ko95Pc0qrXPlUMuHtZywhPk=",
       "license": "MIT",
       "dependencies": {
         "define-lazy-prop": "^2.0.0",
@@ -14199,8 +14198,8 @@
     },
     "node_modules/optionator": {
       "version": "0.9.4",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
-      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha1-fqHBpdkddk+yghOciP4R4YKjpzQ=",
       "license": "MIT",
       "dependencies": {
         "deep-is": "^0.1.3",
@@ -14216,8 +14215,8 @@
     },
     "node_modules/own-keys": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/own-keys/-/own-keys-1.0.2.tgz",
-      "integrity": "sha512-19YVAg7T+WTrxggPukVq7DjTv6+PJ867TmhCvBsYwmbFCsZd344rq2Ld1p0wo8f8Qrrhgp82c6FJRqdXWtSEhg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/own-keys/-/own-keys-1.0.2.tgz",
+      "integrity": "sha1-MUSOwfeB7LFEf29qoNZTQiKvWd4=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.4",
@@ -14234,8 +14233,8 @@
     },
     "node_modules/p-limit": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
-      "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/p-limit/-/p-limit-2.3.0.tgz",
+      "integrity": "sha1-PdM8ZHohT9//2DWTPrCG2g3CHbE=",
       "license": "MIT",
       "dependencies": {
         "p-try": "^2.0.0"
@@ -14249,8 +14248,8 @@
     },
     "node_modules/p-locate": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
-      "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/p-locate/-/p-locate-4.1.0.tgz",
+      "integrity": "sha1-o0KLtwiLOmApL2aRkni3wpetTwc=",
       "license": "MIT",
       "dependencies": {
         "p-limit": "^2.2.0"
@@ -14261,8 +14260,8 @@
     },
     "node_modules/p-retry": {
       "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/p-retry/-/p-retry-4.6.2.tgz",
-      "integrity": "sha512-312Id396EbJdvRONlngUx0NydfrIQ5lsYu0znKVUzVvArzEIt08V1qhtyESbGVd1FGX7UKtiFp5uwKZdM8wIuQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/p-retry/-/p-retry-4.6.2.tgz",
+      "integrity": "sha1-m6rnGEBX7dThcjHO4EJkEG4JKhY=",
       "license": "MIT",
       "dependencies": {
         "@types/retry": "0.12.0",
@@ -14274,8 +14273,8 @@
     },
     "node_modules/p-try": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
-      "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/p-try/-/p-try-2.2.0.tgz",
+      "integrity": "sha1-yyhoVA4xPWHeWPr741zpAE1VQOY=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -14283,8 +14282,8 @@
     },
     "node_modules/param-case": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/param-case/-/param-case-3.0.4.tgz",
-      "integrity": "sha512-RXlj7zCYokReqWpOPH9oYivUzLYZ5vAPIfEmCTNViosC78F8F0H9y7T7gG2M39ymgutxF5gcFEsyZQSph9Bp3A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/param-case/-/param-case-3.0.4.tgz",
+      "integrity": "sha1-fRf+SqEr3jTUp32RrPtiGcqtAcU=",
       "license": "MIT",
       "dependencies": {
         "dot-case": "^3.0.4",
@@ -14293,8 +14292,8 @@
     },
     "node_modules/parent-module": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
-      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/parent-module/-/parent-module-1.0.1.tgz",
+      "integrity": "sha1-aR0nCeeMefrjoVZiJFLQB2LKqqI=",
       "license": "MIT",
       "dependencies": {
         "callsites": "^3.0.0"
@@ -14305,8 +14304,8 @@
     },
     "node_modules/parse-json": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-5.2.0.tgz",
-      "integrity": "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/parse-json/-/parse-json-5.2.0.tgz",
+      "integrity": "sha1-x2/Gbe5UIxyWKyK8yKcs8vmXU80=",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.0.0",
@@ -14323,14 +14322,14 @@
     },
     "node_modules/parse5": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/parse5/-/parse5-6.0.1.tgz",
-      "integrity": "sha512-Ofn/CTFzRGTTxwpNEs9PP93gXShHcTq255nzRYSKe8AkVpZY7e1fpmTfOyoIvjP5HG7Z2ZM7VS9PPhQGW2pOpw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/parse5/-/parse5-6.0.1.tgz",
+      "integrity": "sha1-4aHAhcVps9wIMhGE8Zo5zCf3wws=",
       "license": "MIT"
     },
     "node_modules/parseurl": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
-      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha1-naGee+6NEt/wUT7Vt2lXeTvC6NQ=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -14338,8 +14337,8 @@
     },
     "node_modules/pascal-case": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/pascal-case/-/pascal-case-3.1.2.tgz",
-      "integrity": "sha512-uWlGT3YSnK9x3BQJaOdcZwrnV6hPpd8jFH1/ucpiLRPh/2zCVJKS19E4GvYHvaCcACn3foXZ0cLB9Wrx1KGe5g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/pascal-case/-/pascal-case-3.1.2.tgz",
+      "integrity": "sha1-tI4O8rmOIF58Ha50fQsVCCN2YOs=",
       "license": "MIT",
       "dependencies": {
         "no-case": "^3.0.4",
@@ -14348,8 +14347,8 @@
     },
     "node_modules/path-exists": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha1-UTvb4tO5XXdi6METfvoZXGxhtbM=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -14357,8 +14356,8 @@
     },
     "node_modules/path-is-absolute": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -14366,8 +14365,8 @@
     },
     "node_modules/path-key": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha1-WB9q3mWMu6ZaDTOA3ndTKVBU83U=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -14375,20 +14374,20 @@
     },
     "node_modules/path-parse": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha1-+8EUtgykKzDZ2vWFjkvWi77bZzU=",
       "license": "MIT"
     },
     "node_modules/path-to-regexp": {
       "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
-      "integrity": "sha512-A/AGNMFN3c8bOlvV9RreMdrv7jsmF9XIfDeCd87+I8RNg6s78BhJxMu69NEMHBSJFxKidViTEdruRwEk/WIKqA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/path-to-regexp/-/path-to-regexp-0.1.13.tgz",
+      "integrity": "sha1-myLsFrw6uI0FoMfjaYaUIUAasX0=",
       "license": "MIT"
     },
     "node_modules/path-type": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
-      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/path-type/-/path-type-4.0.0.tgz",
+      "integrity": "sha1-hO0BwKe6OAr+CdkKjBgNzZ0DBDs=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -14396,20 +14395,20 @@
     },
     "node_modules/performance-now": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/performance-now/-/performance-now-2.1.0.tgz",
-      "integrity": "sha512-7EAHlyLHI56VEIdK57uwHdHKIaAGbnXPiw0yWbarQZOKaKpvUIgW0jWRVLiatnM+XXlSwsanIBH/hzGMJulMow==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/performance-now/-/performance-now-2.1.0.tgz",
+      "integrity": "sha1-Ywn04OX6kT7BxpMHrjZLSzd8nns=",
       "license": "MIT"
     },
     "node_modules/picocolors": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha1-PTIa8+q5ObCDyPkpodEs2oHCa2s=",
       "license": "ISC"
     },
     "node_modules/picomatch": {
       "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
-      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha1-WpQpFeJrNy3A8OZ1MUmhbmscVgE=",
       "license": "MIT",
       "engines": {
         "node": ">=8.6"
@@ -14420,8 +14419,8 @@
     },
     "node_modules/pify": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/pify/-/pify-2.3.0.tgz",
-      "integrity": "sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/pify/-/pify-2.3.0.tgz",
+      "integrity": "sha1-7RQaasBDqEnqWISY59yosVMw6Qw=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -14429,8 +14428,8 @@
     },
     "node_modules/pirates": {
       "version": "4.0.7",
-      "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.7.tgz",
-      "integrity": "sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/pirates/-/pirates-4.0.7.tgz",
+      "integrity": "sha1-ZDtKGMQlfIplEEtz8wSc6aChXiI=",
       "license": "MIT",
       "engines": {
         "node": ">= 6"
@@ -14438,8 +14437,8 @@
     },
     "node_modules/pkg-dir": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
-      "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/pkg-dir/-/pkg-dir-4.2.0.tgz",
+      "integrity": "sha1-8JkTPfft5CLoHR2ESCcO6z5CYfM=",
       "license": "MIT",
       "dependencies": {
         "find-up": "^4.0.0"
@@ -14450,8 +14449,8 @@
     },
     "node_modules/pkg-up": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/pkg-up/-/pkg-up-3.1.0.tgz",
-      "integrity": "sha512-nDywThFk1i4BQK4twPQ6TA4RT8bDY96yeuCVBWL3ePARCiEKDRSrNGbFIgUJpLp+XeIR65v8ra7WuJOFUBtkMA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/pkg-up/-/pkg-up-3.1.0.tgz",
+      "integrity": "sha1-EA7CNcwVDk/UJRlBJZaihRKg3vU=",
       "license": "MIT",
       "dependencies": {
         "find-up": "^3.0.0"
@@ -14462,8 +14461,8 @@
     },
     "node_modules/pkg-up/node_modules/find-up": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-3.0.0.tgz",
-      "integrity": "sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/find-up/-/find-up-3.0.0.tgz",
+      "integrity": "sha1-SRafHXmTQwZG2mHsxa41XCHJe3M=",
       "license": "MIT",
       "dependencies": {
         "locate-path": "^3.0.0"
@@ -14474,8 +14473,8 @@
     },
     "node_modules/pkg-up/node_modules/locate-path": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-3.0.0.tgz",
-      "integrity": "sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/locate-path/-/locate-path-3.0.0.tgz",
+      "integrity": "sha1-2+w7OrdZdYBxtY/ln8QYca8hQA4=",
       "license": "MIT",
       "dependencies": {
         "p-locate": "^3.0.0",
@@ -14487,8 +14486,8 @@
     },
     "node_modules/pkg-up/node_modules/p-locate": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-3.0.0.tgz",
-      "integrity": "sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/p-locate/-/p-locate-3.0.0.tgz",
+      "integrity": "sha1-Mi1poFwCZLJZl9n0DNiokasAZKQ=",
       "license": "MIT",
       "dependencies": {
         "p-limit": "^2.0.0"
@@ -14499,8 +14498,8 @@
     },
     "node_modules/pkg-up/node_modules/path-exists": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-3.0.0.tgz",
-      "integrity": "sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/path-exists/-/path-exists-3.0.0.tgz",
+      "integrity": "sha1-zg6+ql94yxiSXqfYENe1mwEP1RU=",
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -14508,8 +14507,8 @@
     },
     "node_modules/possible-typed-array-names": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
-      "integrity": "sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/possible-typed-array-names/-/possible-typed-array-names-1.1.0.tgz",
+      "integrity": "sha1-k+NYK8DlQmWG2dB7ee5A/IQd5K4=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -14517,8 +14516,8 @@
     },
     "node_modules/postcss": {
       "version": "8.5.25",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.25.tgz",
-      "integrity": "sha512-DTPx3RWSSnWyzLxQnlH0rJP+EW5ekl16ZU4/psbIhA0e53kJfdgaN5vKM+xP7yJtXVu+nfdVFmlgFDEKAe4Pyw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss/-/postcss-8.5.25.tgz",
+      "integrity": "sha1-UBKlmOqqiX8hu+hVO+PLe9K9eMs=",
       "funding": [
         {
           "type": "opencollective",
@@ -14545,8 +14544,8 @@
     },
     "node_modules/postcss-attribute-case-insensitive": {
       "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/postcss-attribute-case-insensitive/-/postcss-attribute-case-insensitive-5.0.2.tgz",
-      "integrity": "sha512-XIidXV8fDr0kKt28vqki84fRK8VW8eTuIa4PChv2MqKuT6C9UjmSKzen6KaWhWEoYvwxFCa7n/tC1SZ3tyq4SQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-attribute-case-insensitive/-/postcss-attribute-case-insensitive-5.0.2.tgz",
+      "integrity": "sha1-A9dhskr8BMCedX6S/1NxaujqJ0E=",
       "license": "MIT",
       "dependencies": {
         "postcss-selector-parser": "^6.0.10"
@@ -14564,8 +14563,8 @@
     },
     "node_modules/postcss-browser-comments": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/postcss-browser-comments/-/postcss-browser-comments-4.0.0.tgz",
-      "integrity": "sha512-X9X9/WN3KIvY9+hNERUqX9gncsgBA25XaeR+jshHz2j8+sYyHktHw1JdKuMjeLpGktXidqDhA7b/qm1mrBDmgg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-browser-comments/-/postcss-browser-comments-4.0.0.tgz",
+      "integrity": "sha1-vPyGE031gH9dPA7voZHUITa15yo=",
       "license": "CC0-1.0",
       "engines": {
         "node": ">=8"
@@ -14577,8 +14576,8 @@
     },
     "node_modules/postcss-calc": {
       "version": "8.2.4",
-      "resolved": "https://registry.npmjs.org/postcss-calc/-/postcss-calc-8.2.4.tgz",
-      "integrity": "sha512-SmWMSJmB8MRnnULldx0lQIyhSNvuDl9HfrZkaqqE/WHAhToYsAvDq+yAsA/kIyINDszOp3Rh0GFoNuH5Ypsm3Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-calc/-/postcss-calc-8.2.4.tgz",
+      "integrity": "sha1-d7nCm/y+igf/ZpPchwUIKIiXOaU=",
       "license": "MIT",
       "dependencies": {
         "postcss-selector-parser": "^6.0.9",
@@ -14590,8 +14589,8 @@
     },
     "node_modules/postcss-clamp": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-clamp/-/postcss-clamp-4.1.0.tgz",
-      "integrity": "sha512-ry4b1Llo/9zz+PKC+030KUnPITTJAHeOwjfAyyB60eT0AorGLdzp52s31OsPRHRf8NchkgFoG2y6fCfn1IV1Ow==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-clamp/-/postcss-clamp-4.1.0.tgz",
+      "integrity": "sha1-cmPpWrrdjCuhvZEbC1pcnJPgI2M=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -14605,8 +14604,8 @@
     },
     "node_modules/postcss-color-functional-notation": {
       "version": "4.2.4",
-      "resolved": "https://registry.npmjs.org/postcss-color-functional-notation/-/postcss-color-functional-notation-4.2.4.tgz",
-      "integrity": "sha512-2yrTAUZUab9s6CpxkxC4rVgFEVaR6/2Pipvi6qcgvnYiVqZcbDHEoBDhrXzyb7Efh2CCfHQNtcqWcIruDTIUeg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-color-functional-notation/-/postcss-color-functional-notation-4.2.4.tgz",
+      "integrity": "sha1-IakJ6NdFTTYS0WWeRxzkaW8oyuw=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -14624,8 +14623,8 @@
     },
     "node_modules/postcss-color-hex-alpha": {
       "version": "8.0.4",
-      "resolved": "https://registry.npmjs.org/postcss-color-hex-alpha/-/postcss-color-hex-alpha-8.0.4.tgz",
-      "integrity": "sha512-nLo2DCRC9eE4w2JmuKgVA3fGL3d01kGq752pVALF68qpGLmx2Qrk91QTKkdUqqp45T1K1XV8IhQpcu1hoAQflQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-color-hex-alpha/-/postcss-color-hex-alpha-8.0.4.tgz",
+      "integrity": "sha1-xm4pgPL7waY/WweWYzQM6LVfJaU=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -14643,8 +14642,8 @@
     },
     "node_modules/postcss-color-rebeccapurple": {
       "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-color-rebeccapurple/-/postcss-color-rebeccapurple-7.1.1.tgz",
-      "integrity": "sha512-pGxkuVEInwLHgkNxUc4sdg4g3py7zUeCQ9sMfwyHAT+Ezk8a4OaaVZ8lIY5+oNqA/BXXgLyXv0+5wHP68R79hg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-color-rebeccapurple/-/postcss-color-rebeccapurple-7.1.1.tgz",
+      "integrity": "sha1-Y/2rkdh468TdS3wCYZoMPWpWztA=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -14662,8 +14661,8 @@
     },
     "node_modules/postcss-colormin": {
       "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/postcss-colormin/-/postcss-colormin-5.3.1.tgz",
-      "integrity": "sha512-UsWQG0AqTFQmpBegeLLc1+c3jIqBNB0zlDGRWR+dQ3pRKJL1oeMzyqmH3o2PIfn9MBdNrVPWhDbT769LxCTLJQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-colormin/-/postcss-colormin-5.3.1.tgz",
+      "integrity": "sha1-hsJ8Ju1roA2Wx54I8/+0GNHRmI8=",
       "license": "MIT",
       "dependencies": {
         "browserslist": "^4.21.4",
@@ -14680,8 +14679,8 @@
     },
     "node_modules/postcss-convert-values": {
       "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/postcss-convert-values/-/postcss-convert-values-5.1.3.tgz",
-      "integrity": "sha512-82pC1xkJZtcJEfiLw6UXnXVXScgtBrjlO5CBmuDQc+dlb88ZYheFsjTn40+zBVi3DkfF7iezO0nJUPLcJK3pvA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-convert-values/-/postcss-convert-values-5.1.3.tgz",
+      "integrity": "sha1-BJmLubprZaoxA11mmmrzQsX505M=",
       "license": "MIT",
       "dependencies": {
         "browserslist": "^4.21.4",
@@ -14696,8 +14695,8 @@
     },
     "node_modules/postcss-custom-media": {
       "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/postcss-custom-media/-/postcss-custom-media-8.0.2.tgz",
-      "integrity": "sha512-7yi25vDAoHAkbhAzX9dHx2yc6ntS4jQvejrNcC+csQJAXjj15e7VcWfMgLqBNAbOvqi5uIa9huOVwdHbf+sKqg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-custom-media/-/postcss-custom-media-8.0.2.tgz",
+      "integrity": "sha1-yPljft9F/vdhsBTAJM7gE/gFKeo=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -14715,8 +14714,8 @@
     },
     "node_modules/postcss-custom-properties": {
       "version": "12.1.11",
-      "resolved": "https://registry.npmjs.org/postcss-custom-properties/-/postcss-custom-properties-12.1.11.tgz",
-      "integrity": "sha512-0IDJYhgU8xDv1KY6+VgUwuQkVtmYzRwu+dMjnmdMafXYv86SWqfxkc7qdDvWS38vsjaEtv8e0vGOUQrAiMBLpQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-custom-properties/-/postcss-custom-properties-12.1.11.tgz",
+      "integrity": "sha1-0Uu5s5iaxNQKqg4RC0O+Z6x4Rc8=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -14734,8 +14733,8 @@
     },
     "node_modules/postcss-custom-selectors": {
       "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/postcss-custom-selectors/-/postcss-custom-selectors-6.0.3.tgz",
-      "integrity": "sha512-fgVkmyiWDwmD3JbpCmB45SvvlCD6z9CG6Ie6Iere22W5aHea6oWa7EM2bpnv2Fj3I94L3VbtvX9KqwSi5aFzSg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-custom-selectors/-/postcss-custom-selectors-6.0.3.tgz",
+      "integrity": "sha1-GrRoTWXzD+0XVSD4LSI9sDNyOdk=",
       "license": "MIT",
       "dependencies": {
         "postcss-selector-parser": "^6.0.4"
@@ -14753,8 +14752,8 @@
     },
     "node_modules/postcss-dir-pseudo-class": {
       "version": "6.0.5",
-      "resolved": "https://registry.npmjs.org/postcss-dir-pseudo-class/-/postcss-dir-pseudo-class-6.0.5.tgz",
-      "integrity": "sha512-eqn4m70P031PF7ZQIvSgy9RSJ5uI2171O/OO/zcRNYpJbvaeKFUlar1aJ7rmgiQtbm0FSPsRewjpdS0Oew7MPA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-dir-pseudo-class/-/postcss-dir-pseudo-class-6.0.5.tgz",
+      "integrity": "sha1-K/Md5d52rd7UTgol7PYK6ffHwmw=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-selector-parser": "^6.0.10"
@@ -14772,8 +14771,8 @@
     },
     "node_modules/postcss-discard-comments": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-discard-comments/-/postcss-discard-comments-5.1.2.tgz",
-      "integrity": "sha512-+L8208OVbHVF2UQf1iDmRcbdjJkuBF6IS29yBDSiWUIzpYaAhtNl6JYnYm12FnkeCwQqF5LeklOu6rAqgfBZqQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-discard-comments/-/postcss-discard-comments-5.1.2.tgz",
+      "integrity": "sha1-jfXoHSklryeAB1hAwVJvBmDlNpY=",
       "license": "MIT",
       "engines": {
         "node": "^10 || ^12 || >=14.0"
@@ -14784,8 +14783,8 @@
     },
     "node_modules/postcss-discard-duplicates": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-discard-duplicates/-/postcss-discard-duplicates-5.1.0.tgz",
-      "integrity": "sha512-zmX3IoSI2aoenxHV6C7plngHWWhUOV3sP1T8y2ifzxzbtnuhk1EdPwm0S1bIUNaJ2eNbWeGLEwzw8huPD67aQw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-discard-duplicates/-/postcss-discard-duplicates-5.1.0.tgz",
+      "integrity": "sha1-nrT+hFZwak7r1tO3t3fQe60D6Eg=",
       "license": "MIT",
       "engines": {
         "node": "^10 || ^12 || >=14.0"
@@ -14796,8 +14795,8 @@
     },
     "node_modules/postcss-discard-empty": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-discard-empty/-/postcss-discard-empty-5.1.1.tgz",
-      "integrity": "sha512-zPz4WljiSuLWsI0ir4Mcnr4qQQ5e1Ukc3i7UfE2XcrwKK2LIPIqE5jxMRxO6GbI3cv//ztXDsXwEWT3BHOGh3A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-discard-empty/-/postcss-discard-empty-5.1.1.tgz",
+      "integrity": "sha1-5XdiND/39QP+U/ylU9GNfww2nGw=",
       "license": "MIT",
       "engines": {
         "node": "^10 || ^12 || >=14.0"
@@ -14808,8 +14807,8 @@
     },
     "node_modules/postcss-discard-overridden": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-discard-overridden/-/postcss-discard-overridden-5.1.0.tgz",
-      "integrity": "sha512-21nOL7RqWR1kasIVdKs8HNqQJhFxLsyRfAnUDm4Fe4t4mCWL9OJiHvlHPjcd8zc5Myu89b/7wZDnOSjFgeWRtw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-discard-overridden/-/postcss-discard-overridden-5.1.0.tgz",
+      "integrity": "sha1-foxbUzJXR+nZATG7iGNSgvtKJ24=",
       "license": "MIT",
       "engines": {
         "node": "^10 || ^12 || >=14.0"
@@ -14820,8 +14819,8 @@
     },
     "node_modules/postcss-double-position-gradients": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-double-position-gradients/-/postcss-double-position-gradients-3.1.2.tgz",
-      "integrity": "sha512-GX+FuE/uBR6eskOK+4vkXgT6pDkexLokPaz/AbJna9s5Kzp/yl488pKPjhy0obB475ovfT1Wv8ho7U/cHNaRgQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-double-position-gradients/-/postcss-double-position-gradients-3.1.2.tgz",
+      "integrity": "sha1-uWMY/bR3vpWZfobt0pxuNVekm5E=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/postcss-progressive-custom-properties": "^1.1.0",
@@ -14840,8 +14839,8 @@
     },
     "node_modules/postcss-env-function": {
       "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/postcss-env-function/-/postcss-env-function-4.0.6.tgz",
-      "integrity": "sha512-kpA6FsLra+NqcFnL81TnsU+Z7orGtDTxcOhl6pwXeEq1yFPpRMkCDpHhrz8CFQDr/Wfm0jLiNQ1OsGGPjlqPwA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-env-function/-/postcss-env-function-4.0.6.tgz",
+      "integrity": "sha1-ey0kyBL1QO1u2kyB9gkEFnIqjno=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -14855,8 +14854,8 @@
     },
     "node_modules/postcss-flexbugs-fixes": {
       "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/postcss-flexbugs-fixes/-/postcss-flexbugs-fixes-5.0.2.tgz",
-      "integrity": "sha512-18f9voByak7bTktR2QgDveglpn9DTbBWPUzSOe9g0N4WR/2eSt6Vrcbf0hmspvMI6YWGywz6B9f7jzpFNJJgnQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-flexbugs-fixes/-/postcss-flexbugs-fixes-5.0.2.tgz",
+      "integrity": "sha1-ICjhRTEwdPyavidst8oU5UAetJ0=",
       "license": "MIT",
       "peerDependencies": {
         "postcss": "^8.1.4"
@@ -14864,8 +14863,8 @@
     },
     "node_modules/postcss-focus-visible": {
       "version": "6.0.4",
-      "resolved": "https://registry.npmjs.org/postcss-focus-visible/-/postcss-focus-visible-6.0.4.tgz",
-      "integrity": "sha512-QcKuUU/dgNsstIK6HELFRT5Y3lbrMLEOwG+A4s5cA+fx3A3y/JTq3X9LaOj3OC3ALH0XqyrgQIgey/MIZ8Wczw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-focus-visible/-/postcss-focus-visible-6.0.4.tgz",
+      "integrity": "sha1-UMnqmvoO5lf7dWNfq60l4Y12v54=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-selector-parser": "^6.0.9"
@@ -14879,8 +14878,8 @@
     },
     "node_modules/postcss-focus-within": {
       "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/postcss-focus-within/-/postcss-focus-within-5.0.4.tgz",
-      "integrity": "sha512-vvjDN++C0mu8jz4af5d52CB184ogg/sSxAFS+oUJQq2SuCe7T5U2iIsVJtsCp2d6R4j0jr5+q3rPkBVZkXD9fQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-focus-within/-/postcss-focus-within-5.0.4.tgz",
+      "integrity": "sha1-Wx0uxgMZXzNEtxbAt19h5E6NLiA=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-selector-parser": "^6.0.9"
@@ -14894,8 +14893,8 @@
     },
     "node_modules/postcss-font-variant": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/postcss-font-variant/-/postcss-font-variant-5.0.0.tgz",
-      "integrity": "sha512-1fmkBaCALD72CK2a9i468mA/+tr9/1cBxRRMXOUaZqO43oWPR5imcyPjXwuv7PXbCid4ndlP5zWhidQVVa3hmA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-font-variant/-/postcss-font-variant-5.0.0.tgz",
+      "integrity": "sha1-79WbS36ouwYSfy0DG/u38k0y+mY=",
       "license": "MIT",
       "peerDependencies": {
         "postcss": "^8.1.0"
@@ -14903,8 +14902,8 @@
     },
     "node_modules/postcss-gap-properties": {
       "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/postcss-gap-properties/-/postcss-gap-properties-3.0.5.tgz",
-      "integrity": "sha512-IuE6gKSdoUNcvkGIqdtjtcMtZIFyXZhmFd5RUlg97iVEvp1BZKV5ngsAjCjrVy+14uhGBQl9tzmi1Qwq4kqVOg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-gap-properties/-/postcss-gap-properties-3.0.5.tgz",
+      "integrity": "sha1-9+PN3Pc+4Z6UzPfLd3c/lWCqL/8=",
       "license": "CC0-1.0",
       "engines": {
         "node": "^12 || ^14 || >=16"
@@ -14919,8 +14918,8 @@
     },
     "node_modules/postcss-image-set-function": {
       "version": "4.0.7",
-      "resolved": "https://registry.npmjs.org/postcss-image-set-function/-/postcss-image-set-function-4.0.7.tgz",
-      "integrity": "sha512-9T2r9rsvYzm5ndsBE8WgtrMlIT7VbtTfE7b3BQnudUqnBcBo7L758oc+o+pdj/dUV0l5wjwSdjeOH2DZtfv8qw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-image-set-function/-/postcss-image-set-function-4.0.7.tgz",
+      "integrity": "sha1-CDU711bxy/s7bpMYLHgph5EUSB8=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -14938,8 +14937,8 @@
     },
     "node_modules/postcss-import": {
       "version": "15.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-import/-/postcss-import-15.1.0.tgz",
-      "integrity": "sha512-hpr+J05B2FVYUAXHeK1YyI267J/dDDhMU6B6civm8hSY1jYJnBXxzKDKDswzJmtLHryrjhnDjqqp/49t8FALew==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-import/-/postcss-import-15.1.0.tgz",
+      "integrity": "sha1-QcZO2MwOI3NalpizJJ/9v3BK3HA=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.0.0",
@@ -14955,8 +14954,8 @@
     },
     "node_modules/postcss-initial": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/postcss-initial/-/postcss-initial-4.0.1.tgz",
-      "integrity": "sha512-0ueD7rPqX8Pn1xJIjay0AZeIuDoF+V+VvMt/uOnn+4ezUKhZM/NokDeP6DwMNyIoYByuN/94IQnt5FEkaN59xQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-initial/-/postcss-initial-4.0.1.tgz",
+      "integrity": "sha1-Up9zX3LFckoPswUn32+3rFTX3kI=",
       "license": "MIT",
       "peerDependencies": {
         "postcss": "^8.0.0"
@@ -14964,8 +14963,8 @@
     },
     "node_modules/postcss-js": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-js/-/postcss-js-4.1.0.tgz",
-      "integrity": "sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-js/-/postcss-js-4.1.0.tgz",
+      "integrity": "sha1-ADtjxu3elIdm5A89r36ZeuQ6XOY=",
       "funding": [
         {
           "type": "opencollective",
@@ -14989,8 +14988,8 @@
     },
     "node_modules/postcss-lab-function": {
       "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/postcss-lab-function/-/postcss-lab-function-4.2.1.tgz",
-      "integrity": "sha512-xuXll4isR03CrQsmxyz92LJB2xX9n+pZJ5jE9JgcnmsCammLyKdlzrBin+25dy6wIjfhJpKBAN80gsTlCgRk2w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-lab-function/-/postcss-lab-function-4.2.1.tgz",
+      "integrity": "sha1-b+TAFRAv980n0b1ThVgvZ+vb3Jg=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/postcss-progressive-custom-properties": "^1.1.0",
@@ -15009,8 +15008,8 @@
     },
     "node_modules/postcss-load-config": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-6.0.1.tgz",
-      "integrity": "sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-load-config/-/postcss-load-config-6.0.1.tgz",
+      "integrity": "sha1-b9fc2K6JutzxstZESJy6v4OqgJY=",
       "funding": [
         {
           "type": "opencollective",
@@ -15051,8 +15050,8 @@
     },
     "node_modules/postcss-load-config/node_modules/lilconfig": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.3.tgz",
-      "integrity": "sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lilconfig/-/lilconfig-3.1.3.tgz",
+      "integrity": "sha1-obz9Ylf5WFv1rhTO7rt7VZAl5MQ=",
       "license": "MIT",
       "engines": {
         "node": ">=14"
@@ -15063,8 +15062,8 @@
     },
     "node_modules/postcss-loader": {
       "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/postcss-loader/-/postcss-loader-6.2.1.tgz",
-      "integrity": "sha512-WbbYpmAaKcux/P66bZ40bpWsBucjx/TTgVVzRZ9yUO8yQfVBlameJ0ZGVaPfH64hNSBh63a+ICP5nqOpBA0w+Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-loader/-/postcss-loader-6.2.1.tgz",
+      "integrity": "sha1-CJX3NGsXAhA9MP3Gbk1JSpPACO8=",
       "license": "MIT",
       "dependencies": {
         "cosmiconfig": "^7.0.0",
@@ -15085,8 +15084,8 @@
     },
     "node_modules/postcss-logical": {
       "version": "5.0.4",
-      "resolved": "https://registry.npmjs.org/postcss-logical/-/postcss-logical-5.0.4.tgz",
-      "integrity": "sha512-RHXxplCeLh9VjinvMrZONq7im4wjWGlRJAqmAVLXyZaXwfDWP73/oq4NdIp+OZwhQUMj0zjqDfM5Fj7qby+B4g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-logical/-/postcss-logical-5.0.4.tgz",
+      "integrity": "sha1-7HWx7lRCGswE1ZIVdrfY22sOb3M=",
       "license": "CC0-1.0",
       "engines": {
         "node": "^12 || ^14 || >=16"
@@ -15097,8 +15096,8 @@
     },
     "node_modules/postcss-media-minmax": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/postcss-media-minmax/-/postcss-media-minmax-5.0.0.tgz",
-      "integrity": "sha512-yDUvFf9QdFZTuCUg0g0uNSHVlJ5X1lSzDZjPSFaiCWvjgsvu8vEVxtahPrLMinIDEEGnx6cBe6iqdx5YWz08wQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-media-minmax/-/postcss-media-minmax-5.0.0.tgz",
+      "integrity": "sha1-cUC93sFz4tbWV+29hVSlV5TipbU=",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -15109,8 +15108,8 @@
     },
     "node_modules/postcss-merge-longhand": {
       "version": "5.1.7",
-      "resolved": "https://registry.npmjs.org/postcss-merge-longhand/-/postcss-merge-longhand-5.1.7.tgz",
-      "integrity": "sha512-YCI9gZB+PLNskrK0BB3/2OzPnGhPkBEwmwhfYk1ilBHYVAZB7/tkTHFBAnCrvBBOmeYyMYw3DMjT55SyxMBzjQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-merge-longhand/-/postcss-merge-longhand-5.1.7.tgz",
+      "integrity": "sha1-JKG99ALZ7w5w9Wjzm9wDRNVo+xY=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0",
@@ -15125,8 +15124,8 @@
     },
     "node_modules/postcss-merge-rules": {
       "version": "5.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-merge-rules/-/postcss-merge-rules-5.1.4.tgz",
-      "integrity": "sha512-0R2IuYpgU93y9lhVbO/OylTtKMVcHb67zjWIfCiKR9rWL3GUk1677LAqD/BcHizukdZEjT8Ru3oHRoAYoJy44g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-merge-rules/-/postcss-merge-rules-5.1.4.tgz",
+      "integrity": "sha1-Lyb6XKy3WxQC4hN4n2dmrl5AMTw=",
       "license": "MIT",
       "dependencies": {
         "browserslist": "^4.21.4",
@@ -15143,8 +15142,8 @@
     },
     "node_modules/postcss-minify-font-values": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-minify-font-values/-/postcss-minify-font-values-5.1.0.tgz",
-      "integrity": "sha512-el3mYTgx13ZAPPirSVsHqFzl+BBBDrXvbySvPGFnQcTI4iNslrPaFq4muTkLZmKlGk4gyFAYUBMH30+HurREyA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-minify-font-values/-/postcss-minify-font-values-5.1.0.tgz",
+      "integrity": "sha1-8d8AFKcmCD0mDTvYXXOF+4nR8Bs=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15158,8 +15157,8 @@
     },
     "node_modules/postcss-minify-gradients": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-minify-gradients/-/postcss-minify-gradients-5.1.1.tgz",
-      "integrity": "sha512-VGvXMTpCEo4qHTNSa9A0a3D+dxGFZCYwR6Jokk+/3oB6flu2/PnPXAh2x7x52EkY5xlIHLm+Le8tJxe/7TNhzw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-minify-gradients/-/postcss-minify-gradients-5.1.1.tgz",
+      "integrity": "sha1-8f4bT0mBNKUGgkDC8l1G/NI2uiw=",
       "license": "MIT",
       "dependencies": {
         "colord": "^2.9.1",
@@ -15175,8 +15174,8 @@
     },
     "node_modules/postcss-minify-params": {
       "version": "5.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-minify-params/-/postcss-minify-params-5.1.4.tgz",
-      "integrity": "sha512-+mePA3MgdmVmv6g+30rn57USjOGSAyuxUmkfiWpzalZ8aiBkdPYjXWtHuwJGm1v5Ojy0Z0LaSYhHaLJQB0P8Jw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-minify-params/-/postcss-minify-params-5.1.4.tgz",
+      "integrity": "sha1-wGpseHEosyCLOMk2TPxAyKpdc1I=",
       "license": "MIT",
       "dependencies": {
         "browserslist": "^4.21.4",
@@ -15192,8 +15191,8 @@
     },
     "node_modules/postcss-minify-selectors": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/postcss-minify-selectors/-/postcss-minify-selectors-5.2.1.tgz",
-      "integrity": "sha512-nPJu7OjZJTsVUmPdm2TcaiohIwxP+v8ha9NehQ2ye9szv4orirRU3SDdtUmKH+10nzn0bAyOXZ0UEr7OpvLehg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-minify-selectors/-/postcss-minify-selectors-5.2.1.tgz",
+      "integrity": "sha1-1OfmtGFHuBF+qTJakVqAHV/mVsY=",
       "license": "MIT",
       "dependencies": {
         "postcss-selector-parser": "^6.0.5"
@@ -15207,8 +15206,8 @@
     },
     "node_modules/postcss-modules-extract-imports": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-modules-extract-imports/-/postcss-modules-extract-imports-3.1.0.tgz",
-      "integrity": "sha512-k3kNe0aNFQDAZGbin48pL2VNidTF0w4/eASDsxlyspobzU3wZQLOGj7L9gfRe0Jo9/4uud09DsjFNH7winGv8Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-modules-extract-imports/-/postcss-modules-extract-imports-3.1.0.tgz",
+      "integrity": "sha1-tEl8uFqcDEtaq+t1m7JejYnxUAI=",
       "license": "ISC",
       "engines": {
         "node": "^10 || ^12 || >= 14"
@@ -15219,8 +15218,8 @@
     },
     "node_modules/postcss-modules-local-by-default": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/postcss-modules-local-by-default/-/postcss-modules-local-by-default-4.2.0.tgz",
-      "integrity": "sha512-5kcJm/zk+GJDSfw+V/42fJ5fhjL5YbFDl8nVdXkJPLLW+Vf9mTD5Xe0wqIaDnLuL2U6cDNpTr+UQ+v2HWIBhzw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-modules-local-by-default/-/postcss-modules-local-by-default-4.2.0.tgz",
+      "integrity": "sha1-0VD0ODeDHa4l5AhVluhPb11uw2g=",
       "license": "MIT",
       "dependencies": {
         "icss-utils": "^5.0.0",
@@ -15235,9 +15234,9 @@
       }
     },
     "node_modules/postcss-modules-local-by-default/node_modules/postcss-selector-parser": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.4.tgz",
-      "integrity": "sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg==",
+      "version": "7.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-selector-parser/-/postcss-selector-parser-7.1.5.tgz",
+      "integrity": "sha1-7nsJByTrYHObUwZg5bQCIA5pSpc=",
       "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
@@ -15249,8 +15248,8 @@
     },
     "node_modules/postcss-modules-scope": {
       "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/postcss-modules-scope/-/postcss-modules-scope-3.2.1.tgz",
-      "integrity": "sha512-m9jZstCVaqGjTAuny8MdgE88scJnCiQSlSrOWcTQgM2t32UBe+MUmFSO5t7VMSfAf/FJKImAxBav8ooCHJXCJA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-modules-scope/-/postcss-modules-scope-3.2.1.tgz",
+      "integrity": "sha1-G7zN3LOY8delEeCi0dBHcYr0B4w=",
       "license": "ISC",
       "dependencies": {
         "postcss-selector-parser": "^7.0.0"
@@ -15263,9 +15262,9 @@
       }
     },
     "node_modules/postcss-modules-scope/node_modules/postcss-selector-parser": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.4.tgz",
-      "integrity": "sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg==",
+      "version": "7.1.5",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-selector-parser/-/postcss-selector-parser-7.1.5.tgz",
+      "integrity": "sha1-7nsJByTrYHObUwZg5bQCIA5pSpc=",
       "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
@@ -15277,8 +15276,8 @@
     },
     "node_modules/postcss-modules-values": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/postcss-modules-values/-/postcss-modules-values-4.0.0.tgz",
-      "integrity": "sha512-RDxHkAiEGI78gS2ofyvCsu7iycRv7oqw5xMWn9iMoR0N/7mf9D50ecQqUo5BZ9Zh2vH4bCUR/ktCqbB9m8vJjQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-modules-values/-/postcss-modules-values-4.0.0.tgz",
+      "integrity": "sha1-18Xn5ow7s8myfL9Iyguz/7RgLJw=",
       "license": "ISC",
       "dependencies": {
         "icss-utils": "^5.0.0"
@@ -15292,8 +15291,8 @@
     },
     "node_modules/postcss-nested": {
       "version": "6.2.0",
-      "resolved": "https://registry.npmjs.org/postcss-nested/-/postcss-nested-6.2.0.tgz",
-      "integrity": "sha512-HQbt28KulC5AJzG+cZtj9kvKB93CFCdLvog1WFLf1D+xmMvPGlBstkpTEZfK5+AN9hfJocyBFCNiqyS48bpgzQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-nested/-/postcss-nested-6.2.0.tgz",
+      "integrity": "sha1-TC0iq18gucth4sXFkVlQeE0GgTE=",
       "funding": [
         {
           "type": "opencollective",
@@ -15317,8 +15316,8 @@
     },
     "node_modules/postcss-nesting": {
       "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/postcss-nesting/-/postcss-nesting-10.2.0.tgz",
-      "integrity": "sha512-EwMkYchxiDiKUhlJGzWsD9b2zvq/r2SSubcRrgP+jujMXFzqvANLt16lJANC+5uZ6hjI7lpRmI6O8JIl+8l1KA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-nesting/-/postcss-nesting-10.2.0.tgz",
+      "integrity": "sha1-CxLODbjt/S2K4Kr4ZCc3C4mIkL4=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/selector-specificity": "^2.0.0",
@@ -15337,8 +15336,8 @@
     },
     "node_modules/postcss-normalize": {
       "version": "10.0.1",
-      "resolved": "https://registry.npmjs.org/postcss-normalize/-/postcss-normalize-10.0.1.tgz",
-      "integrity": "sha512-+5w18/rDev5mqERcG3W5GZNMJa1eoYYNGo8gB7tEwaos0ajk3ZXAI4mHGcNT47NE+ZnZD1pEpUOFLvltIwmeJA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize/-/postcss-normalize-10.0.1.tgz",
+      "integrity": "sha1-RkaSZ2tSeSoGsGiAoXYnkhZUDdc=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/normalize.css": "*",
@@ -15355,8 +15354,8 @@
     },
     "node_modules/postcss-normalize-charset": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-normalize-charset/-/postcss-normalize-charset-5.1.0.tgz",
-      "integrity": "sha512-mSgUJ+pd/ldRGVx26p2wz9dNZ7ji6Pn8VWBajMXFf8jk7vUoSrZ2lt/wZR7DtlZYKesmZI680qjr2CeFF2fbUg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize-charset/-/postcss-normalize-charset-5.1.0.tgz",
+      "integrity": "sha1-kwLeCykJS1LCWemyz43Ah5h58O0=",
       "license": "MIT",
       "engines": {
         "node": "^10 || ^12 || >=14.0"
@@ -15367,8 +15366,8 @@
     },
     "node_modules/postcss-normalize-display-values": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-normalize-display-values/-/postcss-normalize-display-values-5.1.0.tgz",
-      "integrity": "sha512-WP4KIM4o2dazQXWmFaqMmcvsKmhdINFblgSeRgn8BJ6vxaMyaJkwAzpPpuvSIoG/rmX3M+IrRZEz2H0glrQNEA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize-display-values/-/postcss-normalize-display-values-5.1.0.tgz",
+      "integrity": "sha1-cqu65YCBlg6e3XIA/PIauDJcPag=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15382,8 +15381,8 @@
     },
     "node_modules/postcss-normalize-positions": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-normalize-positions/-/postcss-normalize-positions-5.1.1.tgz",
-      "integrity": "sha512-6UpCb0G4eofTCQLFVuI3EVNZzBNPiIKcA1AKVka+31fTVySphr3VUgAIULBhxZkKgwLImhzMR2Bw1ORK+37INg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize-positions/-/postcss-normalize-positions-5.1.1.tgz",
+      "integrity": "sha1-75cnnYlAh7WTJbRcR/HoY9rvu5I=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15397,8 +15396,8 @@
     },
     "node_modules/postcss-normalize-repeat-style": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-normalize-repeat-style/-/postcss-normalize-repeat-style-5.1.1.tgz",
-      "integrity": "sha512-mFpLspGWkQtBcWIRFLmewo8aC3ImN2i/J3v8YCFUwDnPu3Xz4rLohDO26lGjwNsQxB3YF0KKRwspGzE2JEuS0g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize-repeat-style/-/postcss-normalize-repeat-style-5.1.1.tgz",
+      "integrity": "sha1-6euWgFIE9HZt9m/QntLhNUVCD7I=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15412,8 +15411,8 @@
     },
     "node_modules/postcss-normalize-string": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-normalize-string/-/postcss-normalize-string-5.1.0.tgz",
-      "integrity": "sha512-oYiIJOf4T9T1N4i+abeIc7Vgm/xPCGih4bZz5Nm0/ARVJ7K6xrDlLwvwqOydvyL3RHNf8qZk6vo3aatiw/go3w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize-string/-/postcss-normalize-string-5.1.0.tgz",
+      "integrity": "sha1-QRlhFp4HMIyCwfjFXz6KM3dX4ig=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15427,8 +15426,8 @@
     },
     "node_modules/postcss-normalize-timing-functions": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-normalize-timing-functions/-/postcss-normalize-timing-functions-5.1.0.tgz",
-      "integrity": "sha512-DOEkzJ4SAXv5xkHl0Wa9cZLF3WCBhF3o1SKVxKQAa+0pYKlueTpCgvkFAHfk+Y64ezX9+nITGrDZeVGgITJXjg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize-timing-functions/-/postcss-normalize-timing-functions-5.1.0.tgz",
+      "integrity": "sha1-1WFEEPjwsjiOnyQKpgEbpvUtr7s=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15442,8 +15441,8 @@
     },
     "node_modules/postcss-normalize-unicode": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-normalize-unicode/-/postcss-normalize-unicode-5.1.1.tgz",
-      "integrity": "sha512-qnCL5jzkNUmKVhZoENp1mJiGNPcsJCs1aaRmURmeJGES23Z/ajaln+EPTD+rBeNkSryI+2WTdW+lwcVdOikrpA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize-unicode/-/postcss-normalize-unicode-5.1.1.tgz",
+      "integrity": "sha1-9nKX/KP+p/F+DSyqQHaa/Eh6oDA=",
       "license": "MIT",
       "dependencies": {
         "browserslist": "^4.21.4",
@@ -15458,8 +15457,8 @@
     },
     "node_modules/postcss-normalize-url": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-normalize-url/-/postcss-normalize-url-5.1.0.tgz",
-      "integrity": "sha512-5upGeDO+PVthOxSmds43ZeMeZfKH+/DKgGRD7TElkkyS46JXAUhMzIKiCa7BabPeIy3AQcTkXwVVN7DbqsiCew==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize-url/-/postcss-normalize-url-5.1.0.tgz",
+      "integrity": "sha1-7Z2IyoLiGr75n3Q0V9NymgQq3Nw=",
       "license": "MIT",
       "dependencies": {
         "normalize-url": "^6.0.1",
@@ -15474,8 +15473,8 @@
     },
     "node_modules/postcss-normalize-whitespace": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-normalize-whitespace/-/postcss-normalize-whitespace-5.1.1.tgz",
-      "integrity": "sha512-83ZJ4t3NUDETIHTa3uEg6asWjSBYL5EdkVB0sDncx9ERzOKBVJIUeDO9RyA9Zwtig8El1d79HBp0JEi8wvGQnA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-normalize-whitespace/-/postcss-normalize-whitespace-5.1.1.tgz",
+      "integrity": "sha1-CKGg0f+henzG7+HmydqWnMRJPPo=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15489,8 +15488,8 @@
     },
     "node_modules/postcss-opacity-percentage": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/postcss-opacity-percentage/-/postcss-opacity-percentage-1.1.3.tgz",
-      "integrity": "sha512-An6Ba4pHBiDtyVpSLymUUERMo2cU7s+Obz6BTrS+gxkbnSBNKSuD0AVUc+CpBMrpVPKKfoVz0WQCX+Tnst0i4A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-opacity-percentage/-/postcss-opacity-percentage-1.1.3.tgz",
+      "integrity": "sha1-W4mzVVGlVuIMXSPrUmD7/PUkXaY=",
       "funding": [
         {
           "type": "kofi",
@@ -15511,8 +15510,8 @@
     },
     "node_modules/postcss-ordered-values": {
       "version": "5.1.3",
-      "resolved": "https://registry.npmjs.org/postcss-ordered-values/-/postcss-ordered-values-5.1.3.tgz",
-      "integrity": "sha512-9UO79VUhPwEkzbb3RNpqqghc6lcYej1aveQteWY+4POIwlqkYE21HKWaLDF6lWNuqCobEAyTovVhtI32Rbv2RQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-ordered-values/-/postcss-ordered-values-5.1.3.tgz",
+      "integrity": "sha1-tv0r0Q+TeyPYa8gpxp53Ms526jg=",
       "license": "MIT",
       "dependencies": {
         "cssnano-utils": "^3.1.0",
@@ -15527,8 +15526,8 @@
     },
     "node_modules/postcss-overflow-shorthand": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/postcss-overflow-shorthand/-/postcss-overflow-shorthand-3.0.4.tgz",
-      "integrity": "sha512-otYl/ylHK8Y9bcBnPLo3foYFLL6a6Ak+3EQBPOTR7luMYCOsiVTUk1iLvNf6tVPNGXcoL9Hoz37kpfriRIFb4A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-overflow-shorthand/-/postcss-overflow-shorthand-3.0.4.tgz",
+      "integrity": "sha1-ftZIb+xEt28OqxWqSGbNpdVdiT4=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15546,8 +15545,8 @@
     },
     "node_modules/postcss-page-break": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/postcss-page-break/-/postcss-page-break-3.0.4.tgz",
-      "integrity": "sha512-1JGu8oCjVXLa9q9rFTo4MbeeA5FMe00/9C7lN4va606Rdb+HkxXtXsmEDrIraQ11fGz/WvKWa8gMuCKkrXpTsQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-page-break/-/postcss-page-break-3.0.4.tgz",
+      "integrity": "sha1-f790HCM2IWIraNQ1ur+3DdjB7l8=",
       "license": "MIT",
       "peerDependencies": {
         "postcss": "^8"
@@ -15555,8 +15554,8 @@
     },
     "node_modules/postcss-place": {
       "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/postcss-place/-/postcss-place-7.0.5.tgz",
-      "integrity": "sha512-wR8igaZROA6Z4pv0d+bvVrvGY4GVHihBCBQieXFY3kuSuMyOmEnnfFzHl/tQuqHZkfkIVBEbDvYcFfHmpSet9g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-place/-/postcss-place-7.0.5.tgz",
+      "integrity": "sha1-ldv4X9llajpuYOgytYCZFCNphsQ=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15574,8 +15573,8 @@
     },
     "node_modules/postcss-preset-env": {
       "version": "7.8.3",
-      "resolved": "https://registry.npmjs.org/postcss-preset-env/-/postcss-preset-env-7.8.3.tgz",
-      "integrity": "sha512-T1LgRm5uEVFSEF83vHZJV2z19lHg4yJuZ6gXZZkqVsqv63nlr6zabMH3l4Pc01FQCyfWVrh2GaUeCVy9Po+Aag==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-preset-env/-/postcss-preset-env-7.8.3.tgz",
+      "integrity": "sha1-KlD15hLDFJzHr3VjTiAqWyrU8eI=",
       "license": "CC0-1.0",
       "dependencies": {
         "@csstools/postcss-cascade-layers": "^1.1.1",
@@ -15641,8 +15640,8 @@
     },
     "node_modules/postcss-pseudo-class-any-link": {
       "version": "7.1.6",
-      "resolved": "https://registry.npmjs.org/postcss-pseudo-class-any-link/-/postcss-pseudo-class-any-link-7.1.6.tgz",
-      "integrity": "sha512-9sCtZkO6f/5ML9WcTLcIyV1yz9D1rf0tWc+ulKcvV30s0iZKS/ONyETvoWsr6vnrmW+X+KmuK3gV/w5EWnT37w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-pseudo-class-any-link/-/postcss-pseudo-class-any-link-7.1.6.tgz",
+      "integrity": "sha1-JpOyIZAtp3LCeN74Wk2aZLbmF6s=",
       "license": "CC0-1.0",
       "dependencies": {
         "postcss-selector-parser": "^6.0.10"
@@ -15660,8 +15659,8 @@
     },
     "node_modules/postcss-reduce-initial": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/postcss-reduce-initial/-/postcss-reduce-initial-5.1.2.tgz",
-      "integrity": "sha512-dE/y2XRaqAi6OvjzD22pjTUQ8eOfc6m/natGHgKFBK9DxFmIm69YmaRVQrGgFlEfc1HePIurY0TmDeROK05rIg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-reduce-initial/-/postcss-reduce-initial-5.1.2.tgz",
+      "integrity": "sha1-eYzXez4DPq5xBcGMnTcdmJ4TgtY=",
       "license": "MIT",
       "dependencies": {
         "browserslist": "^4.21.4",
@@ -15676,8 +15675,8 @@
     },
     "node_modules/postcss-reduce-transforms": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-reduce-transforms/-/postcss-reduce-transforms-5.1.0.tgz",
-      "integrity": "sha512-2fbdbmgir5AvpW9RLtdONx1QoYG2/EtqpNQbFASDlixBbAYuTcJ0dECwlqNqH7VbaUnEnh8SrxOe2sRIn24XyQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-reduce-transforms/-/postcss-reduce-transforms-5.1.0.tgz",
+      "integrity": "sha1-Mztw53WLgC890N3+mLscz++Wtuk=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0"
@@ -15691,8 +15690,8 @@
     },
     "node_modules/postcss-replace-overflow-wrap": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/postcss-replace-overflow-wrap/-/postcss-replace-overflow-wrap-4.0.0.tgz",
-      "integrity": "sha512-KmF7SBPphT4gPPcKZc7aDkweHiKEEO8cla/GjcBK+ckKxiZslIu3C4GCRW3DNfL0o7yW7kMQu9xlZ1kXRXLXtw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-replace-overflow-wrap/-/postcss-replace-overflow-wrap-4.0.0.tgz",
+      "integrity": "sha1-0t9r7RC0d7+cUvqyjFaLSynKQxk=",
       "license": "MIT",
       "peerDependencies": {
         "postcss": "^8.0.3"
@@ -15700,8 +15699,8 @@
     },
     "node_modules/postcss-selector-not": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/postcss-selector-not/-/postcss-selector-not-6.0.1.tgz",
-      "integrity": "sha512-1i9affjAe9xu/y9uqWH+tD4r6/hDaXJruk8xn2x1vzxC2U3J3LKO3zJW4CyxlNhA56pADJ/djpEwpH1RClI2rQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-selector-not/-/postcss-selector-not-6.0.1.tgz",
+      "integrity": "sha1-jwpwm/fUtFIieT/DRAm+QHU3VW0=",
       "license": "MIT",
       "dependencies": {
         "postcss-selector-parser": "^6.0.10"
@@ -15719,8 +15718,8 @@
     },
     "node_modules/postcss-selector-parser": {
       "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
-      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
+      "integrity": "sha1-/exMqA9Xgb0hbKm/iaKg/M//pfA=",
       "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
@@ -15732,8 +15731,8 @@
     },
     "node_modules/postcss-svgo": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-svgo/-/postcss-svgo-5.1.0.tgz",
-      "integrity": "sha512-D75KsH1zm5ZrHyxPakAxJWtkyXew5qwS70v56exwvw542d9CRtTo78K0WeFxZB4G7JXKKMbEZtZayTGdIky/eA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-svgo/-/postcss-svgo-5.1.0.tgz",
+      "integrity": "sha1-CjF0AM7XifIzoogm53Uj8VhX2A0=",
       "license": "MIT",
       "dependencies": {
         "postcss-value-parser": "^4.2.0",
@@ -15748,8 +15747,8 @@
     },
     "node_modules/postcss-unique-selectors": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-unique-selectors/-/postcss-unique-selectors-5.1.1.tgz",
-      "integrity": "sha512-5JiODlELrz8L2HwxfPnhOWZYWDxVHWL83ufOv84NrcgipI7TaeRsatAhK4Tr2/ZiYldpK/wBvw5BD3qfaK96GA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-unique-selectors/-/postcss-unique-selectors-5.1.1.tgz",
+      "integrity": "sha1-qfJz0erNCemqYIj0sFB7GLG1QbY=",
       "license": "MIT",
       "dependencies": {
         "postcss-selector-parser": "^6.0.5"
@@ -15763,14 +15762,14 @@
     },
     "node_modules/postcss-value-parser": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
-      "integrity": "sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz",
+      "integrity": "sha1-cjwJkgg2um0+WvAZ+SvAlxwC5RQ=",
       "license": "MIT"
     },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
-      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha1-3rxkidem5rDnYRiIzsiAM30xY5Y=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8.0"
@@ -15778,8 +15777,8 @@
     },
     "node_modules/pretty-bytes": {
       "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/pretty-bytes/-/pretty-bytes-5.6.0.tgz",
-      "integrity": "sha512-FFw039TmrBqFK8ma/7OL3sDz/VytdtJr044/QUJtH0wK9lb9jLq9tJyIxUwtQJHwar2BqtiA4iCWSwo9JLkzFg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/pretty-bytes/-/pretty-bytes-5.6.0.tgz",
+      "integrity": "sha1-NWJW9kOAR3PIL2RyP+eMksYr6us=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -15790,8 +15789,8 @@
     },
     "node_modules/pretty-error": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/pretty-error/-/pretty-error-4.0.0.tgz",
-      "integrity": "sha512-AoJ5YMAcXKYxKhuJGdcvse+Voc6v1RgnsR3nWcYU7q4t6z0Q6T86sv5Zq8VIRbOWWFpvdGE83LtdSMNd+6Y0xw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/pretty-error/-/pretty-error-4.0.0.tgz",
+      "integrity": "sha1-kKcD9G3XI0rbRtD4SCPp0cuPENY=",
       "license": "MIT",
       "dependencies": {
         "lodash": "^4.17.20",
@@ -15800,8 +15799,8 @@
     },
     "node_modules/pretty-format": {
       "version": "27.5.1",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
-      "integrity": "sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/pretty-format/-/pretty-format-27.5.1.tgz",
+      "integrity": "sha1-IYGHn96lGnpYUfs52SD6pj8B2I4=",
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1",
@@ -15814,8 +15813,8 @@
     },
     "node_modules/pretty-format/node_modules/ansi-styles": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-5.2.0.tgz",
-      "integrity": "sha512-Cxwpt2SfTzTtXcfOlzGEee8O+c+MmUgGrNiBcXnuWxuFJHe6a5Hz7qwhwe5OgaSYI0IJvkLqWX1ASG+cJOkEiA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ansi-styles/-/ansi-styles-5.2.0.tgz",
+      "integrity": "sha1-B0SWkK1Fd30ZJKwquy/IiV26g2s=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -15826,14 +15825,14 @@
     },
     "node_modules/process-nextick-args": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
-      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+      "integrity": "sha1-eCDZsWEgzFXKmud5JoCufbptf+I=",
       "license": "MIT"
     },
     "node_modules/promise": {
       "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/promise/-/promise-8.3.0.tgz",
-      "integrity": "sha512-rZPNPKTOYVNEEKFaq1HqTgOwZD+4/YHS5ukLzQCypkj+OkYx7iv0mA91lJlpPPZ8vMau3IIGj5Qlwrx+8iiSmg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/promise/-/promise-8.3.0.tgz",
+      "integrity": "sha1-jLMz0e3rYe8jhp+7ik6gJ5q2Dgo=",
       "license": "MIT",
       "dependencies": {
         "asap": "~2.0.6"
@@ -15841,8 +15840,8 @@
     },
     "node_modules/prompts": {
       "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz",
-      "integrity": "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/prompts/-/prompts-2.4.2.tgz",
+      "integrity": "sha1-e1fnOzpIAprRDr1E90sBcipMsGk=",
       "license": "MIT",
       "dependencies": {
         "kleur": "^3.0.3",
@@ -15854,8 +15853,8 @@
     },
     "node_modules/prop-types": {
       "version": "15.8.1",
-      "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
-      "integrity": "sha512-oj87CgZICdulUohogVAR7AjlC0327U4el4L6eAvOqCeudMDVU0NThNaV+b9Df4dXgSP1gXMTnPdhfe/2qDH5cg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/prop-types/-/prop-types-15.8.1.tgz",
+      "integrity": "sha1-Z9h78aaU9IQ1zzMsJK8QIUoxQLU=",
       "license": "MIT",
       "dependencies": {
         "loose-envify": "^1.4.0",
@@ -15865,14 +15864,14 @@
     },
     "node_modules/prop-types/node_modules/react-is": {
       "version": "16.13.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
-      "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-is/-/react-is-16.13.1.tgz",
+      "integrity": "sha1-eJcppNw23imZ3BVt1sHZwYzqVqQ=",
       "license": "MIT"
     },
     "node_modules/proxy-addr": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha1-8Z/mnOqzEe65S0LnDowgcPm6ECU=",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -15884,8 +15883,8 @@
     },
     "node_modules/proxy-addr/node_modules/ipaddr.js": {
       "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
-      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha1-v/OFQ+64mEglB5/zoqjmy9RngbM=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.10"
@@ -15893,8 +15892,8 @@
     },
     "node_modules/proxy-from-env": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
-      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+      "integrity": "sha1-p0h1aK2tV3z6qn6IxJyrOrMIGro=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -15902,8 +15901,8 @@
     },
     "node_modules/psl": {
       "version": "1.15.0",
-      "resolved": "https://registry.npmjs.org/psl/-/psl-1.15.0.tgz",
-      "integrity": "sha512-JZd3gMVBAVQkSs6HdNZo9Sdo0LNcQeMNP3CozBJb3JYC/QUYZTnKxP+f8oWRX4rHP5EurWxqAHTSwUCjlNKa1w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/psl/-/psl-1.15.0.tgz",
+      "integrity": "sha1-vazjGJbx2XzsannoIkiYzpPZdMY=",
       "license": "MIT",
       "dependencies": {
         "punycode": "^2.3.1"
@@ -15914,8 +15913,8 @@
     },
     "node_modules/punycode": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha1-AnQi4vrsCyXhVJw+G9gwm5EztuU=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -15923,8 +15922,8 @@
     },
     "node_modules/qs": {
       "version": "6.15.3",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.3.tgz",
-      "integrity": "sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/qs/-/qs-6.15.3.tgz",
+      "integrity": "sha1-doUhMqWO1cfA72fkRBubtdYGGzs=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "es-define-property": "^1.0.1",
@@ -15939,14 +15938,14 @@
     },
     "node_modules/querystringify": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
-      "integrity": "sha512-FIqgj2EUvTa7R50u0rGsyTftzjYmv/a3hO345bZNrqabNqjtgiDMgmo4mkUjd+nzU5oF3dClKqFIPUKybUyqoQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/querystringify/-/querystringify-2.2.0.tgz",
+      "integrity": "sha1-M0WUG0FTy50ILY7uTNogFqmu9/Y=",
       "license": "MIT"
     },
     "node_modules/queue-microtask": {
       "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
-      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha1-SSkii7xyTfrEPg77BYyve2z7YkM=",
       "funding": [
         {
           "type": "github",
@@ -15965,8 +15964,8 @@
     },
     "node_modules/raf": {
       "version": "3.4.1",
-      "resolved": "https://registry.npmjs.org/raf/-/raf-3.4.1.tgz",
-      "integrity": "sha512-Sq4CW4QhwOHE8ucn6J34MqtZCeWFP2aQSmrlroYgqAV1PjStIhJXxYuTgUIfkEk7zTLjmIjLmU5q+fbD1NnOJA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/raf/-/raf-3.4.1.tgz",
+      "integrity": "sha1-B0LpmkplUvRF1z4+4DKK8P8e3jk=",
       "license": "MIT",
       "dependencies": {
         "performance-now": "^2.1.0"
@@ -15974,8 +15973,8 @@
     },
     "node_modules/range-parser": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
-      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha1-PPNwI9GZ4cJNGlW4SADC8+ZGgDE=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -15983,8 +15982,8 @@
     },
     "node_modules/raw-body": {
       "version": "2.5.3",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.3.tgz",
-      "integrity": "sha512-s4VSOf6yN0rvbRZGxs8Om5CWj6seneMwK3oDb4lWDH0UPhWcxwOWw5+qk24bxq87szX1ydrwylIOp2uG1ojUpA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/raw-body/-/raw-body-2.5.3.tgz",
+      "integrity": "sha1-EcZlDudwp94bSU8ZeSfeDJI4IuI=",
       "license": "MIT",
       "dependencies": {
         "bytes": "~3.1.2",
@@ -15998,8 +15997,8 @@
     },
     "node_modules/raw-body/node_modules/iconv-lite": {
       "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha1-ICK0sl+93CHS9SSXSkdKr+czkIs=",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3"
@@ -16010,8 +16009,8 @@
     },
     "node_modules/react": {
       "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react/-/react-18.3.1.tgz",
-      "integrity": "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react/-/react-18.3.1.tgz",
+      "integrity": "sha1-SauJIAnFOTNiW9FrJTP8dUyrKJE=",
       "license": "MIT",
       "dependencies": {
         "loose-envify": "^1.1.0"
@@ -16022,8 +16021,8 @@
     },
     "node_modules/react-app-polyfill": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/react-app-polyfill/-/react-app-polyfill-3.0.0.tgz",
-      "integrity": "sha512-sZ41cxiU5llIB003yxxQBYrARBqe0repqPTTYBTmMqTz9szeBbE37BehCE891NZsmdZqqP+xWKdT3eo3vOzN8w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-app-polyfill/-/react-app-polyfill-3.0.0.tgz",
+      "integrity": "sha1-lSIeCpvSWeXKaxd8e7HLZ2j2j9c=",
       "license": "MIT",
       "dependencies": {
         "core-js": "^3.19.2",
@@ -16039,8 +16038,8 @@
     },
     "node_modules/react-chartjs-2": {
       "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/react-chartjs-2/-/react-chartjs-2-5.3.1.tgz",
-      "integrity": "sha512-h5IPXKg9EXpjoBzUfyWJvllMjG2mQ4EiuHQFhms/AjUm0XSZHhyRy2xVmLXHKrtcdrPO4mnGqRtYoD0vp95A0A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-chartjs-2/-/react-chartjs-2-5.3.1.tgz",
+      "integrity": "sha1-KymZXOiwf1yVxuo2loOFaeiEU6o=",
       "license": "MIT",
       "peerDependencies": {
         "chart.js": "^4.1.1",
@@ -16049,8 +16048,8 @@
     },
     "node_modules/react-dev-utils": {
       "version": "12.0.1",
-      "resolved": "https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-12.0.1.tgz",
-      "integrity": "sha512-84Ivxmr17KjUupyqzFode6xKhjwuEJDROWKJy/BthkL7Wn6NJ8h4WE6k/exAv6ImS+0oZLRRW5j/aINMHyeGeQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-dev-utils/-/react-dev-utils-12.0.1.tgz",
+      "integrity": "sha1-upLttKHzeb1GzNa81Oe8OY3zPnM=",
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.16.0",
@@ -16084,8 +16083,8 @@
     },
     "node_modules/react-dev-utils/node_modules/find-up": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
-      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/find-up/-/find-up-5.0.0.tgz",
+      "integrity": "sha1-TJKBnstwg1YeT0okCoa+UZj1Nvw=",
       "license": "MIT",
       "dependencies": {
         "locate-path": "^6.0.0",
@@ -16100,8 +16099,8 @@
     },
     "node_modules/react-dev-utils/node_modules/loader-utils": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-3.3.1.tgz",
-      "integrity": "sha512-FMJTLMXfCLMLfJxcX9PFqX5qD88Z5MRGaZCVzfuqeZSPsyiBzs+pahDQjbIWz2QIzPZz0NX9Zy4FX3lmK6YHIg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/loader-utils/-/loader-utils-3.3.1.tgz",
+      "integrity": "sha1-c1uaGf1jZIynrb0xwjJ9/igTBOU=",
       "license": "MIT",
       "engines": {
         "node": ">= 12.13.0"
@@ -16109,8 +16108,8 @@
     },
     "node_modules/react-dev-utils/node_modules/locate-path": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
-      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/locate-path/-/locate-path-6.0.0.tgz",
+      "integrity": "sha1-VTIeswn+u8WcSAHZMackUqaB0oY=",
       "license": "MIT",
       "dependencies": {
         "p-locate": "^5.0.0"
@@ -16124,8 +16123,8 @@
     },
     "node_modules/react-dev-utils/node_modules/p-limit": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha1-4drMvnjQ0TiMoYxk/qOOPlfjcGs=",
       "license": "MIT",
       "dependencies": {
         "yocto-queue": "^0.1.0"
@@ -16139,8 +16138,8 @@
     },
     "node_modules/react-dev-utils/node_modules/p-locate": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
-      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/p-locate/-/p-locate-5.0.0.tgz",
+      "integrity": "sha1-g8gxXGeFAF470CGDlBHJ4RDm2DQ=",
       "license": "MIT",
       "dependencies": {
         "p-limit": "^3.0.2"
@@ -16154,8 +16153,8 @@
     },
     "node_modules/react-dom": {
       "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.3.1.tgz",
-      "integrity": "sha512-5m4nQKp+rZRb09LNH59GM4BxTh9251/ylbKIbpe7TpGxfJ+9kv6BLkLBXIjjspbgbnIBNqlI23tRnTWT0snUIw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-dom/-/react-dom-18.3.1.tgz",
+      "integrity": "sha1-wiZdeVEbV9R5s90/36UVNklMXLQ=",
       "license": "MIT",
       "dependencies": {
         "loose-envify": "^1.1.0",
@@ -16167,20 +16166,20 @@
     },
     "node_modules/react-error-overlay": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/react-error-overlay/-/react-error-overlay-6.1.0.tgz",
-      "integrity": "sha512-SN/U6Ytxf1QGkw/9ve5Y+NxBbZM6Ht95tuXNMKs8EJyFa/Vy/+Co3stop3KBHARfn/giv+Lj1uUnTfOJ3moFEQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-error-overlay/-/react-error-overlay-6.1.0.tgz",
+      "integrity": "sha1-IrhiVr6xxYVvCKmiKK24Eh3ZhfI=",
       "license": "MIT"
     },
     "node_modules/react-is": {
       "version": "17.0.2",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-17.0.2.tgz",
-      "integrity": "sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-is/-/react-is-17.0.2.tgz",
+      "integrity": "sha1-5pHUqOnHiTZWVVOas3J2Kw77VPA=",
       "license": "MIT"
     },
     "node_modules/react-refresh": {
       "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.11.0.tgz",
-      "integrity": "sha512-F27qZr8uUqwhWZboondsPx8tnC3Ct3SxZA3V5WyEvujRyyNv0VYPhoBg1gZ8/MV5tubQp76Trw8lTv9hzRBa+A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-refresh/-/react-refresh-0.11.0.tgz",
+      "integrity": "sha1-dxmLlEcz8PHxqQ55HeRUH58HQEY=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -16188,8 +16187,8 @@
     },
     "node_modules/react-router": {
       "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.2.tgz",
-      "integrity": "sha512-aUVMjFm3GAPTTZL7oYr5E7ETiqfQCHRLH+B+5afnICvf0r7kkK4eR6SMuwbSTJw/7t+12khT/Kahij49fqOCIg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-router/-/react-router-7.18.2.tgz",
+      "integrity": "sha1-p2xGzp5e2s1PUSidWnH3EwXbkVI=",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.1",
@@ -16210,8 +16209,8 @@
     },
     "node_modules/react-router-dom": {
       "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.2.tgz",
-      "integrity": "sha512-AIKJ/jgGlFb3EbfCXk5Gzshiwt+l3mqbCrNjmEWMMjqQxNJ3svBa6bgzFyCC2Sw3RA0VWF1kg3uQf2OFhxb8hw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-router-dom/-/react-router-dom-7.18.2.tgz",
+      "integrity": "sha1-AL8dDOi/F6bYMZSarNpyphIOSSY=",
       "license": "MIT",
       "dependencies": {
         "react-router": "7.18.2"
@@ -16226,8 +16225,8 @@
     },
     "node_modules/react-scripts": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/react-scripts/-/react-scripts-5.0.1.tgz",
-      "integrity": "sha512-8VAmEm/ZAwQzJ+GOMLbBsTdDKOpuZh7RPs0UymvBR2vRk4iZWCskjbFnxqjrzoIvlNNRZ3QJFx6/qDSi6zSnaQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-scripts/-/react-scripts-5.0.1.tgz",
+      "integrity": "sha1-YoXb1lqLpuScqNZRzjBkWm2YAAM=",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.16.0",
@@ -16299,8 +16298,8 @@
     },
     "node_modules/react-smooth": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/react-smooth/-/react-smooth-4.0.4.tgz",
-      "integrity": "sha512-gnGKTpYwqL0Iii09gHobNolvX4Kiq4PKx6eWBCYYix+8cdw+cGo3do906l1NBPKkSWx1DghC1dlWG9L2uGd61Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-smooth/-/react-smooth-4.0.4.tgz",
+      "integrity": "sha1-pYdfi7YZY8phuBnO3FadwkU4lLQ=",
       "license": "MIT",
       "dependencies": {
         "fast-equals": "^5.0.1",
@@ -16314,8 +16313,8 @@
     },
     "node_modules/react-transition-group": {
       "version": "4.4.5",
-      "resolved": "https://registry.npmjs.org/react-transition-group/-/react-transition-group-4.4.5.tgz",
-      "integrity": "sha512-pZcd1MCJoiKiBR2NRxeCRg13uCXbydPnmB4EOeRrY7480qNWO8IIgQG6zlDkm6uRMsURXPuKq0GWtiM59a5Q6g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-transition-group/-/react-transition-group-4.4.5.tgz",
+      "integrity": "sha1-5T1OPzNE2oUhSJ+++PJYHUK+zdE=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "@babel/runtime": "^7.5.5",
@@ -16330,8 +16329,8 @@
     },
     "node_modules/read-cache": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/read-cache/-/read-cache-1.0.0.tgz",
-      "integrity": "sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/read-cache/-/read-cache-1.0.0.tgz",
+      "integrity": "sha1-5mTvMRYRZsl1HNvo28+GtftY93Q=",
       "license": "MIT",
       "dependencies": {
         "pify": "^2.3.0"
@@ -16339,8 +16338,8 @@
     },
     "node_modules/readable-stream": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha1-VqmzbqllwAxak+8x6xEaDxEFaWc=",
       "license": "MIT",
       "dependencies": {
         "inherits": "^2.0.3",
@@ -16353,8 +16352,8 @@
     },
     "node_modules/readdirp": {
       "version": "3.6.0",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
-      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/readdirp/-/readdirp-3.6.0.tgz",
+      "integrity": "sha1-dKNwvYVxFuJFspzJc0DNQxoCpsc=",
       "license": "MIT",
       "dependencies": {
         "picomatch": "^2.2.1"
@@ -16365,8 +16364,8 @@
     },
     "node_modules/recharts": {
       "version": "2.15.4",
-      "resolved": "https://registry.npmjs.org/recharts/-/recharts-2.15.4.tgz",
-      "integrity": "sha512-UT/q6fwS3c1dHbXv2uFgYJ9BMFHu3fwnd7AYZaEQhXuYQ4hgsxLvsUXzGdKeZrW5xopzDCvuA2N41WJ88I7zIw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/recharts/-/recharts-2.15.4.tgz",
+      "integrity": "sha1-DtPmbAhDvPLZ+aFyyvl7HQUSel8=",
       "deprecated": "1.x and 2.x branches are no longer active. Bump to Recharts v3 to receive latest features and bugfixes. See https://github.com/recharts/recharts/wiki/3.0-migration-guide",
       "license": "MIT",
       "dependencies": {
@@ -16389,8 +16388,8 @@
     },
     "node_modules/recharts-scale": {
       "version": "0.4.5",
-      "resolved": "https://registry.npmjs.org/recharts-scale/-/recharts-scale-0.4.5.tgz",
-      "integrity": "sha512-kivNFO+0OcUNu7jQquLXAxz1FIwZj8nrj+YkOKc5694NbjCvcT6aSZiIzNzd2Kul4o4rTto8QVR9lMNtxD4G1w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/recharts-scale/-/recharts-scale-0.4.5.tgz",
+      "integrity": "sha1-CWknHxTnMuZC/MW9SrJw1uh90dk=",
       "license": "MIT",
       "dependencies": {
         "decimal.js-light": "^2.4.1"
@@ -16398,14 +16397,14 @@
     },
     "node_modules/recharts/node_modules/react-is": {
       "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/react-is/-/react-is-18.3.1.tgz",
+      "integrity": "sha1-6DVX3BLq5jqZ4AOkY4ix3LtE234=",
       "license": "MIT"
     },
     "node_modules/recursive-readdir": {
       "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/recursive-readdir/-/recursive-readdir-2.2.3.tgz",
-      "integrity": "sha512-8HrF5ZsXk5FAH9dgsx3BlUer73nIhuj+9OrQwEbLTPOBzGkL1lsFCR01am+v+0m2Cmbs1nP12hLDl5FA7EszKA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/recursive-readdir/-/recursive-readdir-2.2.3.tgz",
+      "integrity": "sha1-5ybzKMDWkVO8q9XDItMZUlI3k3I=",
       "license": "MIT",
       "dependencies": {
         "minimatch": "^3.0.5"
@@ -16416,8 +16415,8 @@
     },
     "node_modules/reflect.getprototypeof": {
       "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/reflect.getprototypeof/-/reflect.getprototypeof-1.0.10.tgz",
-      "integrity": "sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/reflect.getprototypeof/-/reflect.getprototypeof-1.0.10.tgz",
+      "integrity": "sha1-xikhnnijMW2LYEx2XvaJlpZOe/k=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -16438,14 +16437,14 @@
     },
     "node_modules/regenerate": {
       "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/regenerate/-/regenerate-1.4.2.tgz",
-      "integrity": "sha512-zrceR/XhGYU/d/opr2EKO7aRHUeiBI8qjtfHqADTwZd6Szfy16la6kqD0MIUs5z5hx6AaKa+PixpPrR289+I0A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/regenerate/-/regenerate-1.4.2.tgz",
+      "integrity": "sha1-uTRtiCfo9aMve6KWN9OYtpAUhIo=",
       "license": "MIT"
     },
     "node_modules/regenerate-unicode-properties": {
       "version": "10.2.2",
-      "resolved": "https://registry.npmjs.org/regenerate-unicode-properties/-/regenerate-unicode-properties-10.2.2.tgz",
-      "integrity": "sha512-m03P+zhBeQd1RGnYxrGyDAPpWX/epKirLrp8e3qevZdVkKtnCrjjWczIbYc8+xd6vcTStVlqfycTx1KR4LOr0g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/regenerate-unicode-properties/-/regenerate-unicode-properties-10.2.2.tgz",
+      "integrity": "sha1-qhE4ErqJm2MGWMdiNGa+ceH4b2Y=",
       "license": "MIT",
       "dependencies": {
         "regenerate": "^1.4.2"
@@ -16456,20 +16455,20 @@
     },
     "node_modules/regenerator-runtime": {
       "version": "0.13.11",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
-      "integrity": "sha512-kY1AZVr2Ra+t+piVaJ4gxaFaReZVH40AKNo7UCX6W+dEwBo/2oZJzqfuN1qLq1oL45o56cPaTXELwrTh8Fpggg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/regenerator-runtime/-/regenerator-runtime-0.13.11.tgz",
+      "integrity": "sha1-9tyj587sIFkNB62nhWNqkM3KF/k=",
       "license": "MIT"
     },
     "node_modules/regex-parser": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/regex-parser/-/regex-parser-2.3.1.tgz",
-      "integrity": "sha512-yXLRqatcCuKtVHsWrNg0JL3l1zGfdXeEvDa0bdu4tCDQw0RpMDZsqbkyRTUnKMR0tXF627V2oEWjBEaEdqTwtQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/regex-parser/-/regex-parser-2.3.1.tgz",
+      "integrity": "sha1-7j9w5QvdgaIh1QUkLLmpwnWirZE=",
       "license": "MIT"
     },
     "node_modules/regexp.prototype.flags": {
       "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.4.tgz",
-      "integrity": "sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/regexp.prototype.flags/-/regexp.prototype.flags-1.5.4.tgz",
+      "integrity": "sha1-GtbGLUSiWQB+VbOXDgD3Ru+8qhk=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -16488,8 +16487,8 @@
     },
     "node_modules/regexpu-core": {
       "version": "6.4.0",
-      "resolved": "https://registry.npmjs.org/regexpu-core/-/regexpu-core-6.4.0.tgz",
-      "integrity": "sha512-0ghuzq67LI9bLXpOX/ISfve/Mq33a4aFRzoQYhnnok1JOFpmE/A2TBGkNVenOGEeSBCjIiWcc6MVOG5HEQv0sA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/regexpu-core/-/regexpu-core-6.4.0.tgz",
+      "integrity": "sha1-NYDODE+u3vWZ7MsUZhJDa2KhduU=",
       "license": "MIT",
       "dependencies": {
         "regenerate": "^1.4.2",
@@ -16505,14 +16504,14 @@
     },
     "node_modules/regjsgen": {
       "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/regjsgen/-/regjsgen-0.8.0.tgz",
-      "integrity": "sha512-RvwtGe3d7LvWiDQXeQw8p5asZUmfU1G/l6WbUXeHta7Y2PEIvBTwH6E2EfmYUK8pxcxEdEmaomqyp0vZZ7C+3Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/regjsgen/-/regjsgen-0.8.0.tgz",
+      "integrity": "sha1-3yP/JuDFswCmRwytFgqdCQw6N6s=",
       "license": "MIT"
     },
     "node_modules/regjsparser": {
       "version": "0.13.2",
-      "resolved": "https://registry.npmjs.org/regjsparser/-/regjsparser-0.13.2.tgz",
-      "integrity": "sha512-NgRBy2Nx/bE+9F27nVHnqcN5HjyLmecqsqx2PJHu3/IEtADD4WuxuXIVExD5PoSDFVrl78dOonfcOe5O+5nbzQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/regjsparser/-/regjsparser-0.13.2.tgz",
+      "integrity": "sha1-9lRzS1xYiyK6PiFpOzBSNBcYCAg=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "jsesc": "~3.1.0"
@@ -16523,8 +16522,8 @@
     },
     "node_modules/relateurl": {
       "version": "0.2.7",
-      "resolved": "https://registry.npmjs.org/relateurl/-/relateurl-0.2.7.tgz",
-      "integrity": "sha512-G08Dxvm4iDN3MLM0EsP62EDV9IuhXPR6blNz6Utcp7zyV3tr4HVNINt6MpaRWbxoOHT3Q7YN2P+jaHX8vUbgog==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/relateurl/-/relateurl-0.2.7.tgz",
+      "integrity": "sha1-VNvzd+UUQKypCkzSdGANP/LYiKk=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.10"
@@ -16532,8 +16531,8 @@
     },
     "node_modules/renderkid": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/renderkid/-/renderkid-3.0.0.tgz",
-      "integrity": "sha512-q/7VIQA8lmM1hF+jn+sFSPWGlMkSAeNYcPLmDQx2zzuiDfaLrOmumR8iaUKlenFgh0XRPIUeSPlH3A+AW3Z5pg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/renderkid/-/renderkid-3.0.0.tgz",
+      "integrity": "sha1-X9gj5NaVHTc1jsyaWLHwaDa2Joo=",
       "license": "MIT",
       "dependencies": {
         "css-select": "^4.1.3",
@@ -16545,8 +16544,8 @@
     },
     "node_modules/require-directory": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
-      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/require-directory/-/require-directory-2.1.1.tgz",
+      "integrity": "sha1-jGStX9MNqxyXbiNE/+f3kqam30I=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -16554,8 +16553,8 @@
     },
     "node_modules/require-from-string": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha1-iaf92TgmEmcxjq/hT5wy5ZjDaQk=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -16563,14 +16562,14 @@
     },
     "node_modules/requires-port": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/requires-port/-/requires-port-1.0.0.tgz",
-      "integrity": "sha512-KigOCHcocU3XODJxsu8i/j8T9tzT4adHiecwORRQ0ZZFcp7ahwXuRU1m+yuO90C5ZUyGeGfocHDI14M3L3yDAQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/requires-port/-/requires-port-1.0.0.tgz",
+      "integrity": "sha1-kl0mAdOaxIXgkc8NpcbmlNw9yv8=",
       "license": "MIT"
     },
     "node_modules/resolve": {
       "version": "1.22.12",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
-      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/resolve/-/resolve-1.22.12.tgz",
+      "integrity": "sha1-9bKmgIl8acI4oTzRaxVnH4tzVJ8=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -16590,8 +16589,8 @@
     },
     "node_modules/resolve-cwd": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
-      "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
+      "integrity": "sha1-DwB18bslRHZs9zumpuKt/ryxPy0=",
       "license": "MIT",
       "dependencies": {
         "resolve-from": "^5.0.0"
@@ -16602,8 +16601,8 @@
     },
     "node_modules/resolve-from": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
-      "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/resolve-from/-/resolve-from-5.0.0.tgz",
+      "integrity": "sha1-w1IlhD3493bfIcV1V7wIfp39/Gk=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -16611,8 +16610,8 @@
     },
     "node_modules/resolve-url-loader": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-url-loader/-/resolve-url-loader-4.0.0.tgz",
-      "integrity": "sha512-05VEMczVREcbtT7Bz+C+96eUO5HDNvdthIiMB34t7FcF8ehcu4wC0sSgPUubs3XW2Q3CNLJk/BJrCU9wVRymiA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/resolve-url-loader/-/resolve-url-loader-4.0.0.tgz",
+      "integrity": "sha1-1Q1N3HRrsQRoRDFnrPgA3NbDrVc=",
       "license": "MIT",
       "dependencies": {
         "adjust-sourcemap-loader": "^4.0.0",
@@ -16639,14 +16638,14 @@
     },
     "node_modules/resolve-url-loader/node_modules/convert-source-map": {
       "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
-      "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/convert-source-map/-/convert-source-map-1.9.0.tgz",
+      "integrity": "sha1-f6rmI1P7QhM2bQypg1jSLoNosF8=",
       "license": "MIT"
     },
     "node_modules/resolve-url-loader/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -16654,8 +16653,8 @@
     },
     "node_modules/resolve.exports": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/resolve.exports/-/resolve.exports-1.1.1.tgz",
-      "integrity": "sha512-/NtpHNDN7jWhAaQ9BvBUYZ6YTXsRBgfqWFWP7BZBaoMJO/I3G5OFzvTuWNlZC3aPjins1F+TNrLKsGbH4rfsRQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/resolve.exports/-/resolve.exports-1.1.1.tgz",
+      "integrity": "sha1-Bc/Vs+32QVcf1G+mCLYQ3anq2Zk=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -16663,8 +16662,8 @@
     },
     "node_modules/retry": {
       "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.13.1.tgz",
-      "integrity": "sha512-XQBQ3I8W1Cge0Seh+6gjj03LbmRFWuoszgK9ooCpwYIrhhoO80pfq4cUkU5DkknwfOfFteRwlZ56PYOGYyFWdg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/retry/-/retry-0.13.1.tgz",
+      "integrity": "sha1-GFsVh6z2eRnWOzVzSeA1N7JIRlg=",
       "license": "MIT",
       "engines": {
         "node": ">= 4"
@@ -16672,8 +16671,8 @@
     },
     "node_modules/reusify": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
-      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/reusify/-/reusify-1.1.0.tgz",
+      "integrity": "sha1-D+E7lSLhRz9RtVjueW4I8R+bSJ8=",
       "license": "MIT",
       "engines": {
         "iojs": ">=1.0.0",
@@ -16682,8 +16681,8 @@
     },
     "node_modules/rimraf": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
-      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/rimraf/-/rimraf-3.0.2.tgz",
+      "integrity": "sha1-8aVAK6YiCtUswSgrrBrjqkn9Bho=",
       "deprecated": "Rimraf versions prior to v4 are no longer supported",
       "license": "ISC",
       "dependencies": {
@@ -16698,14 +16697,14 @@
     },
     "node_modules/robust-predicates": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz",
-      "integrity": "sha512-NS3levdsRIUOmiJ8FZWCP7LG3QpJyrs/TE0Zpf1yvZu8cAJJ6QMW92H1c7kWpdIHo8RvmLxN/o2JXTKHp74lUA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/robust-predicates/-/robust-predicates-3.0.3.tgz",
+      "integrity": "sha1-EJkGGzNJ4sWr7GwqsKzUQNJNQGI=",
       "license": "Unlicense"
     },
     "node_modules/rollup": {
       "version": "2.80.0",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.80.0.tgz",
-      "integrity": "sha512-cIFJOD1DESzpjOBl763Kp1AH7UE/0fcdHe6rZXUdQ9c50uvgigvW97u3IcSeBwOkgqL/PXPBktBCh0KEu5L8XQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/rollup/-/rollup-2.80.0.tgz",
+      "integrity": "sha1-qC78FbdI6Yanx28PdxIhsfoQiiw=",
       "license": "MIT",
       "bin": {
         "rollup": "dist/bin/rollup"
@@ -16719,8 +16718,8 @@
     },
     "node_modules/rollup-plugin-terser": {
       "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/rollup-plugin-terser/-/rollup-plugin-terser-7.0.2.tgz",
-      "integrity": "sha512-w3iIaU4OxcF52UUXiZNsNeuXIMDvFrr+ZXK6bFZ0Q60qyVfq4uLptoS4bbq3paG3x216eQllFZX7zt6TIImguQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/rollup-plugin-terser/-/rollup-plugin-terser-7.0.2.tgz",
+      "integrity": "sha1-6Pu6SGmYGy3DWufopQLVxsBNMk0=",
       "deprecated": "This package has been deprecated and is no longer maintained. Please use @rollup/plugin-terser",
       "license": "MIT",
       "dependencies": {
@@ -16735,8 +16734,8 @@
     },
     "node_modules/rollup-plugin-terser/node_modules/jest-worker": {
       "version": "26.6.2",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-26.6.2.tgz",
-      "integrity": "sha512-KWYVV1c4i+jbMpaBC+U++4Va0cp8OisU185o73T1vo99hqi7w8tSJfUXYswwqqrjzwxa6KpRK54WhPvwf5w6PQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jest-worker/-/jest-worker-26.6.2.tgz",
+      "integrity": "sha1-f3LLxNZDw2Xie5/XdfnQ6qnHqO0=",
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
@@ -16749,8 +16748,8 @@
     },
     "node_modules/rtl-css-js": {
       "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/rtl-css-js/-/rtl-css-js-1.16.1.tgz",
-      "integrity": "sha512-lRQgou1mu19e+Ya0LsTvKrVJ5TYUbqCVPAiImX3UfLTenarvPUl1QFdvu5Z3PYmHT9RCcwIfbjRQBntExyj3Zg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/rtl-css-js/-/rtl-css-js-1.16.1.tgz",
+      "integrity": "sha1-S0i0NUsP+RejBIjZUQD79yGaPoA=",
       "license": "MIT",
       "dependencies": {
         "@babel/runtime": "^7.1.2"
@@ -16758,8 +16757,8 @@
     },
     "node_modules/run-parallel": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
-      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha1-ZtE2jae9+SHrnZW9GpIp5/IaQ+4=",
       "funding": [
         {
           "type": "github",
@@ -16781,14 +16780,14 @@
     },
     "node_modules/rw": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/rw/-/rw-1.3.3.tgz",
-      "integrity": "sha512-PdhdWy89SiZogBLaw42zdeqtRJ//zFd2PgQavcICDUgJT5oW10QCRKbJ6bg4r0/UY2M6BWd5tkxuGFRvCkgfHQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/rw/-/rw-1.3.3.tgz",
+      "integrity": "sha1-P4Yt+pGrdmsUiF700BEkv9oHT7Q=",
       "license": "BSD-3-Clause"
     },
     "node_modules/safe-array-concat": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/safe-array-concat/-/safe-array-concat-1.1.4.tgz",
-      "integrity": "sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/safe-array-concat/-/safe-array-concat-1.1.4.tgz",
+      "integrity": "sha1-pUzJthpX8ztCq608vdo6KzjMVxk=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.9",
@@ -16806,8 +16805,8 @@
     },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha1-Hq+fqb2x/dTsdfWPnNtOa3gn7sY=",
       "funding": [
         {
           "type": "github",
@@ -16826,8 +16825,8 @@
     },
     "node_modules/safe-push-apply": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/safe-push-apply/-/safe-push-apply-1.0.0.tgz",
-      "integrity": "sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/safe-push-apply/-/safe-push-apply-1.0.0.tgz",
+      "integrity": "sha1-AYUOmBwWAtOYyFCB82Dk5tA9J/U=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -16842,8 +16841,8 @@
     },
     "node_modules/safe-regex-test": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/safe-regex-test/-/safe-regex-test-1.1.0.tgz",
-      "integrity": "sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/safe-regex-test/-/safe-regex-test-1.1.0.tgz",
+      "integrity": "sha1-f4fftnoxUHguqvGFg/9dFxGsEME=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -16859,20 +16858,20 @@
     },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha1-RPoWGwGHuVSd2Eu5GAL5vYOFzWo=",
       "license": "MIT"
     },
     "node_modules/sanitize.css": {
       "version": "13.0.0",
-      "resolved": "https://registry.npmjs.org/sanitize.css/-/sanitize.css-13.0.0.tgz",
-      "integrity": "sha512-ZRwKbh/eQ6w9vmTjkuG0Ioi3HBwPFce0O+v//ve+aOq1oeCy7jMV2qzzAlpsNuqpqCBjjriM1lbtZbF/Q8jVyA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/sanitize.css/-/sanitize.css-13.0.0.tgz",
+      "integrity": "sha1-JnVVOXSyeWTHVWKt472F15h58XM=",
       "license": "CC0-1.0"
     },
     "node_modules/sass-loader": {
       "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/sass-loader/-/sass-loader-12.6.0.tgz",
-      "integrity": "sha512-oLTaH0YCtX4cfnJZxKSLAyglED0naiYfNG1iXfU5w1LNZ+ukoA5DtyDIN5zmKVZwYNJP4KRc5Y3hkWga+7tYfA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/sass-loader/-/sass-loader-12.6.0.tgz",
+      "integrity": "sha1-UUg2LI4s3UuVDzxjrF0W2/7Te8s=",
       "license": "MIT",
       "dependencies": {
         "klona": "^2.0.4",
@@ -16909,8 +16908,8 @@
     },
     "node_modules/sax": {
       "version": "1.6.1",
-      "resolved": "https://registry.npmjs.org/sax/-/sax-1.6.1.tgz",
-      "integrity": "sha512-42tBVwLWnaQvW5zc4HbZrTuWccECCZfBi92FDuwtqxasH+JbPB3/FOKb1m222K42R4WxuxzzMsTswfzgtSu64Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/sax/-/sax-1.6.1.tgz",
+      "integrity": "sha1-TCPPYIwLaTq1S0tYiOks/pd7mEM=",
       "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=11.0.0"
@@ -16918,8 +16917,8 @@
     },
     "node_modules/saxes": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/saxes/-/saxes-5.0.1.tgz",
-      "integrity": "sha512-5LBh1Tls8c9xgGjw3QrMwETmTMVk0oFgvrFSvWx62llR2hcEInrKNZ2GZCCuuy2lvWrdl5jhbpeqc5hRYKFOcw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/saxes/-/saxes-5.0.1.tgz",
+      "integrity": "sha1-7rq5U/o7dgjb6U5drbFciI+maW0=",
       "license": "ISC",
       "dependencies": {
         "xmlchars": "^2.2.0"
@@ -16930,8 +16929,8 @@
     },
     "node_modules/scheduler": {
       "version": "0.23.2",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.2.tgz",
-      "integrity": "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/scheduler/-/scheduler-0.23.2.tgz",
+      "integrity": "sha1-QUumSjsoKJLpRM8hCOzAeNEVzcM=",
       "license": "MIT",
       "dependencies": {
         "loose-envify": "^1.1.0"
@@ -16939,8 +16938,8 @@
     },
     "node_modules/schema-utils": {
       "version": "4.3.3",
-      "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-4.3.3.tgz",
-      "integrity": "sha512-eflK8wEtyOE6+hsaRVPxvUKYCpRgzLqDTb8krvAsRIwOGlHoSgYLgBXoubGgLd2fT41/OUYdb48v4k4WWHQurA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/schema-utils/-/schema-utils-4.3.3.tgz",
+      "integrity": "sha1-WxhQkS+jHfkHFpY9RdkSH9/An0Y=",
       "license": "MIT",
       "dependencies": {
         "@types/json-schema": "^7.0.9",
@@ -16958,14 +16957,14 @@
     },
     "node_modules/select-hose": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/select-hose/-/select-hose-2.0.0.tgz",
-      "integrity": "sha512-mEugaLK+YfkijB4fx0e6kImuJdCIt2LxCRcbEYPqRGCs4F2ogyfZU5IAZRdjCP8JPq2AtdNoC/Dux63d9Kiryg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/select-hose/-/select-hose-2.0.0.tgz",
+      "integrity": "sha1-Yl2GWPhlr0Psliv8N2o3NZpJlMo=",
       "license": "MIT"
     },
     "node_modules/selfsigned": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/selfsigned/-/selfsigned-2.4.1.tgz",
-      "integrity": "sha512-th5B4L2U+eGLq1TVh7zNRGBapioSORUeymIydxgFpwww9d2qyKvtuPU2jJuHvYAwwqi2Y596QBL3eEqcPEYL8Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/selfsigned/-/selfsigned-2.4.1.tgz",
+      "integrity": "sha1-Vg2QVlRCo+01tnQDTOxOldzrSuA=",
       "license": "MIT",
       "dependencies": {
         "@types/node-forge": "^1.3.0",
@@ -16977,8 +16976,8 @@
     },
     "node_modules/semver": {
       "version": "7.8.5",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
-      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha1-ObZGA33VDBT7RR5+TKxY7YuGP2k=",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -16989,8 +16988,8 @@
     },
     "node_modules/send": {
       "version": "0.19.2",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
-      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/send/-/send-0.19.2.tgz",
+      "integrity": "sha1-WbwNobTqetQnNv1kKxxClOEU/yk=",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
@@ -17013,8 +17012,8 @@
     },
     "node_modules/send/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha1-XRKFFd8TT/Mn6QpMk/Tgd6U2NB8=",
       "license": "MIT",
       "dependencies": {
         "ms": "2.0.0"
@@ -17022,14 +17021,14 @@
     },
     "node_modules/send/node_modules/debug/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
       "license": "MIT"
     },
     "node_modules/serialize-javascript": {
       "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-7.0.3.tgz",
-      "integrity": "sha512-h+cZ/XXarqDgCjo+YSyQU/ulDEESGGf8AMK9pPNmhNSl/FzPl6L8pMp1leca5z6NuG6tvV/auC8/43tmovowww==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/serialize-javascript/-/serialize-javascript-7.0.3.tgz",
+      "integrity": "sha1-ySAI2KIbx7IwfC6IWkvQ8Dsq7mw=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=20.0.0"
@@ -17037,8 +17036,8 @@
     },
     "node_modules/serve-index": {
       "version": "1.9.2",
-      "resolved": "https://registry.npmjs.org/serve-index/-/serve-index-1.9.2.tgz",
-      "integrity": "sha512-KDj11HScOaLmrPxl70KYNW1PksP4Nb/CLL2yvC+Qd2kHMPEEpfc4Re2e4FOay+bC/+XQl/7zAcWON3JVo5v3KQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/serve-index/-/serve-index-1.9.2.tgz",
+      "integrity": "sha1-KYjjYSEG14peSEnd/1Us5709m8s=",
       "license": "MIT",
       "dependencies": {
         "accepts": "~1.3.8",
@@ -17059,8 +17058,8 @@
     },
     "node_modules/serve-index/node_modules/debug": {
       "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/debug/-/debug-2.6.9.tgz",
+      "integrity": "sha1-XRKFFd8TT/Mn6QpMk/Tgd6U2NB8=",
       "license": "MIT",
       "dependencies": {
         "ms": "2.0.0"
@@ -17068,8 +17067,8 @@
     },
     "node_modules/serve-index/node_modules/depd": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-1.1.2.tgz",
-      "integrity": "sha512-7emPTl6Dpo6JRXOXjLRxck+FlLRX5847cLKEn00PLAgc3g2hTZZgr+e4c2v6QpSmLeFP3n5yUo7ft6avBK/5jQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/depd/-/depd-1.1.2.tgz",
+      "integrity": "sha1-m81S4UwJd2PnSbJ0xDRu0uVgtak=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -17077,8 +17076,8 @@
     },
     "node_modules/serve-index/node_modules/http-errors": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-1.8.1.tgz",
-      "integrity": "sha512-Kpk9Sm7NmI+RHhnj6OIWDI1d6fIoFAtFt9RLaTMRlg/8w49juAStsrBgp0Dp4OdxdVbRIeKhtCUvoi/RuAhO4g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/http-errors/-/http-errors-1.8.1.tgz",
+      "integrity": "sha1-fD8oV3y8iiBziEVdvWIpXtB71ow=",
       "license": "MIT",
       "dependencies": {
         "depd": "~1.1.2",
@@ -17093,14 +17092,14 @@
     },
     "node_modules/serve-index/node_modules/ms": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ms/-/ms-2.0.0.tgz",
+      "integrity": "sha1-VgiurfwAvmwpAd9fmGF4jeDVl8g=",
       "license": "MIT"
     },
     "node_modules/serve-index/node_modules/statuses": {
       "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
-      "integrity": "sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/statuses/-/statuses-1.5.0.tgz",
+      "integrity": "sha1-Fhx9rBd2Wf2YEfQ3cfqZOBR4Yow=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -17108,8 +17107,8 @@
     },
     "node_modules/serve-static": {
       "version": "1.16.3",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
-      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/serve-static/-/serve-static-1.16.3.tgz",
+      "integrity": "sha1-qXt02VV3hYPzhipPC4QetNXXjPk=",
       "license": "MIT",
       "dependencies": {
         "encodeurl": "~2.0.0",
@@ -17123,14 +17122,14 @@
     },
     "node_modules/set-cookie-parser": {
       "version": "2.7.2",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
-      "integrity": "sha512-oeM1lpU/UvhTxw+g3cIfxXHyJRc/uidd3yK1P242gzHds0udQBYzs3y8j4gCCW+ZJ7ad0yctld8RYO+bdurlvw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/set-cookie-parser/-/set-cookie-parser-2.7.2.tgz",
+      "integrity": "sha1-zNCGc6muXS5E6iot4lCJ5nx+32g=",
       "license": "MIT"
     },
     "node_modules/set-function-length": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/set-function-length/-/set-function-length-1.2.2.tgz",
-      "integrity": "sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/set-function-length/-/set-function-length-1.2.2.tgz",
+      "integrity": "sha1-qscjFBmOrtl1z3eyw7a4gGleVEk=",
       "license": "MIT",
       "dependencies": {
         "define-data-property": "^1.1.4",
@@ -17146,8 +17145,8 @@
     },
     "node_modules/set-function-name": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/set-function-name/-/set-function-name-2.0.2.tgz",
-      "integrity": "sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/set-function-name/-/set-function-name-2.0.2.tgz",
+      "integrity": "sha1-FqcFxaDcL15jjKltiozU4cK5CYU=",
       "license": "MIT",
       "dependencies": {
         "define-data-property": "^1.1.4",
@@ -17161,8 +17160,8 @@
     },
     "node_modules/set-proto": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/set-proto/-/set-proto-1.0.0.tgz",
-      "integrity": "sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/set-proto/-/set-proto-1.0.0.tgz",
+      "integrity": "sha1-B2Dbz/MLLX6AH9bhmYPlbaM3Vl4=",
       "license": "MIT",
       "dependencies": {
         "dunder-proto": "^1.0.1",
@@ -17175,14 +17174,14 @@
     },
     "node_modules/setprototypeof": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha1-ZsmiSnP5/CjL5msJ/tPTPcrxtCQ=",
       "license": "ISC"
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha1-zNCvT4g1+9wmW4JGGq8MNmY/NOo=",
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -17193,8 +17192,8 @@
     },
     "node_modules/shebang-regex": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha1-rhbxZE2HPsrYQ7AwexQzYtTEIXI=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -17202,8 +17201,8 @@
     },
     "node_modules/shell-quote": {
       "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/shell-quote/-/shell-quote-1.9.0.tgz",
-      "integrity": "sha512-Iov+JwFv/2HcTpcwNMKd8+IWNb8tboQJNQTkAY/LLVK7gGH9jy+LGkVqPxfekHl+yMmiqXszdGWXgkfml7hjqA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/shell-quote/-/shell-quote-1.9.0.tgz",
+      "integrity": "sha1-4QixoTZYbVlk7bMwABbUvtug/lc=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -17214,8 +17213,8 @@
     },
     "node_modules/side-channel": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
-      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha1-6gLGLgXcS+pn1EQvD7ce4ZL44Ks=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -17233,8 +17232,8 @@
     },
     "node_modules/side-channel-list": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
-      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha1-wuC1oUpUCuvuO7xsP4ZmzJtQkSc=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -17249,8 +17248,8 @@
     },
     "node_modules/side-channel-map": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
-      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha1-1rtrN5Asb+9RdOX1M/q0xzKib0I=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -17267,8 +17266,8 @@
     },
     "node_modules/side-channel-weakmap": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
-      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha1-Ed2hnVNo5Azp7CvcH7DsvAeQ7Oo=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -17286,20 +17285,20 @@
     },
     "node_modules/signal-exit": {
       "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha1-qaF2f4r4QVURTqq9c/mSc8j1mtk=",
       "license": "ISC"
     },
     "node_modules/sisteransi": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
-      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/sisteransi/-/sisteransi-1.0.5.tgz",
+      "integrity": "sha1-E01oEpd1ZDfMBcoBNw06elcQde0=",
       "license": "MIT"
     },
     "node_modules/slash": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
-      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha1-ZTm+hwwWWtvVJAIg2+Nh8bxNRjQ=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -17307,8 +17306,8 @@
     },
     "node_modules/sockjs": {
       "version": "0.3.24",
-      "resolved": "https://registry.npmjs.org/sockjs/-/sockjs-0.3.24.tgz",
-      "integrity": "sha512-GJgLTZ7vYb/JtPSSZ10hsOYIvEYsjbNU+zPdIHcUaWVNUEPivzxku31865sSSud0Da0W4lEeOPlmw93zLQchuQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/sockjs/-/sockjs-0.3.24.tgz",
+      "integrity": "sha1-ybyJlfM6ERvqA5XsMKoyBr21zM4=",
       "license": "MIT",
       "dependencies": {
         "faye-websocket": "^0.11.3",
@@ -17318,14 +17317,14 @@
     },
     "node_modules/source-list-map": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/source-list-map/-/source-list-map-2.0.1.tgz",
-      "integrity": "sha512-qnQ7gVMxGNxsiL4lEuJwe/To8UnK7fAnmbGEEH8RpLouuKbeEm0lhbQVFIrNSuB+G7tVrAlVsZgETT5nljf+Iw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-list-map/-/source-list-map-2.0.1.tgz",
+      "integrity": "sha1-OZO9hzv8SEecyp6jpUeDXHwVSzQ=",
       "license": "MIT"
     },
     "node_modules/source-map": {
       "version": "0.7.6",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.7.6.tgz",
-      "integrity": "sha512-i5uvt8C3ikiWeNZSVZNWcfZPItFQOsYTUAOkcUPGd8DqDy1uOUikjt5dG+uRlwyvR108Fb9DOd4GvXfT0N2/uQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.7.6.tgz",
+      "integrity": "sha1-o2WKuH5bZCnIofO6AIPUxhyj7wI=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">= 12"
@@ -17333,8 +17332,8 @@
     },
     "node_modules/source-map-js": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha1-HOVlD93YerwJnto33P8CTCZnrkY=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -17342,8 +17341,8 @@
     },
     "node_modules/source-map-loader": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/source-map-loader/-/source-map-loader-3.0.2.tgz",
-      "integrity": "sha512-BokxPoLjyl3iOrgkWaakaxqnelAJSS+0V+De0kKIq6lyWrXuiPgYTGp6z3iHmqljKAaLXwZa+ctD8GccRJeVvg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map-loader/-/source-map-loader-3.0.2.tgz",
+      "integrity": "sha1-ryMZL5s0Tapyn2dykzGUzF+lT+4=",
       "license": "MIT",
       "dependencies": {
         "abab": "^2.0.5",
@@ -17363,8 +17362,8 @@
     },
     "node_modules/source-map-support": {
       "version": "0.5.21",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
-      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha1-BP58f54e0tZiIzwoyys1ufY/bk8=",
       "license": "MIT",
       "dependencies": {
         "buffer-from": "^1.0.0",
@@ -17373,8 +17372,8 @@
     },
     "node_modules/source-map-support/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -17382,15 +17381,15 @@
     },
     "node_modules/sourcemap-codec": {
       "version": "1.4.8",
-      "resolved": "https://registry.npmjs.org/sourcemap-codec/-/sourcemap-codec-1.4.8.tgz",
-      "integrity": "sha512-9NykojV5Uih4lgo5So5dtw+f0JgJX30KCNI8gwhz2J9A15wD0Ml6tjHKwf6fTSa6fAdVBdZeNOs9eJ71qCk8vA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/sourcemap-codec/-/sourcemap-codec-1.4.8.tgz",
+      "integrity": "sha1-6oBL2UhXQC5pktBaOO8a41qatMQ=",
       "deprecated": "Please use @jridgewell/sourcemap-codec instead",
       "license": "MIT"
     },
     "node_modules/spdy": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/spdy/-/spdy-4.0.2.tgz",
-      "integrity": "sha512-r46gZQZQV+Kl9oItvl1JZZqJKGr+oEkB08A6BzkiR7593/7IbtuncXHd2YoYeTsG4157ZssMu9KYvUHLcjcDoA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/spdy/-/spdy-4.0.2.tgz",
+      "integrity": "sha1-t09GYgOj7aRSwCSSuR+56EonZ3s=",
       "license": "MIT",
       "dependencies": {
         "debug": "^4.1.0",
@@ -17405,8 +17404,8 @@
     },
     "node_modules/spdy-transport": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/spdy-transport/-/spdy-transport-3.0.0.tgz",
-      "integrity": "sha512-hsLVFE5SjA6TCisWeJXFKniGGOpBgMLmerfO2aCyCU5s7nJ/rpAepqmFifv/GCbSbueEeAJJnmSQ2rKC/g8Fcw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/spdy-transport/-/spdy-transport-3.0.0.tgz",
+      "integrity": "sha1-ANSGOmQArXXfkzYaFghgXl3NzzE=",
       "license": "MIT",
       "dependencies": {
         "debug": "^4.1.0",
@@ -17419,21 +17418,21 @@
     },
     "node_modules/sprintf-js": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/sprintf-js/-/sprintf-js-1.0.3.tgz",
-      "integrity": "sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/sprintf-js/-/sprintf-js-1.0.3.tgz",
+      "integrity": "sha1-BOaSb2YolTVPPdAVIDYzuFcpfiw=",
       "license": "BSD-3-Clause"
     },
     "node_modules/stable": {
       "version": "0.1.8",
-      "resolved": "https://registry.npmjs.org/stable/-/stable-0.1.8.tgz",
-      "integrity": "sha512-ji9qxRnOVfcuLDySj9qzhGSEFVobyt1kIOSkj1qZzYLzq7Tos/oUUWvotUPQLlrsidqsK6tBH89Bc9kL5zHA6w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/stable/-/stable-0.1.8.tgz",
+      "integrity": "sha1-g26zyDgv4pNv6vVEYxAXzn1Ho88=",
       "deprecated": "Modern JS already guarantees Array#sort() is a stable sort, so this library is deprecated. See the compatibility table on MDN: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/sort#browser_compatibility",
       "license": "MIT"
     },
     "node_modules/stack-utils": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/stack-utils/-/stack-utils-2.0.6.tgz",
-      "integrity": "sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/stack-utils/-/stack-utils-2.0.6.tgz",
+      "integrity": "sha1-qvB0gWnAL8M8gjKrzPkz9Uocw08=",
       "license": "MIT",
       "dependencies": {
         "escape-string-regexp": "^2.0.0"
@@ -17444,8 +17443,8 @@
     },
     "node_modules/stack-utils/node_modules/escape-string-regexp": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
-      "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
+      "integrity": "sha1-owME6Z2qMuI7L9IPUbq9B8/8o0Q=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -17453,14 +17452,14 @@
     },
     "node_modules/stackframe": {
       "version": "1.3.4",
-      "resolved": "https://registry.npmjs.org/stackframe/-/stackframe-1.3.4.tgz",
-      "integrity": "sha512-oeVtt7eWQS+Na6F//S4kJ2K2VbRlS9D43mAlMyVpVWovy9o+jfgH8O9agzANzaiLjclA0oYzUXEM4PurhSUChw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/stackframe/-/stackframe-1.3.4.tgz",
+      "integrity": "sha1-uIGgBMjBSaXo7+831RsW5BKUMxA=",
       "license": "MIT"
     },
     "node_modules/static-eval": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/static-eval/-/static-eval-2.1.1.tgz",
-      "integrity": "sha512-MgWpQ/ZjGieSVB3eOJVs4OA2LT/q1vx98KPCTTQPzq/aLr0YUXTsgryTXr4SLfR0ZfUUCiedM9n/ABeDIyy4mA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/static-eval/-/static-eval-2.1.1.tgz",
+      "integrity": "sha1-caxqE6oyueFMW18GPDYhdrDVhLo=",
       "license": "MIT",
       "dependencies": {
         "escodegen": "^2.1.0"
@@ -17468,8 +17467,8 @@
     },
     "node_modules/statuses": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha1-j3XuzvdlteHPzcCA2llAntQk44I=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -17477,8 +17476,8 @@
     },
     "node_modules/stop-iteration-iterator": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/stop-iteration-iterator/-/stop-iteration-iterator-1.1.0.tgz",
-      "integrity": "sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/stop-iteration-iterator/-/stop-iteration-iterator-1.1.0.tgz",
+      "integrity": "sha1-9IH/cKVI9hJNAxLDqhTL+nqlQq0=",
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
@@ -17490,8 +17489,8 @@
     },
     "node_modules/string_decoder": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha1-QvEUWUpGzxqOMLCoT1bHjD7awh4=",
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "~5.2.0"
@@ -17499,8 +17498,8 @@
     },
     "node_modules/string-length": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/string-length/-/string-length-4.0.2.tgz",
-      "integrity": "sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string-length/-/string-length-4.0.2.tgz",
+      "integrity": "sha1-qKjce9XBqCubPIuH4SX2aHG25Xo=",
       "license": "MIT",
       "dependencies": {
         "char-regex": "^1.0.2",
@@ -17512,14 +17511,14 @@
     },
     "node_modules/string-natural-compare": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/string-natural-compare/-/string-natural-compare-3.0.1.tgz",
-      "integrity": "sha512-n3sPwynL1nwKi3WJ6AIsClwBMa0zTi54fn2oLU6ndfTSIO05xaznjSf15PcBZU6FNWbmN5Q6cxT4V5hGvB4taw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string-natural-compare/-/string-natural-compare-3.0.1.tgz",
+      "integrity": "sha1-ekLVhHRFSWN1no6LeuY9ccHn/fQ=",
       "license": "MIT"
     },
     "node_modules/string-width": {
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha1-JpxxF9J7Ba0uU2gwqOyJXvnG0BA=",
       "license": "MIT",
       "dependencies": {
         "emoji-regex": "^8.0.0",
@@ -17532,14 +17531,14 @@
     },
     "node_modules/string-width/node_modules/emoji-regex": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha1-6Bj9ac5cz8tARZT4QpY79TFkzDc=",
       "license": "MIT"
     },
     "node_modules/string.prototype.includes": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/string.prototype.includes/-/string.prototype.includes-2.0.1.tgz",
-      "integrity": "sha512-o7+c9bW6zpAdJHTtujeePODAhkuicdAryFsfVKwA+wGw89wJ4GTY484WTucM9hLtDEOpOvI+aHnzqnC5lHp4Rg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string.prototype.includes/-/string.prototype.includes-2.0.1.tgz",
+      "integrity": "sha1-7O7yEoNkB2GoHb4W1scXGk7ffZI=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.7",
@@ -17552,8 +17551,8 @@
     },
     "node_modules/string.prototype.matchall": {
       "version": "4.0.12",
-      "resolved": "https://registry.npmjs.org/string.prototype.matchall/-/string.prototype.matchall-4.0.12.tgz",
-      "integrity": "sha512-6CC9uyBL+/48dYizRf7H7VAYCMCNTBeM78x/VTUe9bFEaxBepPJDa1Ow99LqI/1yF7kuy7Q3cQsYMrcjGUcskA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string.prototype.matchall/-/string.prototype.matchall-4.0.12.tgz",
+      "integrity": "sha1-bIh0DkmtSVaxMyqRHpSVg6J11MA=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -17579,8 +17578,8 @@
     },
     "node_modules/string.prototype.repeat": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/string.prototype.repeat/-/string.prototype.repeat-1.0.0.tgz",
-      "integrity": "sha512-0u/TldDbKD8bFCQ/4f5+mNRrXwZ8hg2w7ZR8wa16e8z9XpePWl3eGEcUD0OXpEH/VJH/2G3gjUtR3ZOiBe2S/w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string.prototype.repeat/-/string.prototype.repeat-1.0.0.tgz",
+      "integrity": "sha1-6Qhy7gMIspQ1qiYnX24bdi2u4Bo=",
       "license": "MIT",
       "dependencies": {
         "define-properties": "^1.1.3",
@@ -17589,8 +17588,8 @@
     },
     "node_modules/string.prototype.trim": {
       "version": "1.2.11",
-      "resolved": "https://registry.npmjs.org/string.prototype.trim/-/string.prototype.trim-1.2.11.tgz",
-      "integrity": "sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string.prototype.trim/-/string.prototype.trim-1.2.11.tgz",
+      "integrity": "sha1-5r0ZzaOYXQWkLdox89300100MOM=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.9",
@@ -17611,8 +17610,8 @@
     },
     "node_modules/string.prototype.trimend": {
       "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimend/-/string.prototype.trimend-1.0.10.tgz",
-      "integrity": "sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string.prototype.trimend/-/string.prototype.trimend-1.0.10.tgz",
+      "integrity": "sha1-vmvPTz/gRgvezNss9PlxsxD4NG4=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.9",
@@ -17629,8 +17628,8 @@
     },
     "node_modules/string.prototype.trimstart": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/string.prototype.trimstart/-/string.prototype.trimstart-1.0.8.tgz",
-      "integrity": "sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/string.prototype.trimstart/-/string.prototype.trimstart-1.0.8.tgz",
+      "integrity": "sha1-fug03ajHwX7/MRhHK7Nb/tqjTd4=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.7",
@@ -17646,8 +17645,8 @@
     },
     "node_modules/stringify-object": {
       "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/stringify-object/-/stringify-object-3.3.0.tgz",
-      "integrity": "sha512-rHqiFh1elqCQ9WPLIC8I0Q/g/wj5J1eMkyoiD6eoQApWHP0FtlK7rqnhmabL5VUY9JQCcqwwvlOaSuutekgyrw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/stringify-object/-/stringify-object-3.3.0.tgz",
+      "integrity": "sha1-cDBlrvyhkwDTzoivT1s5VtdVZik=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "get-own-enumerable-property-symbols": "^3.0.0",
@@ -17660,8 +17659,8 @@
     },
     "node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha1-nibGPTD1NEPpSJSVshBdN7Z6hdk=",
       "license": "MIT",
       "dependencies": {
         "ansi-regex": "^5.0.1"
@@ -17672,8 +17671,8 @@
     },
     "node_modules/strip-bom": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-4.0.0.tgz",
-      "integrity": "sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/strip-bom/-/strip-bom-4.0.0.tgz",
+      "integrity": "sha1-nDUFwdtFvO3KPZz3oW9cWqOQGHg=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -17681,8 +17680,8 @@
     },
     "node_modules/strip-comments": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/strip-comments/-/strip-comments-2.0.1.tgz",
-      "integrity": "sha512-ZprKx+bBLXv067WTCALv8SSz5l2+XhpYCsVtSqlMnkAXMWDq+/ekVbl1ghqP9rUHTzv6sm/DwCOiYutU/yp1fw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/strip-comments/-/strip-comments-2.0.1.tgz",
+      "integrity": "sha1-StEcP7ysF3pnpArCJMoznKHBups=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -17690,8 +17689,8 @@
     },
     "node_modules/strip-final-newline": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
-      "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
+      "integrity": "sha1-ibhS+y/L6Tb29LMYevsKEsGrWK0=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -17699,8 +17698,8 @@
     },
     "node_modules/strip-json-comments": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
-      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha1-MfEoGzgyYwQ0gxwxDAHMzajL4AY=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -17711,8 +17710,8 @@
     },
     "node_modules/style-loader": {
       "version": "3.3.4",
-      "resolved": "https://registry.npmjs.org/style-loader/-/style-loader-3.3.4.tgz",
-      "integrity": "sha512-0WqXzrsMTyb8yjZJHDqwmnwRJvhALK9LfRtRc6B4UTWe8AijYLZYZ9thuJTZc2VfQWINADW/j+LiJnfy2RoC1w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/style-loader/-/style-loader-3.3.4.tgz",
+      "integrity": "sha1-8w94bDbbA6RcvVW2pw2TDEeQkOc=",
       "license": "MIT",
       "engines": {
         "node": ">= 12.13.0"
@@ -17727,8 +17726,8 @@
     },
     "node_modules/stylehacks": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/stylehacks/-/stylehacks-5.1.1.tgz",
-      "integrity": "sha512-sBpcd5Hx7G6seo7b1LkpttvTz7ikD0LlH5RmdcBNb6fFR0Fl7LQwHDFr300q4cwUqi+IYrFGmsIHieMBfnN/Bw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/stylehacks/-/stylehacks-5.1.1.tgz",
+      "integrity": "sha1-eTSjTrWdcVIUn6adbp5W8vw0vMk=",
       "license": "MIT",
       "dependencies": {
         "browserslist": "^4.21.4",
@@ -17743,14 +17742,14 @@
     },
     "node_modules/stylis": {
       "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/stylis/-/stylis-4.4.0.tgz",
-      "integrity": "sha512-5Z9ZpRzfuH6l/UAvCPAPUo3665Nk2wLaZU3x+TLHKVzIz33+sbJqbtrYoC3KD4/uVOr2Zp+L0LySezP9OHV9yA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/stylis/-/stylis-4.4.0.tgz",
+      "integrity": "sha1-xYRsk0X0v8Ub0MvXyjWgdE9IWl0=",
       "license": "MIT"
     },
     "node_modules/sucrase": {
       "version": "3.35.1",
-      "resolved": "https://registry.npmjs.org/sucrase/-/sucrase-3.35.1.tgz",
-      "integrity": "sha512-DhuTmvZWux4H1UOnWMB3sk0sbaCVOoQZjv8u1rDoTV0HTdGem9hkAZtl4JZy8P2z4Bg0nT+YMeOFyVr4zcG5Tw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/sucrase/-/sucrase-3.35.1.tgz",
+      "integrity": "sha1-RhnqUDk/6L0K5QccJqvZsuNGv+E=",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/gen-mapping": "^0.3.2",
@@ -17771,8 +17770,8 @@
     },
     "node_modules/sucrase/node_modules/commander": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-4.1.1.tgz",
-      "integrity": "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/commander/-/commander-4.1.1.tgz",
+      "integrity": "sha1-n9YCvZNilOnp70aj9NaWQESxgGg=",
       "license": "MIT",
       "engines": {
         "node": ">= 6"
@@ -17780,8 +17779,8 @@
     },
     "node_modules/supports-color": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha1-G33NyzK4E4gBs+R4umpRyqiWSNo=",
       "license": "MIT",
       "dependencies": {
         "has-flag": "^4.0.0"
@@ -17792,8 +17791,8 @@
     },
     "node_modules/supports-hyperlinks": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/supports-hyperlinks/-/supports-hyperlinks-2.3.0.tgz",
-      "integrity": "sha512-RpsAZlpWcDwOPQA22aCH4J0t7L8JmAvsCxfOSEwm7cQs3LshN36QaTkwd70DnBOXDWGssw2eUoc8CaRWT0XunA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/supports-hyperlinks/-/supports-hyperlinks-2.3.0.tgz",
+      "integrity": "sha1-OUNUQ0fB/5CxXv+wP8FK5F7BBiQ=",
       "license": "MIT",
       "dependencies": {
         "has-flag": "^4.0.0",
@@ -17805,8 +17804,8 @@
     },
     "node_modules/supports-preserve-symlinks-flag": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
-      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+      "integrity": "sha1-btpL00SjyUrqN21MwxvHcxEDngk=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4"
@@ -17817,14 +17816,14 @@
     },
     "node_modules/svg-parser": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/svg-parser/-/svg-parser-2.0.4.tgz",
-      "integrity": "sha512-e4hG1hRwoOdRb37cIMSgzNsxyzKfayW6VOflrwvR+/bzrkyxY/31WkbgnQpgtrNp1SdpJvpUAGTa/ZoiPNDuRQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/svg-parser/-/svg-parser-2.0.4.tgz",
+      "integrity": "sha1-/cLinhOVFzYUC3bLEiyO5mMOtrU=",
       "license": "MIT"
     },
     "node_modules/svgo": {
       "version": "2.8.3",
-      "resolved": "https://registry.npmjs.org/svgo/-/svgo-2.8.3.tgz",
-      "integrity": "sha512-5EZD0pafXX6PphdwOGCiVLDSaV1xyuQao2blHajHLsPxr07q4mmEjdtXEWgG07ae2mIz8Ex2CDXNCTiXhy3Khw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/svgo/-/svgo-2.8.3.tgz",
+      "integrity": "sha1-jeL6V58/dCnew/uGRxAFz0b7SDo=",
       "license": "MIT",
       "dependencies": {
         "commander": "^7.2.0",
@@ -17844,14 +17843,14 @@
     },
     "node_modules/symbol-tree": {
       "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/symbol-tree/-/symbol-tree-3.2.4.tgz",
-      "integrity": "sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/symbol-tree/-/symbol-tree-3.2.4.tgz",
+      "integrity": "sha1-QwY30ki6d+B4iDlR+5qg7tfGP6I=",
       "license": "MIT"
     },
     "node_modules/tabster": {
       "version": "8.8.0",
-      "resolved": "https://registry.npmjs.org/tabster/-/tabster-8.8.0.tgz",
-      "integrity": "sha512-eGFXgtvKOQP5BywDI9Ngs+Atm6TRj45epAAqWKyVoi+HmOmdamEB//1H/FttLdNly/+Cz+GJ4RN8TnXTw0KwfA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tabster/-/tabster-8.8.0.tgz",
+      "integrity": "sha1-cE7yrsD91vQss1DXgfJIh32hmWw=",
       "license": "MIT",
       "dependencies": {
         "keyborg": "^2.14.0",
@@ -17860,8 +17859,8 @@
     },
     "node_modules/tailwindcss": {
       "version": "3.4.19",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.19.tgz",
-      "integrity": "sha512-3ofp+LL8E+pK/JuPLPggVAIaEuhvIz4qNcf3nA1Xn2o/7fb7s/TYpHhwGDv1ZU3PkBluUVaF8PyCHcm48cKLWQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tailwindcss/-/tailwindcss-3.4.19.tgz",
+      "integrity": "sha1-ryoKSuMC1S6+B4tndeeZ4TJQDuI=",
       "license": "MIT",
       "dependencies": {
         "@alloc/quick-lru": "^5.2.0",
@@ -17897,8 +17896,8 @@
     },
     "node_modules/tailwindcss/node_modules/lilconfig": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-3.1.3.tgz",
-      "integrity": "sha512-/vlFKAoH5Cgt3Ie+JLhRbwOsCQePABiU3tJ1egGvyQ+33R/vcwM2Zl2QR/LzjsBeItPt3oSVXapn+m4nQDvpzw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lilconfig/-/lilconfig-3.1.3.tgz",
+      "integrity": "sha1-obz9Ylf5WFv1rhTO7rt7VZAl5MQ=",
       "license": "MIT",
       "engines": {
         "node": ">=14"
@@ -17909,8 +17908,8 @@
     },
     "node_modules/tapable": {
       "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
-      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha1-XafJmSxGA4IhJnmFqyhCGoh58WA=",
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -17922,8 +17921,8 @@
     },
     "node_modules/temp-dir": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/temp-dir/-/temp-dir-2.0.0.tgz",
-      "integrity": "sha512-aoBAniQmmwtcKp/7BzsH8Cxzv8OL736p7v1ihGb5e9DJ9kTwGWHrQrVB5+lfVDzfGrdRzXch+ig7LHaY1JTOrg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/temp-dir/-/temp-dir-2.0.0.tgz",
+      "integrity": "sha1-vekrBb3+sVFugEycAK1FF38xMh4=",
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -17931,8 +17930,8 @@
     },
     "node_modules/tempy": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/tempy/-/tempy-0.6.0.tgz",
-      "integrity": "sha512-G13vtMYPT/J8A4X2SjdtBTphZlrp1gKv6hZiOjw14RCWg6GbHuQBGtjlx75xLbYV/wEc0D7G5K4rxKP/cXk8Bw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tempy/-/tempy-0.6.0.tgz",
+      "integrity": "sha1-ZeLDWrwG8RJKl/OHsIMDRCveWfM=",
       "license": "MIT",
       "dependencies": {
         "is-stream": "^2.0.0",
@@ -17949,8 +17948,8 @@
     },
     "node_modules/tempy/node_modules/type-fest": {
       "version": "0.16.0",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.16.0.tgz",
-      "integrity": "sha512-eaBzG6MxNzEn9kiwvtre90cXaNLkmadMWa1zQMs3XORCXNbsH/OewwbxC5ia9dCxIxnTAsSxXJaa/p5y8DlvJg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/type-fest/-/type-fest-0.16.0.tgz",
+      "integrity": "sha1-MkC4kaeLDerpENvrhlU+VSoUiGA=",
       "license": "(MIT OR CC0-1.0)",
       "engines": {
         "node": ">=10"
@@ -17961,8 +17960,8 @@
     },
     "node_modules/terminal-link": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/terminal-link/-/terminal-link-2.1.1.tgz",
-      "integrity": "sha512-un0FmiRUQNr5PJqy9kP7c40F5BOfpGlYTrxonDChEZB7pzZxRNp/bt+ymiy9/npwXya9KH99nJ/GXFIiUkYGFQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/terminal-link/-/terminal-link-2.1.1.tgz",
+      "integrity": "sha1-FKZKJ6s8Dfkz6lRvulXy0HjtyZQ=",
       "license": "MIT",
       "dependencies": {
         "ansi-escapes": "^4.2.1",
@@ -17976,9 +17975,9 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.49.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.49.0.tgz",
-      "integrity": "sha512-SNiDnXyHSrxVcIOtVbULzcTmniUiwcV7Nwdyj1twVubeTmbjoa8p69KKDpfkdoOavuM4/GRm1+ykI8qqnavHoA==",
+      "version": "5.50.0",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/terser/-/terser-5.50.0.tgz",
+      "integrity": "sha1-TlYKRnBPkXL5a6McO9bcEIrSzq0=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "@jridgewell/source-map": "^0.3.3",
@@ -17995,8 +17994,8 @@
     },
     "node_modules/terser-webpack-plugin": {
       "version": "5.6.1",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.6.1.tgz",
-      "integrity": "sha512-201R5j+sJpK8nFWwKVyNfZot8FaJbLZDq5evriVzbV1wDtSXDjRUDRfJzHpAaxFDMEhsZL1QkeqM61wgsS3KaQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/terser-webpack-plugin/-/terser-webpack-plugin-5.6.1.tgz",
+      "integrity": "sha1-R7xBvYuPq4ODti7HY7c5SCkJfns=",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "^0.3.25",
@@ -18055,14 +18054,14 @@
     },
     "node_modules/terser/node_modules/commander": {
       "version": "2.20.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
-      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha1-/UhehMA+tIgcIHIrpIA16FMa6zM=",
       "license": "MIT"
     },
     "node_modules/test-exclude": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
-      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/test-exclude/-/test-exclude-6.0.0.tgz",
+      "integrity": "sha1-BKhphmHYBepvopO2y55jrARO8V4=",
       "license": "ISC",
       "dependencies": {
         "@istanbuljs/schema": "^0.1.2",
@@ -18075,14 +18074,14 @@
     },
     "node_modules/text-table": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
-      "integrity": "sha512-N+8UisAXDGk8PFXP4HAzVR9nbfmVJ3zYLAWiTIoqC5v5isinhr+r5uaO8+7r3BMfuNIufIsA7RdpVgacC2cSpw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/text-table/-/text-table-0.2.0.tgz",
+      "integrity": "sha1-f17oI66AUgfACvLfSoTsP8+lcLQ=",
       "license": "MIT"
     },
     "node_modules/thenify": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/thenify/-/thenify-3.3.1.tgz",
-      "integrity": "sha512-RVZSIV5IG10Hk3enotrhvz0T9em6cyHBLkH/YAZuKqd8hRkKhSfCGIcP2KUY0EPxndzANBmNllzWPwak+bheSw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/thenify/-/thenify-3.3.1.tgz",
+      "integrity": "sha1-iTLmhqQGYDigFt2eLKRq3Zg4qV8=",
       "license": "MIT",
       "dependencies": {
         "any-promise": "^1.0.0"
@@ -18090,8 +18089,8 @@
     },
     "node_modules/thenify-all": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/thenify-all/-/thenify-all-1.6.0.tgz",
-      "integrity": "sha512-RNxQH/qI8/t3thXJDwcstUO4zeqo64+Uy/+sNVRBx4Xn2OX+OZ9oP+iJnNFqplFra2ZUVeKCSa2oVWi3T4uVmA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/thenify-all/-/thenify-all-1.6.0.tgz",
+      "integrity": "sha1-GhkY1ALY/D+Y+/I02wvMjMEOlyY=",
       "license": "MIT",
       "dependencies": {
         "thenify": ">= 3.1.0 < 4"
@@ -18102,26 +18101,26 @@
     },
     "node_modules/throat": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/throat/-/throat-6.0.2.tgz",
-      "integrity": "sha512-WKexMoJj3vEuK0yFEapj8y64V0A6xcuPuK9Gt1d0R+dzCSJc0lHqQytAbSB4cDAK0dWh4T0E2ETkoLE2WZ41OQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/throat/-/throat-6.0.2.tgz",
+      "integrity": "sha1-UaP7teEa5y4s90hh7VyAIPifKf4=",
       "license": "MIT"
     },
     "node_modules/thunky": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/thunky/-/thunky-1.1.0.tgz",
-      "integrity": "sha512-eHY7nBftgThBqOyHGVN+l8gF0BucP09fMo0oO/Lb0w1OF80dJv+lDVpXG60WMQvkcxAkNybKsrEIE3ZtKGmPrA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/thunky/-/thunky-1.1.0.tgz",
+      "integrity": "sha1-Wrr3FKlAXbBQRzK7zNLO3Z75U30=",
       "license": "MIT"
     },
     "node_modules/tiny-invariant": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
-      "integrity": "sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tiny-invariant/-/tiny-invariant-1.3.3.tgz",
+      "integrity": "sha1-RmgLeoc6DV0QAFmV65CnDXTWASc=",
       "license": "MIT"
     },
     "node_modules/tinyglobby": {
       "version": "0.2.17",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
-      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha1-ViqabJ6ys7Ej05cZ+a9btE/NdjE=",
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
@@ -18136,8 +18135,8 @@
     },
     "node_modules/tinyglobby/node_modules/picomatch": {
       "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
-      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha1-UepXoX2G9gX4EDlZX7xA7QalX6s=",
       "license": "MIT",
       "engines": {
         "node": ">=12"
@@ -18148,14 +18147,14 @@
     },
     "node_modules/tmpl": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
-      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tmpl/-/tmpl-1.0.5.tgz",
+      "integrity": "sha1-hoPguQK7nCDE9ybjwLafNlGMB8w=",
       "license": "BSD-3-Clause"
     },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
-      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha1-FkjESq58jZiKMmAY7XL1tN0DkuQ=",
       "license": "MIT",
       "dependencies": {
         "is-number": "^7.0.0"
@@ -18166,8 +18165,8 @@
     },
     "node_modules/toidentifier": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha1-O+NDIaiKgg7RvYDfqjPkefu43TU=",
       "license": "MIT",
       "engines": {
         "node": ">=0.6"
@@ -18175,8 +18174,8 @@
     },
     "node_modules/tough-cookie": {
       "version": "4.1.4",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.4.tgz",
-      "integrity": "sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tough-cookie/-/tough-cookie-4.1.4.tgz",
+      "integrity": "sha1-lF8UYbRbWox2ghwz6knDrBksGzY=",
       "license": "BSD-3-Clause",
       "dependencies": {
         "psl": "^1.1.33",
@@ -18190,8 +18189,8 @@
     },
     "node_modules/tough-cookie/node_modules/universalify": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-0.2.0.tgz",
-      "integrity": "sha512-CJ1QgKmNg3CwvAv/kOFmtnEN05f0D/cn9QntgNOQlQF9dgvVTHj3t+8JPdjqawCHk7V/KA+fbUqzZ9XWhcqPUg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/universalify/-/universalify-0.2.0.tgz",
+      "integrity": "sha1-ZFF2BWb6hXU0dFqx3elS0bF2G+A=",
       "license": "MIT",
       "engines": {
         "node": ">= 4.0.0"
@@ -18199,8 +18198,8 @@
     },
     "node_modules/tr46": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-2.1.0.tgz",
-      "integrity": "sha512-15Ih7phfcdP5YxqiB+iDtLoaTz4Nd35+IiAv0kQ5FNKHzXgdWqPoTIqEDDJmXceQt4JZk6lVPT8lnDlPpGDppw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tr46/-/tr46-2.1.0.tgz",
+      "integrity": "sha1-+oeqgcpdWUHajL8fm3SdyWmk4kA=",
       "license": "MIT",
       "dependencies": {
         "punycode": "^2.1.1"
@@ -18211,20 +18210,20 @@
     },
     "node_modules/tryer": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/tryer/-/tryer-1.0.1.tgz",
-      "integrity": "sha512-c3zayb8/kWWpycWYg87P71E1S1ZL6b6IJxfb5fvsUgsf0S2MVGaDhDXXjDMpdCpfWXqptc+4mXwmiy1ypXqRAA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tryer/-/tryer-1.0.1.tgz",
+      "integrity": "sha1-8shUBoALmw90yfdGW4HqrSQSUvg=",
       "license": "MIT"
     },
     "node_modules/ts-interface-checker": {
       "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/ts-interface-checker/-/ts-interface-checker-0.1.13.tgz",
-      "integrity": "sha512-Y/arvbn+rrz3JCKl9C4kVNfTfSm2/mEp5FSz5EsZSANGPSlQrpRI5M4PKF+mJnE52jOO90PnPSc3Ur3bTQw0gA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ts-interface-checker/-/ts-interface-checker-0.1.13.tgz",
+      "integrity": "sha1-eE/T1nlyK8EDsbS4AwvN212yppk=",
       "license": "Apache-2.0"
     },
     "node_modules/tsconfig-paths": {
       "version": "3.15.0",
-      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.15.0.tgz",
-      "integrity": "sha512-2Ac2RgzDe/cn48GvOe3M+o82pEFewD3UPbyoUHHdKasHwJKjds4fLXWf/Ux5kATBKN20oaFGu+jbElp1pos0mg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tsconfig-paths/-/tsconfig-paths-3.15.0.tgz",
+      "integrity": "sha1-UpnsYF5VsauyPsk57xXtr0gwcNQ=",
       "license": "MIT",
       "dependencies": {
         "@types/json5": "^0.0.29",
@@ -18235,8 +18234,8 @@
     },
     "node_modules/tsconfig-paths/node_modules/json5": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.2.tgz",
-      "integrity": "sha512-g1MWMLBiz8FKi1e4w0UyVL3w+iJceWAFBAaBnnGKOpNa5f8TLktkbre1+s6oICydWAm+HRUGTmI+//xv2hvXYA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/json5/-/json5-1.0.2.tgz",
+      "integrity": "sha1-Y9mNYPIbMTt3xNbaGL+mnYDh1ZM=",
       "license": "MIT",
       "dependencies": {
         "minimist": "^1.2.0"
@@ -18247,8 +18246,8 @@
     },
     "node_modules/tsconfig-paths/node_modules/strip-bom": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
-      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/strip-bom/-/strip-bom-3.0.0.tgz",
+      "integrity": "sha1-IzTBjpx1n3vdVv3vfprj1YjmjtM=",
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -18256,14 +18255,14 @@
     },
     "node_modules/tslib": {
       "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha1-YS7+TtI11Wfoq6Xypfq3AoCt6D8=",
       "license": "0BSD"
     },
     "node_modules/tsutils": {
       "version": "3.21.0",
-      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.21.0.tgz",
-      "integrity": "sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tsutils/-/tsutils-3.21.0.tgz",
+      "integrity": "sha1-tIcX05TOpsHglpg+7Vjp1hcVtiM=",
       "license": "MIT",
       "dependencies": {
         "tslib": "^1.8.1"
@@ -18277,14 +18276,14 @@
     },
     "node_modules/tsutils/node_modules/tslib": {
       "version": "1.14.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
-      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha1-zy04vcNKE0vK8QkcQfZhni9nLQA=",
       "license": "0BSD"
     },
     "node_modules/type-check": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
-      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha1-B7ggO/pwVsBlcFDjzNLDdzC6uPE=",
       "license": "MIT",
       "dependencies": {
         "prelude-ls": "^1.2.1"
@@ -18295,8 +18294,8 @@
     },
     "node_modules/type-detect": {
       "version": "4.0.8",
-      "resolved": "https://registry.npmjs.org/type-detect/-/type-detect-4.0.8.tgz",
-      "integrity": "sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/type-detect/-/type-detect-4.0.8.tgz",
+      "integrity": "sha1-dkb7XxiHHPu3dJ5pvTmmOI63RQw=",
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -18304,8 +18303,8 @@
     },
     "node_modules/type-fest": {
       "version": "0.20.2",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
-      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha1-G/IH9LKPkVg2ZstfvTJ4hzAc1fQ=",
       "license": "(MIT OR CC0-1.0)",
       "engines": {
         "node": ">=10"
@@ -18316,8 +18315,8 @@
     },
     "node_modules/type-is": {
       "version": "1.6.18",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
-      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/type-is/-/type-is-1.6.18.tgz",
+      "integrity": "sha1-TlUs0F3wlGfcvE73Od6J8s83wTE=",
       "license": "MIT",
       "dependencies": {
         "media-typer": "0.3.0",
@@ -18329,8 +18328,8 @@
     },
     "node_modules/typed-array-buffer": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/typed-array-buffer/-/typed-array-buffer-1.0.3.tgz",
-      "integrity": "sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/typed-array-buffer/-/typed-array-buffer-1.0.3.tgz",
+      "integrity": "sha1-pyOVRQpIaewDP9VJNxtHrzou5TY=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -18343,8 +18342,8 @@
     },
     "node_modules/typed-array-byte-length": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/typed-array-byte-length/-/typed-array-byte-length-1.0.3.tgz",
-      "integrity": "sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/typed-array-byte-length/-/typed-array-byte-length-1.0.3.tgz",
+      "integrity": "sha1-hAegT314aE89JSqhoUPSt3tBYM4=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.8",
@@ -18362,8 +18361,8 @@
     },
     "node_modules/typed-array-byte-offset": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/typed-array-byte-offset/-/typed-array-byte-offset-1.0.4.tgz",
-      "integrity": "sha512-bTlAFB/FBYMcuX81gbL4OcpH5PmlFHqlCCpAl8AlEzMz5k53oNDvN8p1PNOWLEmI2x4orp3raOFB51tv9X+MFQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/typed-array-byte-offset/-/typed-array-byte-offset-1.0.4.tgz",
+      "integrity": "sha1-rjaYuOyRqKuUUBYQiu8A1b/xI1U=",
       "license": "MIT",
       "dependencies": {
         "available-typed-arrays": "^1.0.7",
@@ -18383,8 +18382,8 @@
     },
     "node_modules/typed-array-length": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/typed-array-length/-/typed-array-length-1.0.8.tgz",
-      "integrity": "sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/typed-array-length/-/typed-array-length-1.0.8.tgz",
+      "integrity": "sha1-C3Dpgsnp2v4t721kWP9LPy0rbXA=",
       "license": "MIT",
       "dependencies": {
         "call-bind": "^1.0.9",
@@ -18403,8 +18402,8 @@
     },
     "node_modules/typedarray-to-buffer": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz",
-      "integrity": "sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz",
+      "integrity": "sha1-qX7nqf9CaRufeD/xvFES/j/KkIA=",
       "license": "MIT",
       "dependencies": {
         "is-typedarray": "^1.0.0"
@@ -18412,8 +18411,8 @@
     },
     "node_modules/typescript": {
       "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha1-W09Z4VMQqxeiFvXWz1PuR27eZw8=",
       "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
@@ -18425,8 +18424,8 @@
     },
     "node_modules/unbox-primitive": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/unbox-primitive/-/unbox-primitive-1.1.0.tgz",
-      "integrity": "sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/unbox-primitive/-/unbox-primitive-1.1.0.tgz",
+      "integrity": "sha1-jZ0snt7qhGDH81AzqIhnlEk00eI=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.3",
@@ -18443,20 +18442,20 @@
     },
     "node_modules/underscore": {
       "version": "1.13.8",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.8.tgz",
-      "integrity": "sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/underscore/-/underscore-1.13.8.tgz",
+      "integrity": "sha1-qTohGGwEnb8OhHSW26cre9jB6Ss=",
       "license": "MIT"
     },
     "node_modules/undici-types": {
       "version": "7.24.6",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.24.6.tgz",
-      "integrity": "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/undici-types/-/undici-types-7.24.6.tgz",
+      "integrity": "sha1-YSdbSF1/1OnSacfPBOwoc8nMD5E=",
       "license": "MIT"
     },
     "node_modules/unicode-canonical-property-names-ecmascript": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.1.tgz",
-      "integrity": "sha512-dA8WbNeb2a6oQzAQ55YlT5vQAWGV9WXOsi3SskE3bcCdM0P4SDd+24zS/OCacdRq5BkdsRj9q3Pg6YyQoxIGqg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/unicode-canonical-property-names-ecmascript/-/unicode-canonical-property-names-ecmascript-2.0.1.tgz",
+      "integrity": "sha1-yzFz/kfKdD4ighbko93EyE1ijMI=",
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -18464,8 +18463,8 @@
     },
     "node_modules/unicode-match-property-ecmascript": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/unicode-match-property-ecmascript/-/unicode-match-property-ecmascript-2.0.0.tgz",
-      "integrity": "sha512-5kaZCrbp5mmbz5ulBkDkbY0SsPOjKqVS35VpL9ulMPfSl0J0Xsm+9Evphv9CoIZFwre7aJoa94AY6seMKGVN5Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/unicode-match-property-ecmascript/-/unicode-match-property-ecmascript-2.0.0.tgz",
+      "integrity": "sha1-VP0W4OyxZ88Ezx91a9zJLrp5dsM=",
       "license": "MIT",
       "dependencies": {
         "unicode-canonical-property-names-ecmascript": "^2.0.0",
@@ -18477,8 +18476,8 @@
     },
     "node_modules/unicode-match-property-value-ecmascript": {
       "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.2.1.tgz",
-      "integrity": "sha512-JQ84qTuMg4nVkx8ga4A16a1epI9H6uTXAknqxkGF/aFfRLw1xC/Bp24HNLaZhHSkWd3+84t8iXnp1J0kYcZHhg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/unicode-match-property-value-ecmascript/-/unicode-match-property-value-ecmascript-2.2.1.tgz",
+      "integrity": "sha1-Zaet+thXTCGYkOIZKFzkxk7Wfqo=",
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -18486,8 +18485,8 @@
     },
     "node_modules/unicode-property-aliases-ecmascript": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/unicode-property-aliases-ecmascript/-/unicode-property-aliases-ecmascript-2.2.0.tgz",
-      "integrity": "sha512-hpbDzxUY9BFwX+UeBnxv3Sh1q7HFxj48DTmXchNgRa46lO8uj3/1iEn3MiNUYTg1g9ctIqXCCERn8gYZhHC5lQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/unicode-property-aliases-ecmascript/-/unicode-property-aliases-ecmascript-2.2.0.tgz",
+      "integrity": "sha1-MB1PikPSt1yXrfrYfJ3VNQyUddE=",
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -18495,8 +18494,8 @@
     },
     "node_modules/unique-string": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/unique-string/-/unique-string-2.0.0.tgz",
-      "integrity": "sha512-uNaeirEPvpZWSgzwsPGtU2zVSTrn/8L5q/IexZmH0eH6SA73CmAA5U4GwORTxQAZs95TAXLNqeLoPPNO5gZfWg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/unique-string/-/unique-string-2.0.0.tgz",
+      "integrity": "sha1-OcZFH4GvsnSd4rIz4/fF6IQ72J0=",
       "license": "MIT",
       "dependencies": {
         "crypto-random-string": "^2.0.0"
@@ -18507,8 +18506,8 @@
     },
     "node_modules/universalify": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
-      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/universalify/-/universalify-2.0.1.tgz",
+      "integrity": "sha1-Fo78IYCWTmOG0GHglN9hr+I5sY0=",
       "license": "MIT",
       "engines": {
         "node": ">= 10.0.0"
@@ -18516,8 +18515,8 @@
     },
     "node_modules/unpipe": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
-      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha1-sr9O6FFKrmFltIF4KdIbLvSZBOw=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -18525,8 +18524,8 @@
     },
     "node_modules/upath": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/upath/-/upath-1.2.0.tgz",
-      "integrity": "sha512-aZwGpamFO61g3OlfT7OQCHqhGnW43ieH9WZeP7QxN/G/jS4jfqUkZxoryvJgVPEcrl5NL/ggHsSmLMHuH64Lhg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/upath/-/upath-1.2.0.tgz",
+      "integrity": "sha1-j2bbzVWog6za5ECK+LA1pQRMGJQ=",
       "license": "MIT",
       "engines": {
         "node": ">=4",
@@ -18534,9 +18533,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.1",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/update-browserslist-db/-/update-browserslist-db-1.3.1.tgz",
+      "integrity": "sha1-pxwo3SL1BUgdvEaJCHsY2TPpCv0=",
       "funding": [
         {
           "type": "opencollective",
@@ -18565,8 +18564,8 @@
     },
     "node_modules/uri-js": {
       "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha1-mxpSWVIlhZ5V9mnZKPiMbFfyp34=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "punycode": "^2.1.0"
@@ -18574,8 +18573,8 @@
     },
     "node_modules/url-parse": {
       "version": "1.5.10",
-      "resolved": "https://registry.npmjs.org/url-parse/-/url-parse-1.5.10.tgz",
-      "integrity": "sha512-WypcfiRhfeUP9vvF0j6rw0J3hrWrw6iZv3+22h6iRMJ/8z1Tj6XfLP4DsUix5MhMPnXpiHDoKyoZ/bdCkwBCiQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/url-parse/-/url-parse-1.5.10.tgz",
+      "integrity": "sha1-nTwvc2wddd070r5QfcwRHx4uqcE=",
       "license": "MIT",
       "dependencies": {
         "querystringify": "^2.1.1",
@@ -18584,8 +18583,8 @@
     },
     "node_modules/use-sync-external-store": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.6.0.tgz",
-      "integrity": "sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/use-sync-external-store/-/use-sync-external-store-1.6.0.tgz",
+      "integrity": "sha1-sXS/plyytSZzLZ8qwKQIAnh28y0=",
       "license": "MIT",
       "peerDependencies": {
         "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
@@ -18593,20 +18592,20 @@
     },
     "node_modules/util-deprecate": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8=",
       "license": "MIT"
     },
     "node_modules/utila": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/utila/-/utila-0.4.0.tgz",
-      "integrity": "sha512-Z0DbgELS9/L/75wZbro8xAnT50pBVFQZ+hUEueGDU5FN51YSCYM+jdxsfCiHjwNP/4LCDD0i/graKpeBnOXKRA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/utila/-/utila-0.4.0.tgz",
+      "integrity": "sha1-ihagXURWV6Oupe7MWxKk+lN5dyw=",
       "license": "MIT"
     },
     "node_modules/utils-merge": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
-      "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/utils-merge/-/utils-merge-1.0.1.tgz",
+      "integrity": "sha1-n5VxD1CiZ5R7LMwSR0HBAoQn5xM=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.4.0"
@@ -18614,8 +18613,8 @@
     },
     "node_modules/uuid": {
       "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha1-gNW1ztJxu5r2xEXyGhoExgbO++I=",
       "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
       "license": "MIT",
       "bin": {
@@ -18624,8 +18623,8 @@
     },
     "node_modules/v8-to-istanbul": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/v8-to-istanbul/-/v8-to-istanbul-8.1.1.tgz",
-      "integrity": "sha512-FGtKtv3xIpR6BYhvgH8MI/y78oT7d8Au3ww4QIxymrCtZEh5b8gCw2siywE+puhEmuWKDtmfrvF5UlB298ut3w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/v8-to-istanbul/-/v8-to-istanbul-8.1.1.tgz",
+      "integrity": "sha1-d7dS/Tl14xu875OPhem9HHqNYO0=",
       "license": "ISC",
       "dependencies": {
         "@types/istanbul-lib-coverage": "^2.0.1",
@@ -18638,14 +18637,14 @@
     },
     "node_modules/v8-to-istanbul/node_modules/convert-source-map": {
       "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
-      "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/convert-source-map/-/convert-source-map-1.9.0.tgz",
+      "integrity": "sha1-f6rmI1P7QhM2bQypg1jSLoNosF8=",
       "license": "MIT"
     },
     "node_modules/vary": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha1-IpnwLG3tMNSllhsLn3RSShj2NPw=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -18653,8 +18652,8 @@
     },
     "node_modules/victory-vendor": {
       "version": "36.9.2",
-      "resolved": "https://registry.npmjs.org/victory-vendor/-/victory-vendor-36.9.2.tgz",
-      "integrity": "sha512-PnpQQMuxlwYdocC8fIJqVXvkeViHYzotI+NJrCuav0ZYFoq912ZHBk3mCeuj+5/VpodOjPe1z0Fk2ihgzlXqjQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/victory-vendor/-/victory-vendor-36.9.2.tgz",
+      "integrity": "sha1-ZosCpEj6TqD3iNv0Iot+ZGaf+AE=",
       "license": "MIT AND ISC",
       "dependencies": {
         "@types/d3-array": "^3.0.3",
@@ -18675,8 +18674,8 @@
     },
     "node_modules/w3c-hr-time": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/w3c-hr-time/-/w3c-hr-time-1.0.2.tgz",
-      "integrity": "sha512-z8P5DvDNjKDoFIHK7q8r8lackT6l+jo/Ye3HOle7l9nICP9lf1Ci25fy9vHd0JOWewkIFzXIEig3TdKT7JQ5fQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/w3c-hr-time/-/w3c-hr-time-1.0.2.tgz",
+      "integrity": "sha1-ConN9cwVgi35w2BUNnaWPgzDCM0=",
       "deprecated": "Use your platform's native performance.now() and performance.timeOrigin.",
       "license": "MIT",
       "dependencies": {
@@ -18685,8 +18684,8 @@
     },
     "node_modules/w3c-xmlserializer": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/w3c-xmlserializer/-/w3c-xmlserializer-2.0.0.tgz",
-      "integrity": "sha512-4tzD0mF8iSiMiNs30BiLO3EpfGLZUT2MSX/G+o7ZywDzliWQ3OPtTZ0PTC3B3ca1UAf4cJMHB+2Bf56EriJuRA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/w3c-xmlserializer/-/w3c-xmlserializer-2.0.0.tgz",
+      "integrity": "sha1-PnEEoFt1FGzGD1ZDgLf2g6zxAgo=",
       "license": "MIT",
       "dependencies": {
         "xml-name-validator": "^3.0.0"
@@ -18697,8 +18696,8 @@
     },
     "node_modules/walker": {
       "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
-      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/walker/-/walker-1.0.8.tgz",
+      "integrity": "sha1-vUmNtHev5XPcBBhfAR06uKjXZT8=",
       "license": "Apache-2.0",
       "dependencies": {
         "makeerror": "1.0.12"
@@ -18706,8 +18705,8 @@
     },
     "node_modules/watchpack": {
       "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.2.tgz",
-      "integrity": "sha512-6i/00NBjP4yGPs+caKSyRfpTF/8Torsu0MOW3mMzIbhgISFder8i7xbqgHlLMwJrdiN8ndBV3UA1/AfzPSr+jg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/watchpack/-/watchpack-2.5.2.tgz",
+      "integrity": "sha1-4S6C2EZ0Jm/Bxtv+OIkbkv8FIuw=",
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.1.2"
@@ -18718,8 +18717,8 @@
     },
     "node_modules/wbuf": {
       "version": "1.7.3",
-      "resolved": "https://registry.npmjs.org/wbuf/-/wbuf-1.7.3.tgz",
-      "integrity": "sha512-O84QOnr0icsbFGLS0O3bI5FswxzRr8/gHwWkDlQFskhSPryQXvrTMxjxGP4+iWYoauLoBvfDpkrOauZ+0iZpDA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/wbuf/-/wbuf-1.7.3.tgz",
+      "integrity": "sha1-wdjRSTFtPqhShIiVy2oL/oh7h98=",
       "license": "MIT",
       "dependencies": {
         "minimalistic-assert": "^1.0.0"
@@ -18727,8 +18726,8 @@
     },
     "node_modules/webidl-conversions": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-6.1.0.tgz",
-      "integrity": "sha512-qBIvFLGiBpLjfwmYAaHPXsn+ho5xZnGvyGvsarywGNc8VyQJUMHJ8OBKGGrPER0okBeMDaan4mNBlgBROxuI8w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/webidl-conversions/-/webidl-conversions-6.1.0.tgz",
+      "integrity": "sha1-kRG01+qArNQPUnDWZmIa+ni2lRQ=",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=10.4"
@@ -18736,8 +18735,8 @@
     },
     "node_modules/webpack": {
       "version": "5.109.2",
-      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.109.2.tgz",
-      "integrity": "sha512-U9/cvLzxObKNEZ9+TtdqrHM5/9z3lgl2c+c4BzbqGxFQvQvBAq87yql5A8pQ+rrMbS496MZJeF5enVBndIy2hw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/webpack/-/webpack-5.109.2.tgz",
+      "integrity": "sha1-tY3CiVYcMoLbNcIQqZN5qDakwo0=",
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.8",
@@ -18779,8 +18778,8 @@
     },
     "node_modules/webpack-dev-middleware": {
       "version": "5.3.4",
-      "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz",
-      "integrity": "sha512-BVdTqhhs+0IfoeAf7EoH5WE+exCmqGerHfDM0IL096Px60Tq2Mn9MAbnaGUe6HiMa41KMCYF19gyzZmBcq/o4Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/webpack-dev-middleware/-/webpack-dev-middleware-5.3.4.tgz",
+      "integrity": "sha1-63s5KBy84Q4QTrK4vytj/OSaNRc=",
       "license": "MIT",
       "dependencies": {
         "colorette": "^2.0.10",
@@ -18802,8 +18801,8 @@
     },
     "node_modules/webpack-dev-server": {
       "version": "4.15.2",
-      "resolved": "https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-4.15.2.tgz",
-      "integrity": "sha512-0XavAZbNJ5sDrCbkpWL8mia0o5WPOd2YGtxrEiZkBK9FjLppIUK2TgxK6qGD2P3hUXTJNNPVibrerKcx5WkR1g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/webpack-dev-server/-/webpack-dev-server-4.15.2.tgz",
+      "integrity": "sha1-ngxwpCoBJWCGCtsYaYbaEkgzMXM=",
       "license": "MIT",
       "dependencies": {
         "@types/bonjour": "^3.5.9",
@@ -18861,8 +18860,8 @@
     },
     "node_modules/webpack-dev-server/node_modules/ws": {
       "version": "8.21.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
-      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha1-AS5BP8B0KZRRIbDBUxWMQ0MIaVE=",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -18882,8 +18881,8 @@
     },
     "node_modules/webpack-manifest-plugin": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/webpack-manifest-plugin/-/webpack-manifest-plugin-4.1.1.tgz",
-      "integrity": "sha512-YXUAwxtfKIJIKkhg03MKuiFAD72PlrqCiwdwO4VEXdRO5V0ORCNwaOwAZawPZalCbmH9kBDmXnNeQOw+BIEiow==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/webpack-manifest-plugin/-/webpack-manifest-plugin-4.1.1.tgz",
+      "integrity": "sha1-EPjb9HFP+TohXVpFvMQW2AUG+U8=",
       "license": "MIT",
       "dependencies": {
         "tapable": "^2.0.0",
@@ -18898,8 +18897,8 @@
     },
     "node_modules/webpack-manifest-plugin/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -18907,8 +18906,8 @@
     },
     "node_modules/webpack-manifest-plugin/node_modules/webpack-sources": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-2.3.1.tgz",
-      "integrity": "sha512-y9EI9AO42JjEcrTJFOYmVywVZdKVUfOvDUPsJea5GIr1JOEGFVqwlY2K098fFoIjOkDzHn2AjRvM8dsBZu+gCA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/webpack-sources/-/webpack-sources-2.3.1.tgz",
+      "integrity": "sha1-Vw3grxY5Sf4nIjPCzv4bVvdFEf0=",
       "license": "MIT",
       "dependencies": {
         "source-list-map": "^2.0.1",
@@ -18920,8 +18919,8 @@
     },
     "node_modules/webpack-sources": {
       "version": "3.5.1",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.5.1.tgz",
-      "integrity": "sha512-jyuiGJdtvY434z5bUZrjz67v76/ePNvFZTp9Mdz29IlH4+GPsgyGjiv0fKI+M7BdkU6ADjulUcKAd3tUK3WlEw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/webpack-sources/-/webpack-sources-3.5.1.tgz",
+      "integrity": "sha1-dsJBhIbcwCsqoGlMEEF2woWP6Eo=",
       "license": "MIT",
       "engines": {
         "node": ">=10.13.0"
@@ -18929,8 +18928,8 @@
     },
     "node_modules/webpack/node_modules/eslint-scope": {
       "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
-      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/eslint-scope/-/eslint-scope-5.1.1.tgz",
+      "integrity": "sha1-54blmmbLkrP2wfsNUIqrF0hI9Iw=",
       "license": "BSD-2-Clause",
       "dependencies": {
         "esrecurse": "^4.3.0",
@@ -18942,8 +18941,8 @@
     },
     "node_modules/webpack/node_modules/estraverse": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/estraverse/-/estraverse-4.3.0.tgz",
+      "integrity": "sha1-OYrT88WiSUi+dyXoPRGn3ijNvR0=",
       "license": "BSD-2-Clause",
       "engines": {
         "node": ">=4.0"
@@ -18951,8 +18950,8 @@
     },
     "node_modules/webpack/node_modules/mime-db": {
       "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/mime-db/-/mime-db-1.54.0.tgz",
+      "integrity": "sha1-zds+5PnGRTDf9kAjZmHULLajFPU=",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -18960,8 +18959,8 @@
     },
     "node_modules/websocket-driver": {
       "version": "0.7.5",
-      "resolved": "https://registry.npmjs.org/websocket-driver/-/websocket-driver-0.7.5.tgz",
-      "integrity": "sha512-ZL2+3c7kMBdIRCMz6l8jQMHyGVxj+UL+xVk74Ombiciboca8rHa15L86B19E5oh1pL9Ii/uj54gtsIrZGMo6zA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/websocket-driver/-/websocket-driver-0.7.5.tgz",
+      "integrity": "sha1-Vp0idkqyHy3iCvDnS0EeiuWg+kY=",
       "license": "Apache-2.0",
       "dependencies": {
         "http-parser-js": ">=0.5.1",
@@ -18974,8 +18973,8 @@
     },
     "node_modules/websocket-extensions": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/websocket-extensions/-/websocket-extensions-0.1.4.tgz",
-      "integrity": "sha512-OqedPIGOfsDlo31UNwYbCFMSaO9m9G/0faIHj5/dZFDMFqPTcx6UwqyOy3COEaEOg/9VsGIpdqn62W5KhoKSpg==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/websocket-extensions/-/websocket-extensions-0.1.4.tgz",
+      "integrity": "sha1-f4RzvIOd/YdgituV1+sHUhFXikI=",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=0.8.0"
@@ -18983,8 +18982,8 @@
     },
     "node_modules/whatwg-encoding": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/whatwg-encoding/-/whatwg-encoding-1.0.5.tgz",
-      "integrity": "sha512-b5lim54JOPN9HtzvK9HFXvBma/rnfFeqsic0hSpjtDbVxR3dJKLc+KB4V6GgiGOvl7CY/KNh8rxSo9DKQrnUEw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/whatwg-encoding/-/whatwg-encoding-1.0.5.tgz",
+      "integrity": "sha1-WrrPd3wyFmpR0IXWtPPn0nET3bA=",
       "deprecated": "Use @exodus/bytes instead for a more spec-conformant and faster implementation",
       "license": "MIT",
       "dependencies": {
@@ -18993,8 +18992,8 @@
     },
     "node_modules/whatwg-encoding/node_modules/iconv-lite": {
       "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/iconv-lite/-/iconv-lite-0.4.24.tgz",
+      "integrity": "sha1-ICK0sl+93CHS9SSXSkdKr+czkIs=",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3"
@@ -19005,20 +19004,20 @@
     },
     "node_modules/whatwg-fetch": {
       "version": "3.6.20",
-      "resolved": "https://registry.npmjs.org/whatwg-fetch/-/whatwg-fetch-3.6.20.tgz",
-      "integrity": "sha512-EqhiFU6daOA8kpjOWTL0olhVOF3i7OrFzSYiGsEMB8GcXS+RrzauAERX65xMeNWVqxA6HXH2m69Z9LaKKdisfg==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/whatwg-fetch/-/whatwg-fetch-3.6.20.tgz",
+      "integrity": "sha1-WAzm15H6zskdN8cokJlaC0jTHHA=",
       "license": "MIT"
     },
     "node_modules/whatwg-mimetype": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/whatwg-mimetype/-/whatwg-mimetype-2.3.0.tgz",
-      "integrity": "sha512-M4yMwr6mAnQz76TbJm914+gPpB/nCwvZbJU28cUD6dR004SAxDLOOSUaB1JDRqLtaOV/vi0IC5lEAGFgrjGv/g==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/whatwg-mimetype/-/whatwg-mimetype-2.3.0.tgz",
+      "integrity": "sha1-PUseAxLSB5h5+Cav8Y2+7KWWD78=",
       "license": "MIT"
     },
     "node_modules/whatwg-url": {
       "version": "8.7.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-8.7.0.tgz",
-      "integrity": "sha512-gAojqb/m9Q8a5IV96E3fHJM70AzCkgt4uXYX2O7EmuyOnLrViCQlsEBmF9UQIu3/aeAIp2U17rtbpZWNntQqdg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/whatwg-url/-/whatwg-url-8.7.0.tgz",
+      "integrity": "sha1-ZWp45RD/jzk3vAvL6fXArDWUG3c=",
       "license": "MIT",
       "dependencies": {
         "lodash": "^4.7.0",
@@ -19031,8 +19030,8 @@
     },
     "node_modules/which": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/which/-/which-2.0.2.tgz",
+      "integrity": "sha1-fGqN0KY2oDJ+ELWckobu6T8/UbE=",
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -19046,8 +19045,8 @@
     },
     "node_modules/which-boxed-primitive": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/which-boxed-primitive/-/which-boxed-primitive-1.1.1.tgz",
-      "integrity": "sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/which-boxed-primitive/-/which-boxed-primitive-1.1.1.tgz",
+      "integrity": "sha1-127Cfff6Fl8Y1YCDdKX+I8KbF24=",
       "license": "MIT",
       "dependencies": {
         "is-bigint": "^1.1.0",
@@ -19065,8 +19064,8 @@
     },
     "node_modules/which-builtin-type": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/which-builtin-type/-/which-builtin-type-1.2.1.tgz",
-      "integrity": "sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/which-builtin-type/-/which-builtin-type-1.2.1.tgz",
+      "integrity": "sha1-iRg9obSQerCJprAgKcxdjWV0Jw4=",
       "license": "MIT",
       "dependencies": {
         "call-bound": "^1.0.2",
@@ -19092,8 +19091,8 @@
     },
     "node_modules/which-collection": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/which-collection/-/which-collection-1.0.2.tgz",
-      "integrity": "sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/which-collection/-/which-collection-1.0.2.tgz",
+      "integrity": "sha1-Yn73YkOSChB+fOjpYZHevksWwqA=",
       "license": "MIT",
       "dependencies": {
         "is-map": "^2.0.3",
@@ -19110,8 +19109,8 @@
     },
     "node_modules/which-typed-array": {
       "version": "1.1.22",
-      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.22.tgz",
-      "integrity": "sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/which-typed-array/-/which-typed-array-1.1.22.tgz",
+      "integrity": "sha1-jzzHiu+0C0NzRt1Aodv6XR2kP+k=",
       "license": "MIT",
       "dependencies": {
         "available-typed-arrays": "^1.0.7",
@@ -19131,8 +19130,8 @@
     },
     "node_modules/word-wrap": {
       "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
-      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/word-wrap/-/word-wrap-1.2.5.tgz",
+      "integrity": "sha1-0sRcbdT7zmIaZvE2y+Mor9BBCzQ=",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -19140,8 +19139,8 @@
     },
     "node_modules/workbox-background-sync": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-background-sync/-/workbox-background-sync-6.6.0.tgz",
-      "integrity": "sha512-jkf4ZdgOJxC9u2vztxLuPT/UjlH7m/nWRQ/MgGL0v8BJHoZdVGJd18Kck+a0e55wGXdqyHO+4IQTk0685g4MUw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-background-sync/-/workbox-background-sync-6.6.0.tgz",
+      "integrity": "sha1-BYwwBnLVibHY8tg42UCjcbzQ7Ak=",
       "license": "MIT",
       "dependencies": {
         "idb": "^7.0.1",
@@ -19150,8 +19149,8 @@
     },
     "node_modules/workbox-broadcast-update": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-broadcast-update/-/workbox-broadcast-update-6.6.0.tgz",
-      "integrity": "sha512-nm+v6QmrIFaB/yokJmQ/93qIJ7n72NICxIwQwe5xsZiV2aI93MGGyEyzOzDPVz5THEr5rC3FJSsO3346cId64Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-broadcast-update/-/workbox-broadcast-update-6.6.0.tgz",
+      "integrity": "sha1-CrubY4xf5w4TBRYd922xkm/4PSE=",
       "license": "MIT",
       "dependencies": {
         "workbox-core": "6.6.0"
@@ -19159,8 +19158,8 @@
     },
     "node_modules/workbox-build": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-build/-/workbox-build-6.6.0.tgz",
-      "integrity": "sha512-Tjf+gBwOTuGyZwMz2Nk/B13Fuyeo0Q84W++bebbVsfr9iLkDSo6j6PST8tET9HYA58mlRXwlMGpyWO8ETJiXdQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-build/-/workbox-build-6.6.0.tgz",
+      "integrity": "sha1-i7ekuGzalbcqMD2R7l3FvYh3dcE=",
       "license": "MIT",
       "dependencies": {
         "@apideck/better-ajv-errors": "^0.3.1",
@@ -19207,8 +19206,8 @@
     },
     "node_modules/workbox-build/node_modules/fs-extra": {
       "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/fs-extra/-/fs-extra-9.1.0.tgz",
+      "integrity": "sha1-WVRGDHZKjaIJS6NVS/g55rmnyG0=",
       "license": "MIT",
       "dependencies": {
         "at-least-node": "^1.0.0",
@@ -19222,8 +19221,8 @@
     },
     "node_modules/workbox-build/node_modules/source-map": {
       "version": "0.8.0",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.8.0.tgz",
-      "integrity": "sha512-d8EqvL+k/SOXCreS/SUzg2ciyHqBBLcN/yuRjFsbvVhHTE2pgei7oAhmPM7kWFbkX6OSMQfUq4KbkF3au9lhYQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.8.0.tgz",
+      "integrity": "sha1-crkAY4O9n8cNUuQ1yRwtcyScYKQ=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">= 12"
@@ -19231,8 +19230,8 @@
     },
     "node_modules/workbox-cacheable-response": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-cacheable-response/-/workbox-cacheable-response-6.6.0.tgz",
-      "integrity": "sha512-JfhJUSQDwsF1Xv3EV1vWzSsCOZn4mQ38bWEBR3LdvOxSPgB65gAM6cS2CX8rkkKHRgiLrN7Wxoyu+TuH67kHrw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-cacheable-response/-/workbox-cacheable-response-6.6.0.tgz",
+      "integrity": "sha1-9uRTwdoUkTkrow4QcKEM5OhTlQs=",
       "deprecated": "workbox-background-sync@6.6.0",
       "license": "MIT",
       "dependencies": {
@@ -19241,14 +19240,14 @@
     },
     "node_modules/workbox-core": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-core/-/workbox-core-6.6.0.tgz",
-      "integrity": "sha512-GDtFRF7Yg3DD859PMbPAYPeJyg5gJYXuBQAC+wyrWuuXgpfoOrIQIvFRZnQ7+czTIQjIr1DhLEGFzZanAT/3bQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-core/-/workbox-core-6.6.0.tgz",
+      "integrity": "sha1-0PaSnjOOACXUEikTkOdGKl+HlXY=",
       "license": "MIT"
     },
     "node_modules/workbox-expiration": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-expiration/-/workbox-expiration-6.6.0.tgz",
-      "integrity": "sha512-baplYXcDHbe8vAo7GYvyAmlS4f6998Jff513L4XvlzAOxcl8F620O91guoJ5EOf5qeXG4cGdNZHkkVAPouFCpw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-expiration/-/workbox-expiration-6.6.0.tgz",
+      "integrity": "sha1-IpnIapydzKF+7Ej2isiLhlK8jk4=",
       "license": "MIT",
       "dependencies": {
         "idb": "^7.0.1",
@@ -19257,8 +19256,8 @@
     },
     "node_modules/workbox-google-analytics": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-google-analytics/-/workbox-google-analytics-6.6.0.tgz",
-      "integrity": "sha512-p4DJa6OldXWd6M9zRl0H6vB9lkrmqYFkRQ2xEiNdBFp9U0LhsGO7hsBscVEyH9H2/3eZZt8c97NB2FD9U2NJ+Q==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-google-analytics/-/workbox-google-analytics-6.6.0.tgz",
+      "integrity": "sha1-DbmboKCPzWfdz84lXr102D/GG6E=",
       "deprecated": "It is not compatible with newer versions of GA starting with v4, as long as you are using GAv3 it should be ok, but the package is not longer being maintained",
       "license": "MIT",
       "dependencies": {
@@ -19270,8 +19269,8 @@
     },
     "node_modules/workbox-navigation-preload": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-navigation-preload/-/workbox-navigation-preload-6.6.0.tgz",
-      "integrity": "sha512-utNEWG+uOfXdaZmvhshrh7KzhDu/1iMHyQOV6Aqup8Mm78D286ugu5k9MFD9SzBT5TcwgwSORVvInaXWbvKz9Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-navigation-preload/-/workbox-navigation-preload-6.6.0.tgz",
+      "integrity": "sha1-Ly27cXjFdioWPdLzsi/9WGcE868=",
       "license": "MIT",
       "dependencies": {
         "workbox-core": "6.6.0"
@@ -19279,8 +19278,8 @@
     },
     "node_modules/workbox-precaching": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-precaching/-/workbox-precaching-6.6.0.tgz",
-      "integrity": "sha512-eYu/7MqtRZN1IDttl/UQcSZFkHP7dnvr/X3Vn6Iw6OsPMruQHiVjjomDFCNtd8k2RdjLs0xiz9nq+t3YVBcWPw==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-precaching/-/workbox-precaching-6.6.0.tgz",
+      "integrity": "sha1-jHAUczFkJ/r61Vniat+0S3Kub/w=",
       "license": "MIT",
       "dependencies": {
         "workbox-core": "6.6.0",
@@ -19290,8 +19289,8 @@
     },
     "node_modules/workbox-range-requests": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-range-requests/-/workbox-range-requests-6.6.0.tgz",
-      "integrity": "sha512-V3aICz5fLGq5DpSYEU8LxeXvsT//mRWzKrfBOIxzIdQnV/Wj7R+LyJVTczi4CQ4NwKhAaBVaSujI1cEjXW+hTw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-range-requests/-/workbox-range-requests-6.6.0.tgz",
+      "integrity": "sha1-3G6JyhaU5EIHX8f6etnzxGlKhI4=",
       "license": "MIT",
       "dependencies": {
         "workbox-core": "6.6.0"
@@ -19299,8 +19298,8 @@
     },
     "node_modules/workbox-recipes": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-recipes/-/workbox-recipes-6.6.0.tgz",
-      "integrity": "sha512-TFi3kTgYw73t5tg73yPVqQC8QQjxJSeqjXRO4ouE/CeypmP2O/xqmB/ZFBBQazLTPxILUQ0b8aeh0IuxVn9a6A==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-recipes/-/workbox-recipes-6.6.0.tgz",
+      "integrity": "sha1-vsBtT1YFsS6YPQjMusTnCTJJbGw=",
       "license": "MIT",
       "dependencies": {
         "workbox-cacheable-response": "6.6.0",
@@ -19313,8 +19312,8 @@
     },
     "node_modules/workbox-routing": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-routing/-/workbox-routing-6.6.0.tgz",
-      "integrity": "sha512-x8gdN7VDBiLC03izAZRfU+WKUXJnbqt6PG9Uh0XuPRzJPpZGLKce/FkOX95dWHRpOHWLEq8RXzjW0O+POSkKvw==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-routing/-/workbox-routing-6.6.0.tgz",
+      "integrity": "sha1-MBKKZJuEYMVXrQ5wNTB34yVABVg=",
       "license": "MIT",
       "dependencies": {
         "workbox-core": "6.6.0"
@@ -19322,8 +19321,8 @@
     },
     "node_modules/workbox-strategies": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-strategies/-/workbox-strategies-6.6.0.tgz",
-      "integrity": "sha512-eC07XGuINAKUWDnZeIPdRdVja4JQtTuc35TZ8SwMb1ztjp7Ddq2CJ4yqLvWzFWGlYI7CG/YGqaETntTxBGdKgQ==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-strategies/-/workbox-strategies-6.6.0.tgz",
+      "integrity": "sha1-cbtgpG66oMUoSRuLUh9aHHs18MU=",
       "license": "MIT",
       "dependencies": {
         "workbox-core": "6.6.0"
@@ -19331,8 +19330,8 @@
     },
     "node_modules/workbox-streams": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-streams/-/workbox-streams-6.6.0.tgz",
-      "integrity": "sha512-rfMJLVvwuED09CnH1RnIep7L9+mj4ufkTyDPVaXPKlhi9+0czCu+SJggWCIFbPpJaAZmp2iyVGLqS3RUmY3fxg==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-streams/-/workbox-streams-6.6.0.tgz",
+      "integrity": "sha1-C+G6i0/Gkq71/++oMfXpu+7g/Zw=",
       "license": "MIT",
       "dependencies": {
         "workbox-core": "6.6.0",
@@ -19341,14 +19340,14 @@
     },
     "node_modules/workbox-sw": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-sw/-/workbox-sw-6.6.0.tgz",
-      "integrity": "sha512-R2IkwDokbtHUE4Kus8pKO5+VkPHD2oqTgl+XJwh4zbF1HyjAbgNmK/FneZHVU7p03XUt9ICfuGDYISWG9qV/CQ==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-sw/-/workbox-sw-6.6.0.tgz",
+      "integrity": "sha1-4H2FqK86SuMRum5F0XnsqkAtSYM=",
       "license": "MIT"
     },
     "node_modules/workbox-webpack-plugin": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-webpack-plugin/-/workbox-webpack-plugin-6.6.0.tgz",
-      "integrity": "sha512-xNZIZHalboZU66Wa7x1YkjIqEy1gTR+zPM+kjrYJzqN7iurYZBctBLISyScjhkJKYuRrZUP0iqViZTh8rS0+3A==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-webpack-plugin/-/workbox-webpack-plugin-6.6.0.tgz",
+      "integrity": "sha1-Om/CmP+1RtC9FXLzqi9D/Nuc1As=",
       "license": "MIT",
       "dependencies": {
         "fast-json-stable-stringify": "^2.1.0",
@@ -19366,8 +19365,8 @@
     },
     "node_modules/workbox-webpack-plugin/node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha1-dHIq8y6WFOnCh6jQu95IteLxomM=",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=0.10.0"
@@ -19375,8 +19374,8 @@
     },
     "node_modules/workbox-webpack-plugin/node_modules/webpack-sources": {
       "version": "1.4.3",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-1.4.3.tgz",
-      "integrity": "sha512-lgTS3Xhv1lCOKo7SA5TjKXMjpSM4sBjNV5+q2bqesbSPs5FjGmU6jjtBSkX9b4qW87vDIsCIlUPOEhbZrMdjeQ==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/webpack-sources/-/webpack-sources-1.4.3.tgz",
+      "integrity": "sha1-7t2OwLko+/HL/plOItLYkPMwqTM=",
       "license": "MIT",
       "dependencies": {
         "source-list-map": "^2.0.0",
@@ -19385,8 +19384,8 @@
     },
     "node_modules/workbox-window": {
       "version": "6.6.0",
-      "resolved": "https://registry.npmjs.org/workbox-window/-/workbox-window-6.6.0.tgz",
-      "integrity": "sha512-L4N9+vka17d16geaJXXRjENLFldvkWy7JyGxElRD0JvBxvFEd8LOhr+uXCcar/NzAmIBRv9EZ+M+Qr4mOoBITw==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/workbox-window/-/workbox-window-6.6.0.tgz",
+      "integrity": "sha1-obc4NA6oMyOXjqmsyPUnySQGVtY=",
       "license": "MIT",
       "dependencies": {
         "@types/trusted-types": "^2.0.2",
@@ -19395,8 +19394,8 @@
     },
     "node_modules/wrap-ansi": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha1-Z+FFz/UQpqaYS98RUpEdadLrnkM=",
       "license": "MIT",
       "dependencies": {
         "ansi-styles": "^4.0.0",
@@ -19412,14 +19411,14 @@
     },
     "node_modules/wrappy": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "resolved": "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
       "license": "ISC"
     },
     "node_modules/write-file-atomic": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-3.0.3.tgz",
-      "integrity": "sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/write-file-atomic/-/write-file-atomic-3.0.3.tgz",
+      "integrity": "sha1-Vr1cWlxwSBzRnFcb05q5ZaXeVug=",
       "license": "ISC",
       "dependencies": {
         "imurmurhash": "^0.1.4",
@@ -19430,8 +19429,8 @@
     },
     "node_modules/ws": {
       "version": "7.5.11",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.11.tgz",
-      "integrity": "sha512-zS54Oen9bITtp7kp2XM3AydrCIq1D+HwJOuH+c+e4LfpL/lotP5osijd+UoMnxwAam1GN8R4KtLAyIrIcBNpiA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/ws/-/ws-7.5.11.tgz",
+      "integrity": "sha1-lGDa8YEruBpCPFuerHRpQahjEPo=",
       "license": "MIT",
       "engines": {
         "node": ">=8.3.0"
@@ -19451,20 +19450,20 @@
     },
     "node_modules/xml-name-validator": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/xml-name-validator/-/xml-name-validator-3.0.0.tgz",
-      "integrity": "sha512-A5CUptxDsvxKJEU3yO6DuWBSJz/qizqzJKOMIfUJHETbBw/sFaDxgd6fxm1ewUaM0jZ444Fc5vC5ROYurg/4Pw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/xml-name-validator/-/xml-name-validator-3.0.0.tgz",
+      "integrity": "sha1-auc+Bt5NjG5H+fsYH3jWSK1FfGo=",
       "license": "Apache-2.0"
     },
     "node_modules/xmlchars": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
-      "integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/xmlchars/-/xmlchars-2.2.0.tgz",
+      "integrity": "sha1-Bg/hvLf5x2/ioX24apvDq4lCEMs=",
       "license": "MIT"
     },
     "node_modules/y18n": {
       "version": "5.0.8",
-      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
-      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/y18n/-/y18n-5.0.8.tgz",
+      "integrity": "sha1-f0k00PfKjFb5UxSTndzS3ZHOHVU=",
       "license": "ISC",
       "engines": {
         "node": ">=10"
@@ -19472,14 +19471,14 @@
     },
     "node_modules/yallist": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
-      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha1-27fa+b/YusmrRev2ArjLrQ1dCP0=",
       "license": "ISC"
     },
     "node_modules/yaml": {
       "version": "1.10.3",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz",
-      "integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/yaml/-/yaml-1.10.3.tgz",
+      "integrity": "sha1-duQH7ZXEJoT7jhRkHl3mL+ZbvLM=",
       "license": "ISC",
       "engines": {
         "node": ">= 6"
@@ -19487,8 +19486,8 @@
     },
     "node_modules/yargs": {
       "version": "16.2.2",
-      "resolved": "https://registry.npmjs.org/yargs/-/yargs-16.2.2.tgz",
-      "integrity": "sha512-Nt9ZJjXTv5R8MHbqby/wXQ6Gi0Bb3TcYZkR1bzuL4yB2OxWPkXknz513gEF0GoA6tn00UpbPvERW8rzCuWCA6w==",
+      "resolved": "https://ms-feed-2.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/yargs/-/yargs-16.2.2.tgz",
+      "integrity": "sha1-xWcx3KDSeIrghm3TyDkH1rq4X30=",
       "license": "MIT",
       "dependencies": {
         "cliui": "^7.0.2",
@@ -19505,8 +19504,8 @@
     },
     "node_modules/yargs-parser": {
       "version": "20.2.9",
-      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz",
-      "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==",
+      "resolved": "https://ms-feed-17.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/yargs-parser/-/yargs-parser-20.2.9.tgz",
+      "integrity": "sha1-LrfcOwKJcY/ClfNidThFxBoMlO4=",
       "license": "ISC",
       "engines": {
         "node": ">=10"
@@ -19514,8 +19513,8 @@
     },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "resolved": "https://ms-feed-12.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha1-ApTrPe4FAo0x7hpfosVWpqrxChs=",
       "license": "MIT",
       "engines": {
         "node": ">=10"
diff --git a/src/app/package.json b/src/app/package.json
index 8a26aeaad..d1f33deba 100644
--- a/src/app/package.json
+++ b/src/app/package.json
@@ -12,6 +12,7 @@
     "axios": "^1.16.0",
     "chart.js": "^4.5.1",
     "d3": "^7.9.0",
+    "nanoid": "^3.3.18",
     "react": "^18.3.1",
     "react-chartjs-2": "^5.3.1",
     "react-dom": "^18.3.1",
diff --git a/src/app/public/startup.sh b/src/app/public/startup.sh
index 4f043553c..d86bb3e3b 100644
--- a/src/app/public/startup.sh
+++ b/src/app/public/startup.sh
@@ -9,4 +9,27 @@ else
   echo "runtime-config.js not found!"
 fi
 
+# Configure the /api reverse proxy. In private-networking mode the backend has
+# no public endpoint, so the SPA calls the frontend same-origin /api and nginx
+# forwards to the backend over the VNet. In public mode BACKEND_API_HOST is
+# empty and the SPA calls the backend URL directly, so no proxy is emitted.
+PROXY_CONF=/etc/nginx/conf.d/api-proxy.inc
+if [ -n "$BACKEND_API_HOST" ]; then
+  echo "Configuring /api reverse proxy to $BACKEND_API_HOST"
+  cat > "$PROXY_CONF" <<EOF
+location /api/ {
+    proxy_pass https://${BACKEND_API_HOST};
+    proxy_set_header Host ${BACKEND_API_HOST};
+    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto \$scheme;
+    proxy_ssl_server_name on;
+    proxy_http_version 1.1;
+    proxy_read_timeout 300s;
+    proxy_send_timeout 300s;
+}
+EOF
+else
+  : > "$PROXY_CONF"
+fi
+
 nginx -g "daemon off;"
diff --git a/src/app/src/api/client.ts b/src/app/src/api/client.ts
index cbd806dc4..b2b76cc1c 100644
--- a/src/app/src/api/client.ts
+++ b/src/app/src/api/client.ts
@@ -165,22 +165,6 @@ export const askQuestion = (
     document_ids: documentIds,
     conversation_id: conversationId,
   });
-export const sendConversation = (
-  messages: { role: string; content: string }[],
-  topK = 5,
-  filters?: Record<string, string>,
-  chatScope: "all" | "documents" = "all",
-  documentIds?: string[],
-  conversationId?: string
-) =>
-  apiClient.post("/rag/conversation", {
-    messages,
-    top_k: topK,
-    filters,
-    chat_scope: chatScope,
-    document_ids: documentIds,
-    conversation_id: conversationId,
-  });
 
 // Fetch the full content of a cited document (lazy, on citation click).
 // Matches the backend /rag/fetch-azure-search-content endpoint.